Parse notes
Google TAG discovered an exploit in the Zimbra email server 0-day (CVE-2023-37580) in the wild. It was used by 4 groups to steal emails, credentials, and tokens even after a public fix was released. This post-disclosure activity shows that delays leave orgs vulnerable. It urges rapid patching and updates to protect against ongoing exploits of known bugs.
Royal Mail’s parent company has revealed the infrastructure cost associated with the LockBit attack in January will cost the business £10 million ($12.4 million). The total costs related to the attack are likely to be higher, but no figures have been shared.
The is_user_admin function of the WP Fastest Cache plugin extracts the username from cookies to check if a user is an admin. However, the username is not sanitized and thereby can lead to SQL injection. A patched version of the plugin has been released. WPScan will be releasing its proof-of-concept exploit on November 27, 2023.
This blog post series offers a gentle introduction to Rego, the policy language from the creators of the Open Policy Agent (OPA) engine. The series goes over basic Rego concepts and how to get started with OPA, intermediate Rego syntax, and types of values and rules.
The FBI and Cybersecurity and Infrastructure Security Agency (CISA) have released an advisory about Scattered Spider, a hacking collective that collaborates with ALPHV/BlackCat ransomware. Scattered Spider uses social engineering tactics and phishing to gain initial network access. It is a network of individuals with different threat actors participating in each attack.
Amazon ECS allows for the use of EC2 instances as a container host to increase user control over the ECS environment. This tutorial from AWS walks through the process of setting up an EC2 Image Builder pipeline that begins with an Amazon ECS Optimized AMI and then applies the CIS Docker host benchmarks to the AMI. It then goes through how to use a Lambda step function to update the ECS fleet with the new AMI. The walkthrough includes a CloudFormation stack to deploy the infrastructure automatically.
Aikido is an all-in-one solution that brings together multiple aspects of application security in one platform, including SAST, DAST, SCA, and CSPM.
AI Exploits is a collection of exploits and scanning templates for responsibly disclosed vulnerabilities affecting machine learning tools. Each tool has subfolders that contain metasploit modules, nuclei, or CSRF templates.
Turbo Intruder is a Burp Suite extension that allows for sending large numbers of HTTP requests and analyzing the results. It takes a Python script and thus allows for highly configurable payloads and analysis. Turbo Intruder can also be used to enable high-speed Intruder usage on Burp Community edition.
Thomas Kennedy McCormick, aka ‘Fubar’, a 30-year-old from Cambridge, Massachusetts, has been sentenced to 18 years in prison for his role in running Darkode. Investigators said Fubar was involved in the distribution of malware, hacking websites, as well as the theft and sale of personally identifiable information, payment cards, and bank account credentials.
Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code repository for the Python programming language. Nearly 3,000 projects contained at least one unique secret. Many secrets were leaked more than once, bringing the total number of exposed secrets to almost 57,000.
An in-depth look at the three young cybercriminals behind the Mirai botnet. While none of the cybercriminals involved fit the mold of traditional cybercriminals, they successfully took down large swaths of the internet.
Rhysida - a ransomware-as-a-service - that has compromised organizations in education, manufacturing, and information technology, has been released by the CISA, FBI, and MS-ISAC as an advisory.
Following a lack of direct response from MeridianLink, AlphV, who has claimed to have breached Meridian Link, filed a complaint to the SEC alleging that MeridianLink did not disclose a breach of customer data. MeridianLink claims that no production data was accessed.
A report from Datadog analyzing the security posture data from a sample of thousands of organizations using AWS, Azure, or Google Cloud found that many cloud workloads are excessively privileged. Specifically, long-lived credentials, MFA for cloud access, and IMDSv2 are not sufficiently enforced.