Parse notes
Sponsored
After speaking with GRC leaders worldwide, Field CISO Kayne McGladrey realized something was missing: the ability to truly understand an organization's GRC maturity and the steps it would take to build the business case for change.
Omni Family Health has reported a cyberattack that affected 468,344 individuals. The breach, discovered on August 7, exposed personal data of patients and employees, including names, addresses, Social Security numbers, and medical information. Omni is offering affected individuals 12 months of free credit monitoring and identity protection services.
Redbox's bankruptcy raises concerns about data stored in its kiosks. A programmer accessed a Redbox hard drive image, retrieving 2,471 transaction records dating back to 2015. These included customer email addresses, zip codes, partial credit card numbers, and rental details. While only a small portion of transactions were likely stored locally, this highlights potential data privacy risks.
Microsoft researchers discovered a new vulnerability that could allow attackers to bypass Transparency, Consent, and Control (TCC) protections for Safari. The vulnerability can be exploited by an attacker modifying specific configuration files in Safari and then forcing a user to browse to a malicious page. A patch is available and users are encouraged to update as Microsoft has determined that threat actors may be actively exploiting the vulnerability.
Bill Demirkapi's long term project discovered over 66,000 unique TLDs with dangling records and more than 15,000 verified secrets. He used innovative methods including enumerating cloud IP pools, utilizing passive DNS sources, and employing VirusTotal's Retrohunt tool with custom YARA rules. In this post Demirkapi outlines the key principles for large-scale vulnerability discovery, emphasizing starting with the vulnerability itself and using creative data sources with relevant relationships.
This post describes a Patchflow to create an AI code autofixer. The Patchflow first scans the code using Semgrep. It then enriches the Sarif output with the source code file and uses an LLM to triage the report. The LLM is then prompted to create and test a patch. If successful, the LLM then opens a PR with the fix. Prompts for each of the LLM steps are included.
Call stack spoofing is a technique to hide suspicious activity from security software like EDR by mimicking a legitimate call stack. A malware called DodgeBox used by APT41 implemented this technique to trick antivirus software. By creating a fake call stack, the malware obscures the true origin of function calls, making detection more challenging.
Realm.Security is a platform that integrates and manages cybersecurity data from various sources in various formats by leveraging artificial intelligence and data processing technology.
Node Version Audit is a tool for easily checking a given Node.js version against a regularly updated list of CVE exploits, new releases, and end of life dates.
s3cme is a template Go app repository with test and release pipelines that are optimized for software supply chain security.
This researcher attempted to discover security vulnerabilities by scraping and querying the AWS documentation. Their post begins by briefly touching on the steps taken to scrape the AWS documentation and some brief exploration locally using ripgrep. The researcher uploaded the scraped and enriched docs to s3 and set up Amazon Bedrock to query the docs using Claude 3.5. They discovered over a hundred publicly accessible buckets with sensitive information, was able to takeover a bucket, and discovered that the amzn-s3-demo-* prefix is reserved.
This post provides cybersecurity professionals with insights into how to leverage FCC's $200 million program to help K-12 schools improve cybersecurity defenses. Schools can apply for funding by demonstrating cybersecurity needs and developing improvement plans. Partnering with cybersecurity experts can enhance schools' chances of securing funding and maintaining long-term security.
OWASP updated its Top 10 Risks for Mobile Applications, highlighting "Improper Credential Usage" as a significant security concern due to hardcoded secrets in mobile apps. To enhance secrets security, developers should avoid hardcoding secrets, use secure storage APIs, move secrets to the backend, rotate keys regularly, and implement secrets detection tools like GitGuardian. Leaked secrets can lead to severe consequences, such as unauthorized access, financial losses, and legal repercussions, showing the importance of prioritizing secrets management in mobile app development.
This report provides a comprehensive overview of the hacking community and its perspective on topics at the forefront of cybersecurity.
DEFCON has uploaded all of the main stage talks from DEFCON 32 to its YouTube channel.
The European Union has updated its product liability rules to cover software and associated risks.