Parse notes
Sponsored
Orca Security has published its new State of AI Security Report. This research report is based on findings from billions of cloud assets scanned by Orca's agentless cloud security platform [5] on AWS, Azure, Google Cloud, Oracle Cloud, and Alibaba Cloud.
Dell has announced that it is investigating a data breach after a hacker posted an alleged data dump to BreachForums. The data breach contains data of 10k employees' full names, unique identifiers, employee status, and internal identification strings. Neither Dell nor the hacker have disclosed how the data was stolen.
A security researcher has discovered a vulnerability in the Arc browser that could lead to RCE on other users. The Arc browser has a feature called Boosts that allows arbitrary CSS and JavaScript to run and modify websites in users' browsers. The vulnerability arises from improper ACLs on The Browser Company's Firebase data store, which allows attackers to apply Boosts to different users' browsers by changing the user ID that they are attached to. An update has been pushed and The Browser Company has committed to improving its security posture.
A new version of the Necro Trojan has infected popular apps on Google Play and unofficial sources, impacting over 100 million devices worldwide. The malware used obfuscation to evade detection and had the ability to display ads, download files, and execute JavaScript code. Google Play removed the malicious loader from affected apps following reports of the issue.
PowerShell Script Block Logging is one of the types of PowerShell logs that records the content of all script blocks executed within PowerShell. ScriptBlock Smuggling is a technique whereby an attacker can hide a malicious script block within a benign script block. This post tests detections for this attack in a lab environment using a test script from AtomicRedTeam. The author notes that the full script, which contains the malicious command, can still be seen in the details pane and questions the usefulness of this attack.
This author wrote a script that was praised for its UX to automate the evaluation steps in a competition. They argue for comprehensive error handling and input validation with detailed and actionable error messages, clear and colorful output, detailed progress reporting without overwhelming the user by using set -x, using set -x and set +x for fine grained and strategic error handling, making use of platform specific functionality, and using time stamped file outputs to make multiple runs easier to compare. Examples of each of these principles are included in the post.
Many critical sectors still use vulnerable pager networks like POCSAG, which are easily exploited for message injection attacks via radio frequencies, for emergency communication. These networks lack encryption, allowing anyone with basic equipment to intercept and manipulate messages, posing serious security risks in sensitive environments. This blog post highlights the urgent need for stronger security measures in these outdated communication systems by demonstrating how easy it is to spoof messages.
Sponsored
To better understand the current vulnerabilities and threats facing modern DevOps teams, Datadog evaluated real-world data [13] from thousands of organizations. Discover why only 3% of “critical” vulnerabilities are actually worth prioritizing, the problem with 3rd party dependencies, and why legacy risks are still a problem. Read the
Cloud Testing VM is a VM that contains a set of common cloud security testing tools. There are scripts to build it as an AWS AMI.
undocumented-aws-api-hunter is a tool for uncovering undocumented AWS APIs. It works by launching a headless Chrome browser that crawls through the AWS Console.
Cloudflare has launched new free security features for website owners and network protection, including threat intelligence, analytics, and account takeover attack detection. Users can now access Security Analytics, API schema validation, and Page Shield script monitor to enhance their security. Cloudflare has also introduced new authentication options, such as signing up and logging in with Google, to simplify account access and reduce the risk of compromise.
Google has announced the ability for users to save passkeys to Password Manager, the password manager built into Chrome. Passkeys will automatically sync across computers and Android devices running the Password Manager app. Support for ChromeOS is in beta and support for iOS is planned.
TCM Security has announced that it will be launching a free tier to its academy. The initial offering will contain four courses: Practical Help Desk, Programming 100: Fundamentals, Linux 100: Fundamentals, and Soft Skills for the Job Market. The free tier launches today and users can access the content by signing up with only an email address.
CrowdStrike has improved testing and rollout procedures to prevent system crashes like the one in July. It now deploys software updates gradually and has added new validation checks to prevent errors. Microsoft is also making changes to enhance security in Windows 11 following the global IT outage caused by a faulty CrowdStrike update.
This post shares how organizations can detect and disrupt these threats by implementing detection strategies and maintaining vigilance.
A study by e2e-assure revealed a stark contrast between cyber risk owners' confidence in AI policies (85%) and employee awareness of such guidance (34%), indicating potential vulnerabilities in organizational cyber resilience despite increased adoption of AI technologies.
A cyberattack on a Kansas water treatment facility led to manual operations being implemented to ensure water safety.