Parse notes
American Vision Partners faces a class action lawsuit over a data breach that impacted 2.35 million patients. The unauthorized access resulted in patients' personal info, medical data, SSNs, and insurance details being stolen. A law firm specializing in data breach-related class action lawsuits is urging affected patients to get in touch as it may file a lawsuit against AMV’s parent company.
Approximately 100 organizations have had their SSH credentials stolen using a recently released open source pentesting tool with worm-like capabilities. The tool is completely self-replicating and self-propagating — and completely fileless. In many ways, SSH-Snake is actually a worm: it replicates itself and spreads itself from one system to another as far as it can.
Australian telco Tangerine suffered a data breach that resulted in 230,000 customers' personal information being exposed. The exposed information included full names, dates of birth, mobile numbers, postal addresses, email addresses, and Tangerine account numbers. Tangerine's CEO stated that the breach was caused by leaked credentials to a legacy customer database belonging to a contractor.
A team of researchers has released a set of attacks called VoltSchemer that take advantage of hardware security flaws in wireless charging standards. Attackers can use finely tuned voltage fluctuations within wireless chargers to create interferences in the regular data exchange between the charger and smartphone. The researchers demonstrated that these interferences can be used to overheat a phone, bypass Qi safety standards, and even inject voice commands.
Hackbots are automated systems that use AI in a meaningful way to find vulnerabilities. This post covers a PoC of several hackbots, including some that are commercially sold. Hackbots could become integral tools in testing software for vulnerabilities before release or as part of an internal bug bounty program.
The team at Neodyme has found a method to reveal hidden GitHub commits. The GitHub PushEvent API can be used to retrieve the hashes of commits that have been hidden using a force push. The commit can then be retrieved via the discovered hash. Neodyme has released a tool for discovering secrets via this method.
Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data. It is useful for both offensive and defensive security testing.
Infisical is an open-source secret management platform that can be used by teams to centralize their secrets, like API keys, database credentials, and configurations.
Awesome Pentest Cheat Sheets is a collection of cheat sheets for use in pentesting. The cheat sheets are divided by phase, platform, purpose, tools, and other categories.
A new version of the Lucifer botnet is currently targeting Apache Hadoop and Apache Druid deployments. Researchers from Aqua Nautilus, who have been monitoring the campaign, have counted more than 3,000 unique attacks targeting its Apache Hadoop, Apache Druid, and Apache Flink honeypots in just the last month alone.
The high-risk ConnectWise flaw is an authentication bypass vulnerability that allows attackers to remotely steal confidential data from vulnerable servers or deploy malicious code such as malware. ConnectWise's SaaS customers were patched within 48 hours, but 8,800 ConnectWise servers remain vulnerable to exploitation.
A suspected North Korea-linked malware sample, believed to be KONNI, was discovered targeting the Russian Ministry of Foreign Affairs. It was found bundled into a backdoored version of Statistika KZU, a Russian language software installer intended for internal use within the Russian Ministry of Foreign Affairs for relaying annual report files from consular posts.
Apple is integrating a new post-quantum cryptographic protocol called PQ3 into iMessage to protect against future attacks from quantum computers.
Rob Joyce, the director of the NSA, has announced plans to step down at the end of March. Joyce has led the NSA since 2021 and served in the NSA for a total of 34 years.
The U.S. Federal Trade Commission (FTC) imposed a $16.5 million fine on Avast for selling users' browsing data to advertisers despite claiming its products would prevent online tracking.