Parse notes
Researchers from IIIT Hyderabad discovered a vulnerability that allows malicious apps to expose credentials when a user autofills with a password manager on Android. The attack involves tricking password managers into autofilling into the app as well as a Login with Google WebView.
Researchers have discovered a new flaw, tracked as CVE-2023-45866, that allows for remote code execution on Android, iOS, macOS, and Linux Devices. The attack deceives the target into thinking that it’s connected to a Bluetooth keyboard by taking advantage of an unauthenticated pairing mechanism that’s defined in the Bluetooth specification. No specialized hardware is needed for the attack, which allows attackers in Bluetooth proximity to inject keystrokes into a vulnerable device.
Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.
This post breaks down a process for hunting malicious open-source infrastructure by identifying hardcoded headers or static strings that are included in the application. It includes two worked examples using Responder and Havoc C2. This is part of a series of posts on techniques to hunt malicious infrastructure.
This post goes step by step on how the author identified three Symfony RCEs. Symfony is a free and open source PHP framework that makes web development faster and easier.
This post analyzes the 2017 WannaCry ransomware attack which rapidly spread by exploiting Windows vulnerabilities, encrypting files, and demanding cryptocurrency payments to decrypt them. It reviews key indicators of WannaCry's behavior, a YARA rule to detect it, and discusses the malware's unorthodox "kill switch" domain check which ultimately halted its spread.
TInjA is a CLI tool for testing webpages for template injection vulnerabilities. TInjA currently supports 44 different templating engines and can scan for SSTI and CSTI.
Bambdas is a new feature of Burp Suite that allows for customization of the Burp Suite UI from the GUI using Java snippets. Bambdas is meant to allow users to customize the functionality of Burp Suite and add in utility that is needed for them. Examples of Bambdas and helpful snippets are provided in the post.
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM platforms and in CI environments.
This report found that AppSec chaos reigns, with 78% of CISOs responding that today’s AppSec attack surfaces are unmanageable and 90% of responders confirming that relationships between their security and development teams need to improve. Surprisingly, 77% of CISOs believe software supply chain security is a bigger blind spot for AppSec than Gen AI or open source.
Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.
The total number of data breaches more than tripled between 2013 and 2022 — exposing 2.6 billion personal records in the past two years alone — and has continued to get worse in 2023. Ransomware and vendor attacks contributed in a major way to the sharp increase in data breaches and resulting compromise of sensitive records. The number of ransomware attacks in the first nine months of 2023, for instance, was 70% higher than the same period in 2022.
EDR-Telemetry is a project that lists telemetry features from EDR providers and other endpoint agents. The motivation of this project is to allow security practitioners to quickly compare and evaluate the telemetry potential of those providers.
The Australian and New Zealand Nissan Corporation and Financial Services has advised that its systems were subject to a cyber incident. Nissan is working to investigate the extent of the incident and whether any personal information has been accessed.
Hacktivists hacked a small water utility in the Erris area of Ireland and interrupted the water supply for two days. The cyber attack impacted 180 homeowners and the Eurotronics water pumping system. The attackers defaced the user interface of the water-pumping system.