Parse notes
EasyPark Group, Europe’s largest parking application operator, has disclosed a data breach impacting customer information. Data stolen by hackers includes name, phone number, physical address, email address, and partial IBAN or credit/debit card numbers.
Mortgage servicing firm LoanCare has started informing more than 1.3 million individuals about a data breach impacting their personal information. The attackers have exfiltrated data from FNF’s systems, including personal information such as names, addresses, Social Security numbers, and loan numbers.
Researchers have unveiled new findings surrounding an attack that backdoored iPhones belonging to Kaspersky employees. Operation Triangulation exploited 4 zero days including an undocumented hardware feature which allowed for an unprecedented level of access. The malware was delivered via an iMessage text that kicked off an incredibly complex kill chain that begins with a zero-day in Apple’s TrueType font implementation and includes several other complex techniques.
This blog post explains the class of vulnerabilities known as parser mismatch vulnerabilities. These are caused by two systems parsing data differently. This class of vulnerabilities includes vulnerabilities such as HTTP Request Smuggling and URL parsing vulnerabilities. Examples are included in the post.
This post walks through five different CodeQL queries that can be used to catch potentially serious bugs in the OpenSSL libcrypto API that can cause memory leaks, authentication bypasses, and other cryptographic issues. It encourages developers and code reviewers to use tools like CodeQL to build and share queries to secure their code.
The God Mode Security Rules Repository is dedicated to hosting “god mode” rules that can detect as many threats as possible with minimal false positives. It currently contains a YARA rule with a Sigma rule in progress.
This suite of tools helps decrypt data encrypted by the Black Basta group.
Store and retrieve encrypted secrets with PowerShell on Windows, Linux, or macOS and also from KeePass 2 databases on Windows.
Google has agreed to settle a lawsuit filed in June 2020 that alleged that the company misled users by tracking their surfing activity who thought that their internet use remained private when using the "incognito" or "private" mode on web browsers. The class-action lawsuit sought at least $5 billion in damages. The settlement terms were not disclosed.
An attacker with access to a Kubernetes cluster can chain two vulnerabilities in Google Kubernetes Engine (GKE) to escalate privileges and take over the cluster. The recently identified vulnerabilities in FluentBit and ASM can be exploited as part of the second stage of an attack, provided that the attacker has achieved remote code execution in the FluentBit container or that they can break out of another container.
In an effort to combat stalking, Apple modified its location privacy system for AirTags by reducing the frequency of key rotations to allow for better identification of malicious AirTags at a sacrifice of privacy. Researchers have devised a cryptographic scheme that blends secret sharing and error correction coding to better preserve user privacy while also allowing for anti-stalking detection. The group of researchers has proposed their scheme to a consortium of Apple, Google, and other companies working on this issue.
Nissan has confirmed that an unauthorized third party illegally accessed some of the company’s network systems. Akira has taken credit for the attack, claiming to have stolen 100 GB of data, including corporate files and personal information belonging to employees.
A guide from TryHackMe on preparing for security engineer interviews. The guide includes helpful general interview tips as well as sample technical questions and scenarios with answers.
NASA has released its Space Security Best Practices Guide, aimed at enhancing the cybersecurity efforts of both public and private sector space activities.