Parse notes
Sponsored
Most compliance mandates require you to define your risk tolerance before putting controls in place. To do so, you first need to have a good understanding of cybersecurity risk, and how it impacts your compliance posture.
Temu denied being hacked or having a data breach after a threat actor claimed to have stolen 87 million customer records. It says the stolen data does not match the company's own data. Users should take precautionary steps like enabling two-factor authentication and changing passwords.
Two critical vulnerabilities in VMware vCenter Server and Cloud Foundation products allow attackers to execute remote code and escalate privileges. VMware has advised customers to patch affected systems immediately by upgrading to specific versions or applying the async patch. These flaws impact versions 7.0 and 8.0 of vCenter Server and versions 4.x and 5.x of Cloud Foundation.
The Maids International experienced a data breach that exposed sensitive consumer information like Social Security numbers and health data. It took steps to investigate and notify affected individuals. Consider seeking help to protect yourself from potential fraud or identity theft.
Apache's HTTP server's modular design opens it up to vulnerabilities as the request_rec structure gets passed around to different modules, which may mutate it and interfere with how a module further downstream expects it to be, leading to confusion attacks. Most modules treat the filename parameter as a system path but some treat it as a URL. This leads to path truncation vulnerabilities in mod_rewrite and ACL bypass in mod_proxy. mod_rewrite will always load the path from both the DocumentRoot and root directory, which can lead to source code disclosure or LFI, XSS, and even RCE via local gadget abuse and jailbreak. A legacy code snippet that allows for the Content-Type to override the Handler causes handler confusion, which can lead to SSRF, information disclosure, and RCE.
LinkedIn developed a tool called Security Posture Platform (SPP), which provides a graph database and GraphQL API to answer questions about security posture in the organization. To enhance usability by allowing for natural language querying, LinkedIn added an AI layer to SPP. This post describes the process and data engineering used to achieve 85-90% accuracy with LinkedIn's AI.
This blog post explores deserialization attacks, focusing on how to identify and exploit vulnerabilities in applications that handle serialized data. It provides a step-by-step guide on how attackers can inject malicious code through deserialization, ultimately gaining control over the application's functionality. The author emphasizes the importance of understanding these attacks to enhance security practices during code review engagements.
Sponsored
You don't have to put your career on hold to get a high quality education. With 100% online classes, and six 8-week terms a year, SNHU offers the flexibility you need to take the next step. Find your InfoSec degree today [11] (US based students only)
This resource provides a list of configurable payloads for bypassing URL validations.
Fibratus detects, protects, and eradicates advanced adversary tradecraft by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner. Events can be shipped to a wide array of output sinks or dumped to capture files for local inspection and forensics analysis. Users can use filaments to extend Fibratus with their own arsenal of tools and so leverage the power of the Python ecosystem.
OPAL is an administration layer for Policy Engines, such as Open Policy Agent (OPA) and AWS' Cedar Agent. It detects changes to both policy and policy data in real time and pushes live updates to agents. OPAL brings open-policy up to the speed needed for live applications.
This post provides a comprehensive look at the cloud security and CNAPP landscape. It begins with a history of cloud security before diving into the agent vs agentless debate. Agent based scammers can provide more granular insights and provide runtime protection but can be difficult to deploy and may have performance issues. Agentless scanners are quick to deploy but generate a lot of false positives and are not suited to containerized workloads. CNAPP stifles innovation while being too bloated to be useful due to trying to cater to cloud security engineers and developers, who are both looking for fundamentally different things. The future of CNAPP is a convergence between vulnerability management, posture scanning, runtime detection, and response.
In the wake of the disastrous CrowdStrike outage, Microsoft met with industry leaders to discuss security features that could be added to Windows to enable endpoint security vendors to move their products out of the kernel. Many vendors championed this as a productive endeavor and appreciated the collaboration from Microsoft. Others, like Cloudflare CEO Matthew Prince, cautioned the move as potentially leading to an unfair market where only Microsoft has access to the kernel. Microsoft has not mentioned locking vendors out of the kernel since 2006.
Maxwell Dulin's team won the Industrial Control Systems (ICS) Capture the Flag (CTF) competition this year with a 37% lead over the next team. In this blog post, Dulin shares the team's winning strategies, which include focusing on in-person challenges during the day and solving offline challenges at night. Dulin's favorite challenge was turning on the lights for a smart city, which involved spoofing a device to control the lights.
Apple has announced that it will extend Activation Lock to iPhone parts in iOS 18 to deter theft.
A former Ticketmaster boss has been sentenced after pleading guilty to illegally accessing computer servers of a rival company and stealing sensitive business information.
A Chinese man, Song Wu, used fake emails to steal sensitive information from NASA and other U.S. government agencies.