Parse notes
Sponsored
What's next for GRC? Join the live panel discussion [4] to hear predictions from three established experts [4]: Jonathan Harbin, Principal Practice Manager at AWS; Drata CISO Matt Hillary; and Danny Manimbo, Principal AI Assessment Leader at Schellman.
The Bank of Uganda announced that offshore hackers stole nearly 17M USD from accounts in the country's central bank. Uganda's largest independent newspaper reported that the hack may have involved collusion from malicious insiders. Conversely, a state-owned newspaper published that over half of the stolen currency had been recovered and downplayed the attack.
Cybersecurity researcher Michael Heinzl discovered 4 critical and 1 high vulnerability in mySCADA's myPRO system. The vulnerabilities in the ICS software include OS command injection, improper and missing authentication, and path traversal. CISA which coordinated the disclosure has not observed any evidence of exploitation.
FBI and CISA have noted that the China-linked hacking group Salt Typhoon still has access to U.S. telecommunications networks, causing concerns for officials. Steps are being taken to strengthen network security against these hackers. Efforts are ongoing to remove the hackers completely, with some progress being made by companies working with the government.
Tailscale's infrastructure team is composed of only three engineers. The company is able to simplify networking infrastructure by utilizing Tailnets to connect resources across VPCs and different cloud providers while handling access at the Tailscale ACL level. Tailscale ACLs combined with setec, an in-house secrets manager to simplify secrets management as well.
Phishing attacks have increased by nearly 40 percent, with many targeting new domain extensions like .shop and .xyz due to their low prices and minimal registration requirements. These new gTLDs accounted for 37 percent of cybercrime domains reported in the past year. Despite this trend, ICANN plans to introduce more new gTLDs in the future, raising concerns about further opportunities for cybercriminals.
Jonathan Walker of Security Runners crawled through AWS documentation to create a list of all possible service buckets and determine if any were available for bucket namesquatting. During his research, Walker discovered buckets created for a large number of regions that didn't yet exist such as us-east-3. While ultimately unsuccessful at discovering an available bucket for namesquatting, Walker's discovery that AWS reserves buckets in a large list of uncreated regions to protect against attacks like this is interesting.
RequestShield is an open source tool written in Python designed to analyze HTTP access.log files and identify suspicious HTTP requests and potential security threats. It uses factors like geolocation, abuse history, request volume, and suspicious request paths to assign a risk score to each IP, providing actionable insights for security monitoring. RequestShield helps security teams detect and mitigate threats by analyzing access logs in real-time.
Semgr8s is an admissions controller for Kubernetes that uses Semgrep rules to validate k8s resources before deployment.
NativeBypassCredGuard is a Red Team tool that bypasses Credential Guard by patching WDigest.dll using NTAPI functions. It can force plaintext credential storage in memory, making user credentials easily retrievable. The tool offers options to check current values or write new values, with the ability to remap the ntdll library for bypassing security mechanisms.
TryHackMe has started its annual Advent of Cyber event, which includes daily challenges across cybersecurity domains. The challenges are geared towards beginners and are contributed by various creators in the cybersecurity space. Prizes for answering the questions include certification vouchers, various peripherals, and premium subscriptions to TryHackMe.
This recently released guide by CISA provides best practices for strengthening the visibility and security of communication networks against cyber threats, including those affiliated with the PRC. It covers monitoring, hardening systems, and collaboration between network defenders and engineers to ensure network protection. Specific guidance is given for Cisco systems to prevent exploitation by cyber threat actors.
APT35, a threat group linked to Iran, is targeting aerospace and semiconductor industries in various countries using forged recruitment sites to lure victims into downloading malicious programs. The attackers utilize legitimate internet resources like OneDrive and Google Cloud to carry out their activities, making threat detection and protection tools essential for defense against these attacks. ThreatBook has identified key indicators of compromise (IOCs) related to this attack event to enhance threat intelligence detection and protection efforts.
Cloudflare reports that Cyber Monday saw the highest global Internet traffic, with Black Friday following closely behind, and DDoS attacks were prominent during Cyber Week, particularly targeting shopping sites.
The FTC banned data brokers from selling Americans' sensitive location data linked to places like churches and healthcare facilities.
Cybercriminals are increasingly misusing Cloudflare's 'pages.dev' and 'workers.dev' domains for phishing and malicious activities, taking advantage of Cloudflare's trusted reputation.