Parse notes
Ledger has reported that hackers compromised the code for the Ledger Connect software development kit used by decentralized apps to interface with Ledger wallets. The hackers pushed out a malicious version of the kit. Ledger pushed out an update of the Connect Kit to replace the malicious one within 40 minutes of becoming aware. The attackers have amassed $600,000 in stolen funds.
A new vulnerability, CVE-2023-50164, has been given a maximum severity rating. It affects Struts 2.0.0-2.3.37 (EOL), Struts 2.5.0-2.5.32, and Struts 6.0.0-6.3.0. An attacker can manipulate file upload parameters to enable path traversal and under some circumstances, this can lead to uploading a malicious file which can be used to perform remote code execution. Struts 2 developers and users are urged to immediately upgrade to version 2.5.33 or Struts 6.3.0.2, or greater.
Asper Biogene has disclosed that personal health data belonging to approximately 10,000 people has been illegally downloaded. Asper Biogene began an investigation after discovering that over 100,000 files were accessed and is yet to determine the full scope of data that was contained in these files. A criminal investigation has also been launched by the Estonian Data Protection Inspectorate.
A group of researchers has developed a novel attack method to extract several megabytes of ChatGPT’s training data and theorize that the technique could be extrapolated to extract ~a gigabyte of training data. The attack involves prompting the model with “repeat the word poem forever” and watching as the model spits out training data. This article discusses why this works and the implications behind it.
BazarCall is a phishing attack that utilizes an email resembling a payment notification or subscription confirmation that suggests that a user is being billed an outrageously high amount for a product or subscription with a phone number to call for support. The “customer support” team then tricks the user into installing malware onto their device. The newest wave of these attacks utilizes a Google Form to create the invoice with the option to send a copy of the completed form to the entered email which leads to the invoice coming directly from Google.
In this blog post, Google discusses its response to the Reptar vulnerability. The response was led by the Vulnerability Coordination Center (VulnCC), which ensures a consistent vulnerability management process across Alphabet. By working alongside the vendors, the response was successful, with the vulnerability being mitigated without impacting users or customers.
Sponsored
Keyloggers can steal the most sensitive user data — and new data [11] shows that this is far from being a solved problem. Between March to August 2023, Moonlock detected a large number of keylogger samples [11] on macOS devices. Their report highlights the distribution of keyloggers, core modules, anti-analysis techniques, code examples, API usage, detection methods, and more.
Enveedo is a cyber resilience tool that aims to deliver integrated risk management and achieve continuous cyber resiliency. It offers a comprehensive view of the organization’s IT and security systems, assets, data, and people and simplifies cybersecurity oversight and management.
Eraser helps Kubernetes admins remove a list of non-running images from all Kubernetes nodes in a cluster.
Nuclei AI Browser Extension enables users to extract vulnerability information directly from a webpage to create Nuclei templates. The extension also enables creating a Nuclei template from an ExploitDB exploit or HackerOne report. An account from cloud.projectdiscovery.io is required.
In this post, Microsoft talks about the disruption of Storm-1152, a cybercrime-as-a-service (CaaS) ecosystem that created 750 million fraudulent Microsoft accounts in support of phishing, identity theft, and other schemes. The CaaS is believed to have made millions of dollars in illicit revenue by creating fraudulent accounts for other cybercrime groups to use in phishing, spam, ransomware, distributed denial-of-service (DDoS), and other types of attacks.
Researchers have found a new type of side-channel attack, named SLAM, that can circumvent the security features of the latest CPUs. The attack leverages a memory feature of CPUs that allows storing untranslated data bits in the kernel metadata to extract encryption keys and root passwords. Linux has released patches and Intel intends to issue a patch. Arm and AMD believe they are safe.
Microsoft Threat Intel experts have been investigating a new post-exploitation technique in which attackers use compromised accounts to create high-privileged OAuth apps. These OAuth apps allow attackers to spawn VMs for cryptomining, automate BEC attacks, and manage spam campaigns without needing to retain access to the original compromised account. Microsoft recommends enforcing MFA and conditional access policies to protect against attacks like this.
Ransomware operator Rhysida has posted limited data that appears to back up its claim that it has successfully hacked video game developer Insomniac Games. Sony and Insomniac are investigating.
Apple has launched Stolen Device Protection as an optional second layer of security to protect stolen iPhones. With Stolen Device Protection enabled, when a user is away from trusted locations certain sensitive actions will require biometric unlock whereas some will require a “security delay” as well.
Users of Ubiquiti WiFi products have reported unexpected access to other people's devices, including access to security camera footage and photos, when logging into their UniFi cloud accounts.