Parse notes
Sponsored
For security teams, the cloud is both a blessing and a curse. Abundant telemetry allows for unparalleled visibility and control, but traditional security tools (like SIEM and EDR) fall short in addressing the complexities and scale of cloud infrastructure.
The Solana web3.js SDK was backdoored by a malicious commit for roughly 5 hours on December 2. The backdoor was hidden in a new addToQueue function which sent the user's private key in seemingly benign headers to an attacker-controlled server. Calls to the function were then placed in strategic locations in the key generation and loading process. The developers urge any developers who think they might have been compromised to rotate their keys.
Atrium Health reported a data breach affecting 585,000 individuals due to online tracking technologies on its patient portal between 2015 and 2019. Potential personal information may have been shared with third parties like Google and Facebook, though no financial data was compromised.
Two versions of the Ultralytics AI library were compromised to deliver a cryptocurrency miner, leading to a spike in CPU usage for users. The malicious code injection occurred in the PyPI deployment workflow, allowing unauthorized modifications to be inserted after the code review step. Users are advised to update to the latest version of the library to avoid potential security risks.
This blog post dives into CVE-2020-0401 after an old OnePlus phone sparked curiosity about the vulnerability. The vulnerability allows malicious apps to register as installers without proper permissions so the author tried to exploit it.
Paved roads is a common security buzzword that refers to the process of creating a standardized path for common security pitfalls. Security reviews should look to identify common pain points across different reviews as candidates for paved roads and then work with teams that will pioneer the paved path. Following this methodology, full classes of vulnerabilities can be fixed at scale as opposed to individually as they appear in individual reviews.
This author provides a deep dive on macOS internals and their process in building a KEXT fuzzer. The post begins by detailing the difficulties of kernel-level binary instrumentation in macOS. The author then describes how they came to decide on an architecture that uses a custom-built trampoline to instrument basic blocks that were identified in the Boot Kext Collection and then feed the coverage results into the next iteration of the fuzzer.
Sponsored
Join a panel of experts from BigID and Cloudrise for an interactive webinar [11] on implementing Data Security Posture Management (DSPM) at enterprise scale. On the agenda: DSPM vs DLP, going from demo to deployment, remediating data incidents, and handling the complexities
Ethyca's platform helps organizations inventory data through automated system mapping to remain compliant with consent management across their entire data workflows.
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments and the enforcement of privacy regulations in code.
ChainReactor is a project that leverages AI planning to find exploitation chains for privilege escalation on Unix systems.
French and Dutch police dismantled the Matrix encrypted chat app used by criminals, seizing 2.3 million messages about illegal activities across 40 servers. The operation led to three arrests and exposed the app's supposed security.
Denial of Wallet attacks occur when an attacker makes use of cloud services which charge based on usage to generate large bills for victims. They can be caused by scaling traditional DDoS attacks or other vectors such as cryptojacking or LLM hijacking. This is the first post in a series on Denial of Wallet attacks and mitigations to protect against them.
A new zero-day vulnerability in Windows lets attackers steal NTLM credentials by tricking users into viewing a malicious file in Windows Explorer. The issue affects various Windows versions, from Windows 7 to Windows 11. An unofficial patch is available from the 0patch team until Microsoft releases an official fix.
While automatic secrets rotation is a desirable goal, it requires significant organizational maturity in secrets management, proper infrastructure, and careful planning rather than being a simple one-click solution, as credential rotation involves complex processes that can impact production systems if not handled correctly.
The U.S. offered $10 million for information leading to the arrest of a Russian hacker known as "Wazawaka," who was involved in ransomware attacks.
Apple is being sued for not implementing a system to scan iCloud photos for child sexual abuse material.