Parse notes
Jewish Home Lifecare, a New York City healthcare nonprofit, disclosed a data breach impacting over 104,000 individuals. Hackers accessed personal and medical information, including Social Security numbers and financial details.
The Oregon Zoo disclosed a payment skimming malware attack that exfiltrated personal and credit card data of 100K individuals over 6 months. The breach follows similar incidents at other zoos. The stolen card data has been found for sale on dark web carding shops.
Toyota has confirmed a breach of 240GB of data but has not provided details on what the data contains or how many people are affected by it. The leaker claims that the data contains contacts, financials, customers, employees, photos, DBs, network infrastructure, emails, and more. The files were stolen or created on December 25, 2022, which suggests that the data may have been a backup.
A post from TrustedSec's Brandon McGrath which begins with a discussion of an engagement where his implant got caught by a member of the blue team. McGrath details how he uses a key ring consisting of host based checks, network checks, and external checks as an execution guardrail. In the example, the implant first checked the hostname of the system, then network shares, and finally a TXT record before downloading and launching the payload.
Trusted Types is a defense-in-depth mechanism that protects against DOM XSS by implementing type systems to ensure that only safely constructed values can reach injection sinks. To rollout Trusted Types in AppSheet, the Google team followed a five stage process: report-only mode, collect and triage violations, refactor blockers, repeat the previous two steps, and enforcement. When investigating a Trusted Types violation, a report contains the source file where the violation occurred, the document URI which is the URI where the violation occurred, and the script-sample which includes the underlying API call that caused the violation and a prefix of the input that caused the violation.
Synacktiv discovered a novel GitHub Actions exploitation technique leveraging Dependabot to compromise repositories and push arbitrary code. The vulnerability stems from workflows using the 'pull_request_target' event with weak access controls based on the 'github.actor' context, which can be manipulated by triggering Dependabot actions on a forked repository. Synacktiv demonstrated successful exploits against the spring-security and trpc projects, highlighting the importance of careful workflow configuration and the use of tools like octoscan for detecting such vulnerabilities.
Sponsored
Banking apps are a prime target for attacks. Secure SDKs (e.g. for KYC or payments) are good, but they can create a false sense of security and leave unaddressed vulnerabilities. Learn how to protect mobile bank apps [11] against real-world threat scenarios using a multi-layered approach [11] that includes obfuscation, encryption, and real-time application self-protection (RASP). Join the live session
Linx uses analytics and AI to scan and understand the landscape of an organization's system to link all identities together and to actual, active employees. In the process, it also finds IDs that are no longer connected to active users so that they can be removed.
GraphQLer is a dependency-aware API fuzzer that uses relationships between objects and mutations to inform its testing
Grimoire is a tool that generates datasets of cloud audit logs for detection engineering. The tool currently supports the ability to detonate Stratus Red Team or AWS CLI commands and stream the CloudTrail logs to an output file.
Microsoft will soon require multi-factor authentication for all Azure sign-ins to enhance account security. The rollout will happen in two phases, first for the Azure portal and admin centers, then for Azure CLI, PowerShell, and other tools.
In the wake of NIST releasing the first set of post-quantum cryptography standards, the UK's NCSC has started a series of posts on how organizations should respond. Implementations and protocols like TLS still need to be updated to make use of post-quantum cryptography which will likely take years. NCSC advises that the key actions that organizations can take now are to inventory the use of cryptography in their own environments and in their supply chains.
Hackers linked to North Korea exploited a Windows zero-day vulnerability to install advanced malware.
Microsoft Authenticator has a design flaw that can overwrite accounts, causing users to be locked out unexpectedly.
The 71st issue of beloved hacker e-zine Phrack has been released after nearly 2 years since the last issue.