Parse notes
Evolution Mining, an Australian gold mining company, reported a ransomware attack on August 8. It believes the incident is contained and is working with cyber forensic experts. The company doesn't expect a material impact on operations. The group responsible for the attack remains unidentified.
MalwareBytes detected a malware campaign that used Google ads to pose as a download page for the Google authenticator app. The downloaded file was hosted on GitHub and was actually the DeerStealer infostealer. This post includes screenshots showing how the attacker was able to make the ad look legitimate by registering a verified advertiser profile.
SAP released security patches for 17 vulnerabilities, including a critical flaw allowing remote attackers to bypass authentication and compromise systems. The flaw impacts SAP BusinessObjects Business Intelligence Platform versions 430 and 440. Hackers target such flaws to access valuable corporate networks, so it's crucial to apply updates promptly.
Azure Health Bot Service, a platform for AI health assistants, had critical vulnerabilities allowing cross-tenant access. Microsoft has applied mitigations across affected services and regions. No customer action is required.
James Kettle presented at DEFCON on how he exploited timing attacks with delays as low as 200 microseconds. To reduce noise, Kettle utilized HTTP/2 to send multiple requests that arrived at the same time and interleaved a ping packet to force HTTP header coalescing, trying to hit slow code paths. He was able to effectively demonstrate the efficacy of this technique in discovering hidden parameters, server-side injections, and reverse-proxy misconfigurations.
This text discusses the importance of code security and the vulnerabilities that can arise when working with XML parsers in C++ code. It covers the XXE vulnerability and provides examples of insecure and secure code implementations to prevent such vulnerabilities. The author aims to help beginners improve their security code review skills by understanding and mitigating common XML vulnerabilities.
LeakSignal's platform allows customers to block sensitive data before it is logged, observe and redact it during calls to outbound third-party application programming interfaces (APIs), and observe and set limits on internal API data access.
PANIX is a highly customizable Linux persistence tool for security researchers, detection engineers, and penetration testers. It prioritizes functionality over stealth and is easily detectable.
AppLockerGen is a tool that simplifies the process for generating AppLocker XML policies. The webapp features prebuilt policies as well as GUIs for merging or generating policies.
The FBI has dismantled servers and domains associated with the Radar/Dispossessor ransomware group, which evolved from piggybacking on LockBit's stolen data to becoming an independent operation. The takedown involved international collaboration with UK and German law enforcement agencies.
Research reveals prompt injection attacks on LLMs are primarily used by job seekers bypassing HR screeners and AI protesters, not criminals. The technique overrides initial instructions given to AI models. While direct injections are common, indirect injections via web pages or documents also occur.
Cloudflare Radar now includes insights on HTTP request traffic, allowing users to compare bytes with requests for better traffic analysis. New graphs have been added to show HTTP request-based traffic data on the Overview and Traffic sections of Cloudflare Radar. These new metrics offer a clearer view of user behavior and traffic patterns.
Apple will be disabling the ability to override Gatekeeper with Control-click when opening software that isn't properly signed or notarized.
A suspected Iranian cyber intrusion targeted the Trump and Biden campaigns, with stolen documents leaked to media outlets.
NIST has released new encryption standards to protect against quantum computer attacks.