Parse notes
Sponsored
As enterprises race to adopt AI, CISOs and other cybersecurity leaders have a critical role to play. AI implementations have to be compliant and secure for business to reap the full productivity gains they expect to see. Download this checklist by SecureFrame [5] for step-by-step guidance on how you can effectively implement AI while addressing concerns related to transparency, privacy, and security.
Cloudflare has provided an update on a breach from October 2023 when a threat actor accessed its internal systems using stolen Okta credentials. Not rotating the compromised tokens post-Okta breach enabled access to Cloudflare’s Atlassian suite. No Cloudflare customer data or systems were impacted by this event.
Clorox disclosed that a 2023 cyber attack has already cost it $49M. The company estimates that the attack will cost another $50-60M in FY24. There are still no details about the attack but it is suspected that it was a ransomware attack.
AnyDesk reported that it suffered a cyberattack in which threat actors breached production systems. The attackers stole source code and code signing keys. AnyDesk has released a new version with new code signing keys and has reset the web portal passwords of all users.
This post enumerates methods for escalating privileges on EC2 instances to root/System by modifying the instance’s user data. An attacker can create a new user data script if an instance has the ec2:ModifyInstanceAttribute permissions, replace the old user data with it, and restart the instance. The post covers a method that can be used if the EC2 instance pulls user data scripts or artifacts from S3 and has permissions to modify those buckets.
This post provides a deep dive into an incident that Invictus responded to. The threat actor was unique in that it utilized a new method of persistence in which it set up a cross-account role. The post divides the threat actor's activities into three primary phases of attack and delves into the motives and impact of each one.
This article covers the sequence of events that led to the Microsoft breach disclosed on January 25, 2024. The article contains diagrams that describe the flow of events as well as information about the breached systems. It also provides detailed instructions for identifying and investigating these applications using the Azure portal.
Chalk captures metadata at build time. It can add a small 'chalk mark' (metadata) to any artifacts so they can be identified in production. Chalk can also extract chalk marks and collect additional metadata about the operating environment when it does this. It can be used to create software security supply chain compliance reports automatically.
Prompt Security safeguards every interaction with GenAI in its organization, such as internal AI tools and commercial products with AI features, by checking each prompt and model response to protect against exposure of sensitive data, block harmful content, and prevent other GenAI-specific attacks.
Objection is a runtime mobile exploration toolkit powered by Frida that helps assess the security posture of mobile applications without a jailbroken device. It can be used to interact with the container file system, for SSL unpinning, and for memory dumping and patching.
The HeadCrab malware that targets Redis databases has been updated with new evasion techniques like fileless loading nearly a year after it was first disclosed. The crypto-mining campaign now has over 2,300 infected servers, which shows the threat actor is adapting to stay under the radar. HeadCrab 2.0 uses advanced techniques for stealth and persistence, demonstrating the attacker's sophistication as it aims to secretly mine cryptocurrency.
Access Now, in collaboration with Citizen Lab and other organizations, conducted a forensic analysis of iPhones belonging to members of Jordan-based civil society. It confirmed that nine individuals were targeted and/or infected with Pegasus spyware, including journalists, lawyers, and members of civil society.
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to disconnect Ivanti Connect Secure or Ivanti Policy Secure devices from their networks due to reports of Chinese hackers targeting these devices for espionage operations. It has issued instructions for updating and bringing the devices back online.
Joseph Garrison was sentenced to 18 months for a credential-stuffing attack on DraftKings. He stole $600K total from around 1,600 accounts by adding new payment methods.
VentureBeat has published an analysis and spreadsheet of the best companies hiring for cybersecurity in 2024 based on LinkedIn postings and GlassDoor rankings. Kaspersky Lab, ServiceNow, and Cisco Systems lead the rankings.
Mastodon, a decentralized social network, has fixed a vulnerability that could be exploited by threat actors to impersonate and take over any account.