Parse notes
Sponsored
Trustero's patented AI [4] is helping the world's best GRC teams make quick efficient work of the things that used to take them weeks like audits and questionnaires, and vetting third parties.
* Use AI to collect and map evidence in any format against any framework
Moonlock Labs has uncovered a new AMOS stealer variant that spreads by masquerading as the Loom screen recorder on Google Ads. In addition to usual infostealer malware capabilities, this new variant contains the capability to clone and swap legitimate apps such as a crypto wallet to wipe victims' wallets. This variant also includes files that suggest that it is targeting gamers.
A vulnerability in MSI SMM driver allowed attackers to run unauthorized code by exploiting a buffer overflow. The exploit involved setting a variable to corrupt SMRAM, leading to potential system compromise. Mitigation required setting DataSize to 8 for status message writing to physical memory.
Palo Alto Networks patched a critical command execution flaw in its Cortex XSOAR product, allowing attackers to run commands without authentication. The company also addressed vulnerabilities in other products like Prisma Access Browser and PAN-OS, releasing patches to fix the issues. While no known attacks have occurred, Palo Alto Networks is proactive about addressing cybersecurity threats in its products.
A Reddit user experienced a $9,000 bill due to a CloudFront WAF bypass. A comment presented a list of suggestions to improve WAF usage such as blocking the AWSManagedRulesAmazonIPReputationList list, setting rate limits at various levels with COUNT actions to determine baselines to block, restricting access to the S3 bucket, and blocking geos that customers don't reside in. The comment also suggested using AWS Shield Advanced, which gives access to the Shield Response Team and has a WAF allowance included in its $3,000/month cost.
This article details an exploration of how email parsers handle the more arcane parts of the RFC. It begins with background about ways that the RFC treats some special characters like escapes and comments. The article then details how the author utilized encoded words to bypass access controls to obtain access to protected environments using encoded words before taking it a step further to achieve RCE using puny codes. Relevant tooling for automating encoded word discovery with Turbo Intruder and fuzzing with punycode as well as a CTF are included.
The 3 Billion people nationwide data breach has led to leaked records including names, addresses, and Social Security numbers. Data aggregator NPD is facing a class action lawsuit over the breach.
Sponsored
Whether you're already in cyber or looking for your first role, a university degree [11] can help you stand out and deepen your knowledge. Explore online Bachelor of Science degrees from Southern New Hampshire University [11] (SNHU) for 24/7 online accessibility, affordable tuition rates, and flexible terms starts.
Project Apeman is a tool for generating and visualizing AWS attack paths.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Daemon to ban hosts that cause multiple authentication errors.
NIST has announced the first set of standards for post-quantum cryptography: ML-KEM, ML-DSA, and SLH-DSA. ML-KEM uses a lattice system to create a secure communication channel whereas the other algorithms are for creation and verification of digital signatures. IBM's Dario Gil urges companies to start adopting these standards now as threat actors may be stockpiling encrypted data to crack with a quantum computer, which Gil theorizes should be available within the next 10 years.
This post breaks Detection as Code (DaC) into four components: language, testing, integration, and monitoring. When a team starts adopting DaC, they may use markup languages before moving on to query languages and finally general purpose programming languages. As teams adopt testing for their DaC, they will likely begin with unit testing before adopting other forms of testing like integration testing and end-to-end testing. Teams will also add more monitoring and integrations as they mature. A maturity matrix is included at the end of the post.
NIST announced new post-quantum cryptography standards, including SLH-DSA. Trail of Bits created a Rust implementation of SLH-DSA for secure cryptographic use. Its open-source project, which focuses on security and usability improvements, aids the transition to post-quantum cryptography.
Microsoft has removed the 32GB limit for FAT32 partitions in Windows 11, now allowing sizes up to 2TB.
A new vulnerability in GitHub called ArtiPACKED could let attackers take over repositories by leaking tokens and compromising cloud services.
A cybercriminal known as "J P Morgan" has been extradited to the United States after a decade-long investigation.