Parse notes
An unprotected database belonging to Real Estate Wealth Network was accessible from the internet for an unknown period. The unprotected database was 1.16 terabytes in size, containing more than 1.5 billion records. Britney Spears, Floyd Mayweather, Dave Chappelle, Elon Musk, Dolly Parton, Mark Wahlberg, Nancy Pelosi, and others have been affected.
The data breach disclosed recently by Comcast’s Xfinity impacted nearly 36 million individuals, the company told US authorities. Hackers gained access to customer usernames and hashed passwords as well as names, dates of birth, contact information, secret questions and answers, and the last four digits of social security numbers in some cases.
Microsoft has warned that Iranian cyber-espionage group APT33 is using new backdoor malware called FalseFont to target defense contractors worldwide. FalseFont provides remote access to compromised systems and file transfer to its command-and-control (C2) servers. Microsoft has advised network defenders to reset credentials for accounts targeted in password spray attacks and reset any remote access options like RDP.
In this blog post, the researchers describe a detailed analysis of the Menorah Malware, originally discovered by Trend Micro in August and used by APT34. The malware creates a mutex to ensure only one copy runs at a time and extracts the hostname and username to compute a hash that identifies the infected machine. It can perform commands such as creating new processes, listing files and subdirectories, exfiltrating files, and downloading files using a hard-coded C2 server.
Chrome has implemented new mitigations to make it more difficult to exploit the v8 JavaScript engine. The "V8 Sandbox" project was developed as a way to isolate and protect v8. This document discusses Liftoff, v8's WebAssembly compiler, and highlights some interesting opcodes generated by Liftoff.
This blog post provides a pathway to getting started in code review. The post suggests starting out with small vulnerable code snippets before moving on to CVE patches and then finally full libraries. It was written in 2021 and therefore does not make any mention of AI assistants like ChatGPT or Copilot.
A static analysis security vulnerability scanner for Ruby on Rails applications.
Dynamic instrumentation toolkit for developers, reverse engineers, and security researchers.
FARA, or Faux YARA, is a simple repository that contains a set of purposefully erroneous Yara rules. This is intended to be used for training for security analysis and for even Yara veterans to keep their skills up.
In this blog post, the researchers delve into an analysis of the web injection utilized in the recent malware campaign, its evasive techniques, code flow, targets, and the methods employed to achieve them.
This report uncovers a stealthy cross-platform Go malware stealer dubbed JaskaGO, which evades many antivirus solutions. JaskaGO poses a severe Windows & macOS threat as its extensive C2 command set enables advanced system persistence and data exfiltration. The focus of this stealer is sensitive user info like browser logins and crypto wallets.
Post URLs on X use the format https://twitter.com/[account_name]/status/[status_id]. The account_name is not validated. Security researchers have reported that crypto scammers have been making use of this “feature” to post crypto scams and fake giveaways while making the URL appear to be from legitimate accounts such as Binance.
Google has released an update for Google Chrome, patching a new zero-day high vulnerability CVE-2023-7024 that has already been seen exploited in the wild. It is recommended to update ASAP.
A collection of the top-rated talks from SANS Summits in 2023. The talks cover a broad range of topics in the industry.
The FTC has banned Rite Aid from using AI facial recognition software in its stores for 5 years due to a lack of comprehensive safeguards. The FTC alleges that Rite Aid’s technology falsely tagged customers, with a bias against women and people of color.