Parse notes
Hyundai India has fixed a bug that exposed customer data, including names, addresses, emails, phone numbers, and vehicle details. The flaw leaked data through WhatsApp links shared after vehicles were serviced. The links were automated without human involvement. Hyundai said systems get periodic reviews and updates and that it strives to safeguard data.
GitLab has released updates for two critical vulnerabilities, including CVE-2023-7028 for account takeover without user interaction by resetting passwords via unverified emails. CVE-2023-7028 has a 10.0 CVSS score. GitLab has released patches to address the critical flaws.
Bitdefender Labs discovered that the Bosch BCC100 thermostat is vulnerable to cyber attacks that allow attackers to manipulate settings and install malware on the device. The vulnerability was discovered on August 29, 2023, and Bitdefender responsibly disclosed the flaw on January 11, 2024.
Open-source intelligence (OSINT) involves collecting and analyzing publicly available information. It is used by security pros, hackers, and intelligence agencies to uncover sensitive details. OSINT complements operational security (OPSEC). Organizations use it to find exposed data that could help attackers. This list goes into what are some top OSINT tools for analyzing public data, identifying security risks, and improving practices.
SentinelOne researchers have reported a new hacking toolkit called Fbot. The tool features credential harvesting techniques, AWS account hijacking tools, and functions to enable attacks against PayPal and other SaaS accounts. It utilizes a Lithuanian fashion retailer to validate PayPal credentials.
This blog post provides an overview of available data sources and methods for detecting initial access to Microsoft 365 environments. It covers how the Unified Audit Log and Azure AD logs can be utilized for detection. It then covers techniques and queries for detecting the following attack methods: password spraying, illicit consent grants, device code phishing, MFA fatigue, MFA enumeration, and adversary in the middle.
Venera is a tool for automating customized tests and attacks against many kinds of protocols. It relies on a scripting engine based on the Lua scripting language that makes it possible to create modules for all types of checks and exploits.
EZGHSA is a command-line tool for summarizing and filtering vulnerability alerts on GitHub repositories.
Jason Haddix has published his personal GPT for offensive security. It is meant to act as a peer to aid ethical hackers with up-to-date research and methodology.
The Medusa ransomware group has increased attacks after launching a dark web leak site in February 2023 to publish data from victims refusing to comply with demands. The group's multi-extortion strategy offers victims options like extensions or data deletion for a price. Medusa emerged in 2022 and targets diverse sectors, impacting 74 organizations in 2023. Its attacks exploit internet-facing vulnerabilities and hijack accounts, often using initial access brokers for network access.
Researchers have identified attacks exploiting Apache Hadoop and Flink misconfigurations to deploy crypto miners. The malware uses packers and rootkits to hide, delete contents, and modify configs for evasion. Hadoop attacks abuse a YARN ResourceManager misconfiguration, allowing remote code execution via crafted requests and Flink attacks similarly to achieve unauthenticated remote code execution by targeting a misconfiguration.
The Finnish National Cybersecurity Center has warned of increased activity of the Akira ransomware in December, with six out of seven ransomware incidents reported last month being attributed to the ransomware. The ransomware has been wiping backups, which amplifies the damage of the attack and puts more pressure on victims to pay the ransom.
The chair of the FCC has formally requested that automakers provide plans to prevent abusive partners from using car features that collect location data to stalk partners.
The ACLU recently discovered a typo in a geofence warrant that led to the collection of personal information of users in a two-mile span of San Francisco. The ACLU is using this issue to put a spotlight on the overly wide reach of geofence warrants.
A 29-year-old Ukrainian national has been arrested for running a sophisticated cryptojacking scheme that earned them over $2 million in illicit profits.