Parse notes
Russian hacking group Midnight Blizzard gained access to some of Microsoft's source code repositories and internal systems in a breach that was discovered in January. No customer-facing systems were compromised. The hackers attempted unauthorized access using exfiltrated Microsoft corporate email data, including secrets shared with customers.
Security researchers have revealed multiple vulnerabilities in Sceiner's smart lock firmware that allow attackers to manipulate its locks and open doors. The issues, which affect products sold by Sceiner and brands like Kontrol and Elock, include insecure cryptography, plaintext processing, and outdated protocols in the lock firmware and associated mobile app used for remote control.
A new social engineering campaign uses links resembling those generated by Skype, Zoom, and Google Meet to trick users into downloading RATs. The campaign targets Windows and Android users with specialized Trojan programs for each platform.
Applications have different mechanisms for importing dependencies. Executed libraries are dependencies that actually run. Library loading is when a dependency is imported and loaded into memory prior to usage. Runtime tracing can determine library usage.
Form hijacking is where an attacker exploits an HTML injection vulnerability by utilizing the formaction attribute or injecting their own form, thereby bypassing CSP. This is possible because the form-action directive was added in CSP v2 and is not covered by default-src. This post lists options to fix this and presents an overview of different scans in Burp Suite related to CSPs.
This post looks at statistical trends of vulnerabilities in the GitHub Advisory Database. The most common CWE associated with vulnerabilities was cross-site scripting. Maven was the ecosystem associated with the greatest number of vulnerabilities.
Sponsored
Security compliance can be complicated, especially when you’re
has everything you need to understand the process and get your SOC 2 report. Includes a free ebook, evidence collection spreadsheet [10], customizable policy templates, and an audit readiness checklist.
Secutils.dev is a versatile yet simple toolbox for security-minded engineers.
Ostorlab is a security scanning framework built for modularity, scalability, and simplicity.
Under New Management is a Chrome extension that periodically checks whether your extensions have changed owners.
The US charged ex-Google engineer Linwei Ding with stealing trade secrets related to AI and tensor processing units, including chip designs, GPU details, and cluster management software. Ding allegedly stole the data with the intent of using it at AI firms he was associated with in China. If convicted, he faces up to 10 years in prison per count.
Cybersecurity professionals are increasingly tempted to earn extra income on the dark web by offering offensive cybercrime services like phishing, crypto theft, and malicious coding. This trend is driven by layoffs, stagnant salaries, and employers unwilling to raise compensation, pitting enterprises against insiders with intimate knowledge of their vulnerabilities.
This article describes an experience with adopting passkeys. When the experience works properly, passkeys feel seamless and futuristic. There are still issues with websites adopting passkey support and interoperability between devices.
The CISA has laid out key actions for securing open source software.
TikTok sent a push notification that included a mechanism to search for representatives to its users to urge representatives to vote against an initiative to force ByteDance to divest from TikTok or face a ban.