Parse notes
Sponsored
Attackers move fast—you need to be faster. Intruder offers real-time discovery and prioritization of attack surface weaknesses, allowing you to focus on the fixes that matter most. Join thousands of companies worldwide protecting their digital assets.
Tibber is a provider of green energy options for customers in Northern Europe and Germany. It reported that customer data belonging to 50K German customers of its smart hardware online store was stolen. The leaked data includes names, email addresses, order amounts, and incomplete address data.
Three variants of a new macOS malware have been detected. One variant was written in Python, one in Golang, and one using Flutter, which heavily obfuscates code by default. The malware was embedded in a clone of Minesweeper. No evidence of exploitation has been found - the callback domain returns a 404. The malware appeared to target cryptocurrency developers. It had several of the hallmarks of a Lazarus group attack.
The Gogs self-hosted Git service version 0.13.0 has a vulnerability (CVE-2024-44625) that allows remote code execution. Attackers can exploit this by gaining access to an account that can push to a repository and editing files from the web interface. The issue remains unaddressed by Gogs developers despite multiple reports, prompting users to take security measures and consider migrating to Gitea.
This in-depth guide to bypassing SELinux on Android devices begins with an overview of how SELinux works and breaks down the relevant sections of the implementation code. It then discusses some bypasses that don't work either for hypervisor blocks or read only memory such as disabling SELinux by setting the enforcing mode to permissive, overwriting the permissive map, AV Cache poisoning, and SELinux initialization overwriting. Two bypasses that do eventually work involve overwriting the SELinux hooks and overwriting the allow_unknown field in the selinux_state.
This is the first out of two articles that cover DOMPurify security bypasses discovered in early 2024 by various researchers. Affecting versions 3.1.0-3.1.2, the vulnerabilities include exploits that use deep nesting and DOM clobbering techniques.
A technical analysis that explores ChatGPT's sandbox environment. It covers how to gain file system access, command execution capabilities, and prompting techniques to extract system information. The author emphasizes responsible disclosure and educational goals and requests readers notify OpenAI of any issues prior to publication.
Sponsored
As a security leader, it's your job to approach AI with a dose of healthy skepticism. Download this guide by BigID [13] to learn how to navigate the world of AI from a CISO's perspective - and how to start finding opportunities rather than focusing solely on threats. Get the
Whispr is a CLI tool for injecting secrets from various secret vaults into an app environment. It supports vault services from AWS, Azure, and GCP.
PowerHuntShares is PowerShell tool designed to help cybersecurity teams and penetration testers better identify, understand, attack, and remediate SMB shares in the Active Directory environments they protect.
SurePath AI provides visibility and control over gen-AI use across public and private models, with role-based access controls that decide what data is allowed to leave the organization and what end-users have access to.
This past February, NIST announced that it did not have enough resources to keep up with the CVE enrichment backlog and stated that changes would be made to keep up. Now, the NIST has announced that it is fully staffed, has partnered with other federal agencies and industry partners, and has provided enriched CVE data for all vulnerabilities in the KEV. However, NIST also stated that the format that it receives data from its Authorized Data Provider is difficult to import and enhance.
A common cybersecurity trope is to never use unsecured, public WiFi without a VPN. The author of this article challenged this notion by monitoring the HTTPS and non-HTTPS connections made by their iPhone and Chromebook. They found that anyone monitoring their connection could only see 0.25% of requests from their Chromebook and that there were zero connections to HTTP websites and services from their iPhone.
PyPI has introduced digital attestations (PEP 740) to improve package security. Digital attestations offer better usability and verifiability than PGP signatures. Attestations are automatically enabled for publishers using Trusted Publishing with pypa/gh-action-pypi-publish v1.11.0+.
Ilya Lichtenstein has received a 5-year sentence for the 2016 Bitfinex hack.
Threat actors are using SVG attachments in phishing emails to avoid detection, with some of them displaying HTML and then executing JavaScript when the image is loaded.
Microsoft has announced that it will use the Common Security Advisory Framework, which helps organizations understand and fix security issues faster, for vulnerability disclosures.