Parse notes
Sponsored
Many companies think of compliance in terms of templates and generic checklists. These box-ticking exercises are high-effort, slow, and can cause teams to take compliance and security less seriously (or treat it as a nuisance).
DigiCert announced that it will be revoking 0.4% of certificates issued from August 2019 to June 2024. The CABF baseline domain verification requirement is to publish a CNAME record with the domain followed by an underscore and random value. A bug introduced in August 2019 led to some code paths not appending the underscore which could potentially lead to clashes between the record and subdomains. DigiCert says this is unlikely due to the random value having 150 bits of entropy, but nevertheless has notified customers that it will be revoking affected certificates.
CISA and several security companies are warning that two ServiceNow vulnerabilities that were reported by AssetNote on July 11 are being actively exploited. The vulnerabilities allow attackers to access databases and exfiltrate data as well as read arbitrary files. Researchers warn of between 13k to 42k vulnerable ServiceNow instances ranging across the private and public sectors.
Microsoft admitted its defensive implementation worsened the Azure outage on July 30, which was initially triggered by a DDoS attack. DDOS attacks aim to overwhelm systems with malicious traffic. They are becoming increasingly common, so Microsoft should have been able to prevent the outage.
Tal Be'ery, co-founder of ZenGo, performed a first ever analysis of AWS Session Tokens to uncover the components that make up a session token. The goal of this research was to discover if the tokens contained sensitive information and if tokens could be edited for forgery as well as other attack vectors. The research found that session tokens are base64 encoded protobufs that store most of the interesting information in a userEncryptedData field. The researchers found that they could forge tokens however AWS rejected forged tokens. The post includes more details about the reversing process and protobuf fields.
An exploration of how to incrementally improve credentials access in AWS. The post begins with outlining a “vanilla” credentials workflow before detailing how environment variables do not solve the threats inherent with having plaintext credentials. It then outlines how to store secrets in Secrets Manager and have the application dynamically retrieve them to eliminate plaintext secrets from production. The next improvement comes from using KMS to encrypt secrets before using them in CI/CD pipelines to reduce the presence of plaintext credentials. The post then details steps that service providers can use to improve credential management for customers including bringing your own key.
This blog post discusses creating a custom implant for evasive purposes by avoiding detection through customized payloads. It explains the process of building the implant in C and includes details on server setup, interactive features, client functionality, and testing against security tools. The conclusion highlights the advantages of custom implants but also emphasizes the need for caution due to potential limitations and security considerations.
Fleet is an open-source version of FleetDM's tool. It is built on Osquery and can be used for vulnerability monitoring, MDM, detection engineering, and other applications.
A collection of templates for SOC2 policies and procedures. The templates can be outputted as an HTML dashboard or in PDF.
Clutch Security is a platform that gives security teams visibility into all of an organization's non-human identities. The platform allows security teams to understand which NHIs exist within the organization and identify associated risks.
Ransomware attacks are rising, with an 18% year-on-year increase reported by Zscaler ThreatLabz. A record $75 million ransom was allegedly paid this year. The U.S. faces nearly half of all attacks, with a 93% increase. The U.K. was the second most targeted country.
The UK Electoral Commission was reprimanded by the ICO for a security lapse that left millions of voters' data vulnerable to hackers. The breach, which lasted over a year from August 2021, was enabled by unchanged passwords and outdated software.
A joint analysis by Infoblox and Eclypsium reveals that Russian cybercriminals are exploiting DNS weaknesses in "Sitting Ducks" attacks to hijack domains without accessing owner accounts. This method, easier and less detectable than other hijacking techniques, has affected over 35,000 domains since 2018.
The average cost of a data breach jumped 10% to $4.88 million in 2023.
Twilio has shut down its Authy for Desktop app, logging users out and discontinuing the service.
Hackers used Stack Exchange to trick developers into downloading malicious Python packages that could steal cryptocurrency.