Parse notes
Sponsored
Orca’s 2024 State of Cloud Security Report [3] highlights risks found in actual production environments, based on data captured from billions of cloud assets [3] on all major public cloud providers. The researchers found that basic security practices are still lacking [3]. Even more troubling, many risks reside on exposed and public assets — for example, 21% of organizations [3] store sensitive data in a public-facing storage bucket.
>> Learn more about using Orca’s Cloud Security Platform [4] to prioritize cloud risk
Hackers are exploiting vulnerabilities in 92,000 D-Link devices to take control remotely. The vulnerabilities exist in end-of-life devices no longer supported by the manufacturer. Users should update firmware or replace outdated hardware to protect against these attacks.
Microsoft fixed two actively exploited zero-day vulnerabilities in the latest Patch Tuesday, addressing malware attacks. One vulnerability involved a malicious driver signed with a valid Microsoft certificate, while the other bypassed a security feature to deploy malware on Windows systems.
Hackers have been leveraging hijacked Facebook accounts to impersonate legitimate AI services like MidJourney and OpenAI’s SORA to trick users into installing malware. The pages utilize Facebook ads that pushed communities that supposedly allowed members to test new features but instead posted links to download malware masquerading as beta versions of the software. One particularly successful campaign operated a MidJourney page that amassed 1.2 million members over nearly a year.
This post discusses the history and evolving threat of vulnerable drivers in Windows operating systems, highlighting the need for monitoring and prevention strategies. Microsoft recommends a defense-in-depth approach that leverages technologies like Memory Integrity, Smart App Control, and the Vulnerable Driver Block List to enhance security against driver-based attacks.
This technical blog post details the vulnerabilities and exploits that led to the discovery of issues in CD Projekt Red's GOG Galaxy 2.0 gaming platform related to Denial-of-Service and Local Privilege Escalation (assigned CVE IDs 2023-50915 and 2023-50914). It highlights the risks associated with insecure interactions within the platform. The vulnerabilities involve inter-process communication and filesystem manipulation and can lead to potential exploitation for impactful attacks.
A tutorial from AWS on how to create security events for testing IR playbooks. The solution generates findings for a list of included CVEs that can be detected for GuardDuty, Inspector, or sent to a SIEM. AWS recommends that these should be run in a dedicated, sandboxed environment as a purple-teaming exercise.
Wiz maintains a database of cloud-focused incidents, actors, tools, and techniques. The website uses a collection of database tables that are filterable and it can also be subscribed via RSS feed.
gram is Klarna's locally hostable threat model diagramming tool. It is a webapp for engineers to collaboratively create threat models for their systems, providing an accessible way to document a system as a data flow diagram with threats and controls attached. The repository has a quickstart section to step through setting up the tool.
CloudFox is a tool by BishopFox to enumerate cloud environments. The tool can be used by defenders to enumerate attack paths or by attackers to automatically enumerate resources that stolen credentials can access. Currently, AWS and Azure are implemented, with support planned for GCP and Kubernetes.
This is a guide on evaluating children’s toys for privacy. It begins with some tips for evaluating privacy policies for the toys and companion apps. The post then provides a deep dive into how to inspect Bluetooth and Wi-Fi traffic and what to look for.
An introduction by AWS to the new Terraform Test framework introduced in v1.6. The tutorial includes worked examples on writing tests for success, failure, and tests for resources or variable validations. It also includes examples on how to run tests in a CodePipeline.
This edition of CISO conversations with Nick McKenzie and Chris Evans discusses the evolving role of CISOs in cybersecurity. The conversation provides an insightful look into the evolution and best practices of bug bounty and vulnerability disclosure initiatives from the perspective of two industry leaders.
The FCC is working to protect domestic violence survivors from being tracked by their abusers through connected car features like GPS and is seeking input from vehicle manufacturers and wireless service providers on how to limit abusers' access to these features.
Android 15 introduces Private Space for added data protection on your Android device, which will allow you to hide and secure sensitive apps and files within an encrypted area.
Google introduced the V8 Sandbox as a default option on supported platforms in Chrome to protect users from memory corruption exploits.