Parse notes
BTCTurk, Turkey's largest crypto exchange, was hacked. One analyst claims that the stolen currency amounted to nearly 51M euros. BTCTurk reported that the attack was caused by a vulnerability that allowed uncontrolled withdrawals to be processed. The exchange halted withdrawals and deposits to investigate the attack.
CDK Global announced that it will likely take several days to restore service to nearly 15,000 car dealerships that rely on its software. It has been working with clients to find alternative ways to conduct business. Some dealerships report resorting to conducting business and keeping records by hand temporarily.
Over 100,000 websites were affected by a supply chain attack on the Polyfill.io service where a script was modified to redirect users to malicious sites. Polyfill.io is a service that provides code that enables modern browser features on older browsers. It was compromised after being acquired by a Chinese company. Cloudflare and Fastly created their own mirrors of the service to mitigate risks.
This project from Google's Project Zero explores how large language models (LLMs) can improve vulnerability discovery in cybersecurity testing by up to 20x in the CyberSecEval 2 benchmark. The researchers developed a framework called Naptime that significantly enhances LLM performance in identifying and analyzing vulnerabilities. Naptime automates variant analysis and closely mimics the approach of human security experts by incorporating specialized tools and principles.
Fly.io operates a custom OIDC IdP that allows apps running in Fly Machines to access AWS services without a user needing to directly interact with AWS. Fly utilizes a custom init server that fly machines boot into, which exposes a Unix socket to access the Fly Machine API that contains the OIDC information. Fly then detects if an AWS_ROLE_ARN is set and if so, generates an OIDC token, saves it to a file, and sets the appropriate environment variables for the AWS SDK.
This blog post explains how to reverse engineer eBPF programs by examining their structure and using helper functions. The eBPF calling convention defines the return value and program flow. Understanding the verifier rules is crucial for writing effective eBPF programs.
Mutahunter is an open source language agnostic LLM-based mutation testing tool that leverages LLM models to inject context-aware faults into codebases.
GCPwn is an all-purpose red team GCP toolkit modeled after pacu for AWS.
Ronin is a free and open source Ruby toolkit for security research and development. Ronin 2.1.0 open beta testing phase is now live until July 19th, with the official release scheduled for July 22nd. Participants can install Ronin 2.1.0.rc1 using the provided script and are encouraged to test new commands and libraries and report any issues to the GitHub repository for a chance to receive a free sticker.
A new tool called "k4spreader" is being used by the "8220" mining gang to install malware like the Tsunami DDoS botnet and PwnRig mining program. The tool is still in development with three observed variants. It is designed to download and execute malicious files, primarily Tsunami and PwnRig.
AWS IAM Access Analyzer has launched a new update that allows for the detection of unused roles, access keys, and passwords. It provides a quick link to delete the credential when IAM Access Analyzer detects an unused credential.
The LockBit ransomware gang published alleged US Federal Reserve data after ransom negotiations broke down. It threatened to release 33 terabytes of banking information if a ransom demand wasn't met.
Julian Assange has agreed to a plea deal that will release him from prison in the UK and ensure no further jail time.
Four Vietnamese nationals, allegedly part of the cybercrime group 'FIN9,' were charged with hacking into U.S. companies and causing over $71 million in losses.
Indonesia refuses to pay an $8 million ransom after a ransomware attack disrupted public services.