Parse notes
GitHub is struggling to contain an ongoing attack that is flooding the site with millions of malicious code repositories mimicking legitimate ones. The fake repositories contain hidden malware that steals passwords and cryptocurrency from developers. Removing the repositories is like playing whack-a-mole as some malicious forks are surviving and getting re-forked, compounding the problem.
A database belonging to YX International, which routes millions of SMS messages daily, was left exposed online without a password. The database contained sensitive one-time passcodes that grant access to accounts on Facebook, Google, and TikTok. The company secured the database after being contacted by a security researcher.
Taiwan's defense ministry has confirmed that hackers stole sensitive military and government documents from Chunghwa Telecom and sold them online. The breach, initially reported by TVBS, included 1.7TB of data that the hackers claim contains contracts and information from the armed forces, foreign ministry, and coast guard.
As AI advances, serious questions arise about its potential impacts on society. Could it destroy civilization, turn us into zombies, or view humans as we view dogs? While AI poses risks, thoughtful regulation and ethical development can help realize benefits and avoid pitfalls depicted in sci-fi like 2001: A Space Odyssey with HAL. This post dives into the current ways we are preparing against AI as a society.
Terraform can be configured to store state files in a remote backend. This post looks at how attackers can leverage compromised state files. It begins by demonstrating how an attacker could cause AWS resource deletion by confusing a Terraform user into applying a modified state file that results in resource deletion. It then goes on to demonstrate the process of writing and publishing a malicious Terraform provider that can execute code upon Terraform plan or apply and then demonstrates how this can be combined with state file modification to hijack CI/CD systems.
This post begins with an overview of what passkeys are and how they work. The post then discusses threat models around phishing, stolen credentials, and MFA as they relate to passkeys. It concludes with a warning not to implement WebAuthn manually before providing some implementation considerations for passkeys.
Sponsored
Web applications have critical vulnerabilities that only dynamic
with Veracode [11]: ✅ <5% false positive rate
My Privacy DNS' "Matrix" project is a handcrafted and completely self-managed DNS Firewall through Response Policy Zones.
reconFTW is a tool designed to perform automated recon on target domains by running the best set of tools for scanning and finding vulnerabilities
The Bluetooth Landscape Exploration & Enumeration Platform (BLEEP) can be used for enumerating Bluetooth devices. It can also be used to automate Bluetooth vulnerability discovery.
The Biden administration issued an executive order on February 28th identifying "countries of concern" that exploit Americans' personal data as a national emergency. The order aims to prevent these unspecified countries from accessing bulk sensitive data about Americans. It cites the vast commercial data market selling people's information as a crisis necessitating action.
With security improvements to endpoints, cyber threats have shifted to the perimeter. Many perimeter devices are not built to be secure by design and therefore are ripe targets for exploitation.
Attribute-based access control can be implemented in AWS via tags that store attributes on both Principals and Resources. This post looks at improvements to ABAC since 2020 as well as issues that remain.
A U.S. judge has ordered NSO Group to hand over its source code for Pegasus and other products to Meta as part of the social media giant's ongoing litigation against the Israeli spyware vendor.
Semgrep Code now supports static analysis for C and C++. Exclusive to the platform, static analysis parses source code before macro expansion, bypassing the complexities associated with C/C++ analysis.