Parse notes
Sponsored
If you think compliance is going to be any easier in 2024, think again. New regulation and tighter enforcement [5] are likely to increase the resources you’ll need to spend on manual compliance tasks — unless you invest in automation. Drata [5] is trusted by thousands of security and compliance teams (e.g. at Postman, Lemonade, and Vercel). Drata gives you a single picture of compliance [5] so you can manage risk and improve your security posture.
LoanDepot shut down certain systems to implement measures to secure its business operations, bring systems back online, and respond to a recent ransomware attack. The unauthorized third-party activity included access to certain company systems and the encryption of data. Its impact still has to be estimated.
A new CI/CD attack that utilizes self-hosted GitHub runners to achieve arbitrary code execution has been reported. The default setup instructions for self-hosted GitHub runners features persistent runners and only requires approval for the attacker’s first request. Attackers can exploit the bug to poison images for major companies and even GitHub itself.
Researchers have discovered 23 vulnerabilities in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B, a network-connected wrench used in factories to assemble sensitive instruments and devices. Exploitation of these vulnerabilities could allow hackers to install malware that disables entire fleets of the devices or causes them to tighten fastenings too loosely or tightly.
This post is an analysis of the McAfee-reported iOS apps spreading via Korean phishing sites to steal user data. Unable to find the malicious iOS .ipa on malware sites, the author conducted his own investigation starting from the phishing links to download and analyze the apps.
Phishing attacks against Microsoft 365 are rising due to its wide use and MFA bypass techniques like AiTM phishing. This post explains how to detect AiTM phishing on Microsoft Login pages.
This post presents a cost-minimization approach that utilizes Cognito Identity Pools to control authentication and authorization directly from a front-end app. The crux of the solution involves an IAM policy that utilizes DynamoDB Leading Keys to handle user separation. The post includes sample IAM roles and policies, a worked demo, and a list of advantages and disadvantages of this approach.
Galah is a web honeypot tool powered by LLM (currently only the OpenAI API). Leveraging LLMs, it processes incoming HTTP requests and dynamically crafts realistic responses on the fly to engage attackers.
Eraser helps Kubernetes admins remove a list of non-running images from all Kubernetes nodes in a cluster.
Asset inventory of over 800 public bug bounty programs.
NIST has published a guidance describing the various types of attacks that can be used to target artificial intelligence systems, warning AI developers and users that there is currently no foolproof method for protecting such systems. The agency has encouraged the community to attempt to find better defenses. The report covers both predictive and generative AI.
A post on the curl project’s struggle with researchers’ use of LLMs in their bug bounty program. The curl team receives a myriad of submissions that are generated at least in part by LLMs. These are often high-quality reports with fictional vulnerabilities. The post includes a few examples that show why these reports take more time to triage even if there is no real finding.
The Chinese Bureau of Justice has announced that it worked with a forensics firm to crack Apple’s anonymous AirDrops to track the use and spread of “inappropriate speech.” The firm reported that it was able to analyze iPhone logs for hashed values of senders' mobile numbers and emails, which it then cracked with a rainbow table.
The number of funding rounds increased from 303 in 2022 to 346 in 2023. Companies raised a total of $8.7 billion in 2023, compared to $14.5 billion in 2022, which represents a 40% drop.
X users who have shown interest in cryptocurrencies are reporting that their feeds are full of malicious crypto ads that lead to crypto drainers, fake airdrops, and other scams. MalwareHunterTeam and ScamSniffer have started tracking the volume of scams, and users have started leaving community notes on ads warning users about scams.
Portswigger has begun accepting nominations for its “Top 10 Web Hacking Techniques of 2023” roundup. The announcement includes a list of preliminary nominations that feature interesting web hacking techniques.