Parse notes
Sponsored
As a 5* rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $7,000 per year [4] and ensure your business is always protected.
There is a vulnerability in Apple AirPods that allows anyone with the Bluetooth MAC address to connect and access the microphone or music. An update is available for affected AirPods models to fix the issue. Android users may face challenges updating the firmware as AirPods typically auto-update only with iOS or macOS devices.
Shoezone UK has reported a cyberattack that led to unauthorized access to its online systems and data. Despite the breach, the company's website is still functioning, and trade operations were not disrupted. Shoezone is taking steps to investigate the incident and protect customer data.
TeamViewer has notified customers that its corporate network was breached by APT29, also known as Cozy Bear and Midnight Blizzard. It assured customers that its corporate and customer networks are completely separate and no customer information was compromised. Health-ISAC informed providers that it has detected threat actors exploiting TeamViewer to attack networks. It is unclear if the two are related.
An in-depth blog post from GitHub that explores how unsafe deserialization vulnerabilities manifest in Ruby and works through the process of creating a gadget chain to detect unsafe deserialization vulnerabilities in the Oj library. The post breaks down how the universal deserialization gadget for Marshal works and how it can be adapted to the Oj and other deserialization libraries. It then extends the gadget chain that they create to achieve RCE using the zip command and lists the vulnerable sinks that CodeQL uses to detect unsafe deserialization vulnerabilities.
Rami McCarthy scraped AWS for publicly exposed SSM Command Documents that allow a configured IAM user to run a set of bundled commands against an instance. McCarthy detected exposed API keys and other secrets, S3 buckets, and other artifacts in the 2,472 exposed documents. AWS should make documents private by default and scan for exposed secrets automatically.
This blog post from CloudFlare outlines the ML algorithm used to identify and block residential proxy abuse. This model helps protect against distributed attacks while minimizing false positives for legitimate users. CloudFlare users can enable MLv8 to take advantage of this feature.
Web Check is an all-in-one OSINT tool for analyzing websites. This repository includes information for deploying the tool on Netlify, Vercel, Docker, or building from source. A live demo is also included.
Domain Protect GCP is a project that scans Google DNS across a GCP organization for domain records vulnerable to takeover. Alerts can be sent to Slack or email.
ELFie Scanner is a C++ POC for advanced process memory scanning that attempts to detect a number of malicious techniques used by threat actors and those that have been incorporated into open-source user-mode rootkits. It inspects every running process (both x86/x64) and its corresponding loaded libraries to look for evil. It then outputs the resultant telemetry into a NDJSON file.
Google will block websites using Entrust certificates in Chrome starting November 2024 due to compliance failures and security issues. This decision aims to ensure secure connections between browsers and websites, with users being warned of insecure connections from Entrust-issued certificates. Website operators are advised to switch to other trusted certificate authorities to avoid disruptions by October 31.
A report from CISA examined 172 broadly deployed open source projects. Some key findings include that 52% of the analyzed projects contain code written in memory unsafe languages, 55% of the total lines of code across all projects were written in memory unsafe languages, and that the median proportion of lines of code written in memory unsafe languages across the ten largest projects was 62.5% with four projects exceeding 94%. CISA notes that some of these projects are designed with critical performance and resource constraints where memory unsafe languages will likely remain prevalent.
This article discusses a critical DoS vulnerability that was found in WebRTC media servers that affected real-time communication availability. The vulnerability stems from a race condition between ICE and DTLS traffic, allowing attackers to disrupt media sessions. Exploiting this vulnerability involves sending a DTLS ClientHello message with a null cipher suite to targeted UDP ports on the media server.
308 different models of Sharp Multi-Function Printers (MFP) are vulnerable to 17 attacks outlined in this blog post.
Google Chrome is introducing an "Unrestricted WebUSB" feature for isolated web apps to access sensitive USB devices.
Zyxel NAS devices in Europe are facing a Mirai-like botnet attack due to critical vulnerabilities (CVE-2024-29973).