Parse notes
Law firm Orrick has disclosed a 2023 breach impacting over 600,000 individuals. Attackers accessed a file with client data between February 28 and March 13. Orrick found no further unauthorized activity after detecting the incident on March 13. Notification letters were sent starting June 2023. Exposed personal information included names, SSNs, passport numbers, and financial account details.
This article describes how Telco Orange Spain experienced an outage due to a BGP hijack that resulted in a 50% drop in traffic from Orange Spain customers. The threat actor gained access to Orange's RIPE account, which manages internet IP addresses. The account had weak security measures, such as no two-step authentication and a lack of password policy.
Hackers breached the Flight Information Display System and Baggage Handling System at Beirut International Airport Rafic Hariri in Lebanon. The cyber attack disrupted the baggage inspection system, forcing personnel to use police dogs to complete the inspection procedures. No threat actor has claimed responsibility for the attack.
This article shares a collection of scripts and tools that helps anyone get started with vulnerability assessments and penetration testing with an optimized workflow. The setup identifies open ports, missing headers, weak crypto, hidden files, subdomains, and more, requiring only the target domain name. It runs on any Docker-compatible OS.
A post from GitHub explaining how it tamed its disparate vulnerability remediation processes with the creation of a Security Findings tool. The tool features a dynamic UI that can aggregate findings from various sources and display them at various levels to suit developer experience. The post also discusses the changing requirements that led to folding security exceptions into the tool.
This blog post discusses preventative measures that can be taken to ensure secure defaults in AWS. The post includes tools to prevent public exposure of resources, prevent some risky behaviors, and enforce security measures. This is part of a series and assumes that SCPs from a previous post have been applied.
Sponsored
Nucleus [11] integrates with your existing security tools to aggregate, normalize, prioritize, correlate and act on all of the vulnerability data in your enterprise [11].
A reconnaissance tool for capturing and displaying SSIDs from a device's Preferred Network List.
ShellSweep is a tool that detects potential web shells in servers. The tool includes three utilities that work together (ShellScan, ShellCSV, and ShellSweep) to provide a comprehensive defense against web shells. The article suggests using the tools alongside regular audits.
A VSCode extension that allows users to generate live graphs of Terraform resources as they write Terraform code.
A threat actor recently sold the Zeppelin ransomware source code for just $500, potentially reviving the Russian ransomware, which has been used in the past in attacks on critical US infrastructure. Zeppelin is a VegaLocker derivative written in Delphi. The CISA and FBI released IoCs on Zeppelin TTPs in 2022. This cheap sale may signal a ransomware-as-a-service revival.
Bitwarden's Windows Hello implementation had an unexpected consequence - allowing remote theft of credentials without knowing the password or requiring biometric authentication. The issue enabled accessing Bitwarden vaults on compromised workstations without end-user interaction. It has since been fixed in v2023.4.0.
AWS launched a new feature of EKS called Cluster Access Management to simplify granting and managing access to EKS clusters. This new feature broadly allows managing access to an EKS cluster via the AWS API. This allows for mapping AWS identities to pre-defined AWS-managed Kubernetes permissions, mapping AWS identities to Kubernetes groups, and gaining visibility into shadow admins.
This post dives into the newly released CVEs of 2023. We ended 2023 with 28,902 published CVEs, up over 15% from the 25,081 CVEs published in 2022.
Merck has settled a dispute with insurers over a $1.4 billion claim related to the NotPetya malware incident that disrupted its operations worldwide in 2017.
Keybase suffered an outage as the New Year started that was caused by a root CA expiring. Users must manually update their apps to restore functionality.