Parse notes
Sponsored
Service Control Policies (SCPs) can be intimidating, but they are an essential part of working in AWS, especially when used to keep a lid on excessive permissions and reduce unnecessary risk!
NCC Group researchers have discovered vulnerabilities in Sonos smart speakers that allow remote code execution and potential eavesdropping. The flaw affects Wi-Fi drivers and could be exploited by nearby attackers. These vulnerabilities have now been patched by Sonos and updating drivers is recommended.
Researchers have discovered a security flaw, dubbed Sinkclose, in AMD processors, affecting chips since 2006. The vulnerability allows hackers to run malicious code in the chip's privileged System Management Mode. While requiring initial access, Sinkclose enables deep-seated malware installation that can survive OS reinstallation and be extremely difficult to remove.
Security researchers discovered severe vulnerabilities in Ecovacs robots that allow hackers to take control via Bluetooth from up to 450 feet away. Once compromised, attackers can remotely access cameras, microphones, and Wi-Fi credentials. Ecovacs hasn't responded to the researchers' reports, leaving these vulnerabilities potentially exploitable.
Researchers deployed canary tokens (aka fake AWS credentials) in public online locations to study threat actor behavior. These digital tripwires triggered alerts when accessed, revealing patterns in credential discovery and attack methods.
TrailShark is a tool that integrates AWS CloudTrail logs with Wireshark for real-time analysis of API calls. It helps identify vulnerabilities in AWS services by monitoring internal API interactions. TrailShark offers features like advanced filtering, inner API call analysis, and custom event creation to enhance security and transparency in AWS environments.
Security researchers discovered a new vulnerability whereby websites can bypass protections and send requests to 0.0.0.0 and reach internal APIs that are listening on localhost. This vulnerability was able to bypass Google Chrome's Private Network Access protections because 0.0.0.0 was not on the blocklist that it uses. Following the researchers' findings, all major browsers have committed to blocking requests to 0.0.0.0 and establishing Private Network Access as a standard which will include 0.0.0.0 in its blocklist.
Endari provides customers with scalable solutions for protecting assets and customer data without the need for a full-time security team.
Code Pathfinder, the open-source alternative to CodeQL. Designed for precise flow analysis and advanced structural search, it identifies vulnerabilities in source code.
A CloudFormation template to create reasonable account defaults around Cost Surprise Alerting.
Oracle has agreed to pay $115 million to settle a class action lawsuit alleging user data misuse. The settlement, which affects 220 million people, requires Oracle to address privacy violations and implement an audit program for customer compliance.
A new CPU vulnerability called GhostWrite affects a common RISC-V processor, allowing attackers to read/write to any part of the computer's memory. Mitigating GhostWrite requires disabling around half of the CPU's functionality, leading to a significant 77% performance hit by turning off the vector extension support. The vulnerability is not related to speculative execution. RISC-V chips are becoming more popular targets for security researchers and attackers.
This author discusses Detection as Code and lessons learned in five years as it has evolved beyond simply writing detection logic in programming languages to focus instead on codifying processes and leveraging CI/CD pipelines for automated checks and version control. Test-Driven Detection (TDD), which emphasizes test creation before writing detection logic, is emerging as a best practice. LLMs show promise in auditing and improving detector descriptions within CI/CD pipelines but aren't suitable for creating detection logic.
2.7 billion personal records, including Social Security numbers, were leaked from National Public Data on a hacking forum, exposing sensitive information of people in the US.
The UK and France are consulting on commercial cyber intrusion capabilities through the Pall Mall Process.
The White House released a report on open-source software security initiatives that details activities planned by the OS3I for 2024-2025.