Parse notes
Sponsored
When you treat risk and compliance like a project, you're setting yourself up for failure. Build a process that can support your business, even as needs and regulations evolve, with Drata [4]:
Alex Cheema of EXO Labs discovered a seemingly benign PR that attempted to inject malware into EXO's GitHub repo. The PR attempted to modify the models.py file with a set of Unicode characters that translated to a code snippet that would download and run a file titled stage1payload. The (now deleted) GitHub user that opened the PR was named evildojo666, which suggested security researcher Mike Bell was responsible. Bell has stated that this was an impersonator and that he has no connection to the attempted backdoor.
Researchers from WordFence have discovered a new vulnerability in the Really Simple Security WordPress plugin. The vulnerability involves an error in handling an invalid login nonce in the 2FA procedure that can allow an unauthenticated user to login as an administrator. Users should ensure that they're on the latest version of the plugin. WordFence is working with the plugin developers and WordPress.org to force users to update to the latest version. The WordPress.org stats site reported 3.5M sites that were potentially vulnerable at the time of publication.
Apple released emergency security updates to fix two zero-day vulnerabilities that were being exploited in attacks on Intel-based Mac systems. The flaws allowed attackers to execute code remotely and launch cross-site scripting attacks. Apple has addressed these vulnerabilities in macOS Sequoia and other Apple operating systems.
Amazon Cognito is a user management offering from AWS that can include security features such as threat detection. Cognito can use custom authentication flows to support passwordless authentication methods. It now supports using advanced security features on custom authentication flows. This post walks through how to set up passwordless authentication using webauthn and enable and configure threat detection.
This article reverse engineers iOS 18's new inactivity reboot security feature by analyzing both debug strings in the SEPKeyStore kernel extension and decrypted Secure Enclave Processor (SEP) firmware. The SEP tracks device unlock times and triggers a forced reboot after 72 hours of inactivity. The feature is not wireless-dependent as previously rumored, but rather is implemented through direct SEP-to-kernel communication that forces devices into a secure "Before First Unlock" state. The SEP's involvement makes this feature highly tamper-resistant, requiring kernel-level code execution within the first three days to prevent the reboot, effectively creating an asymmetric defense that particularly impacts criminals while leaving law enforcement a narrow window for forensic analysis.
Sharp Panda's new loader, now renamed Sharp Dragon, is deploying a new dropper to target Southeast Asia countries. The malware disguises itself as a Word document to trick victims and drops a malicious DLL for further exploitation. The malware may contain keylogging features and uses various APIs.
Nuke It From Orbit (nifo) can disable AV/EDR products from Windows machines even if they have BitLocker enabled if an attacker has physical access.
A Kubernetes attack graph tool that automatically calculates attack paths between assets in a cluster.
GoCrack is a management frontend that provides APIs for managing password cracking tasks.
Google Play Services' newest APK seems to include references to a Shielded Email feature. This feature would allow users to create email aliases when signing up for websites that can be turned off to avoid spam. The feature is available in the Autofill settings but it doesn't seem to be enabled at present.
LLMs show promise for finding vulnerabilities due to their potential to understand code behaviors and go beyond the exact pattern matching that is used in traditional SAST tools. LLMs provide inconsistent results, have privacy issues, are time-intensive to train, and their use can lead to vendor lock-in. Many of these issues could be mitigated by modifying their usage. This article lists some possible improvements. CodeLlama, LLaMA, Mixtral, and Mistral are particularly problematic for these tasks.
There has been positive progress on the secure-by-design pledge, which was launched in May and has now been signed by 248 companies who committed to implementing seven key digital security practices within a year of signing. The pledge focuses on improvements like expanding multi-factor authentication, reducing default passwords, and better vulnerability disclosure. Companies like Microsoft and Google are already showing significant progress through monthly technical exchanges and public reporting. While CISA plans to partner with a civil society organization to independently assess companies' progress and launch a website tracking their commitments, it won't remove companies who fail to meet goals - it will instead let their lack of progress be evident through an absence of public updates.
A handy list of the 27 IAM policy conditions categorized with explanations and examples for each one.
Strava is limiting how user data can be shared with third-party apps to prioritize privacy and user control.