Parse notes
Sponsored
If your vulnerability management only kicks into action after the bad thing has happened, it's not good enough. You need to find and plug vulnerabilities before they can be exploited to deploy ransomware, infostealers, and other threats.
Anna Jacques suffered a data breach towards the end of 2023 that led to the publication of the breached data in early 2024. The hospital concluded a manual review of the breached data in November 2024 and has notified the over 300K individuals who were affected. The exposed information includes demographic information, medical history, health insurance information, SSNs, driver's license numbers, and financial information.
A data breach at the app Senior Dating has exposed the data of over 700K users. The owner of the site acknowledged the breach as well as a breach on Ladies.com which affected over 100K users in an email announcing the closing of both apps. The breached data includes bios, dates of birth, drinking habits, education levels, email addresses, genders, geographic locations, occupations, profile photos, relationship statuses, smoking habits, and social media profiles.
A bug in WPForms allows users to issue Stripe refunds on over 6 million WordPress sites. The vulnerability was categorized as high-severity and a patch has been released in version 1.9.2.2. Website owners are advised to update to the latest version to prevent potential revenue loss and business disruption.
Researchers from Tenable investigated the OPA policy-as-code language and the Terraform infrastructure-as-code language and discovered new attack techniques. When investigating OPA they found that data can be exfiltrated from IMDSv2 using the http.send function in Rego or via DNS tunneling if http.send is disabled. In Terraform, the team explored some known weaknesses in Terraform plans such as usage of the external, HTTP, or external data source as well as the local-exec and remote-exec provisioners. Tenable suggests only using trusted modules and policies, setting up cloud and application logging, limiting network access, and scanning to mitigate these risks.
Cross-IdP impersonation is an attack in which an attacker signs up for an account on an app that can function as an IdP and links it to the employee's company email address via a “use existing email” option. The attacker then either bypasses verification or verifies the domain by clicking a link in the email (or socially engineering an employee to click the link). The attacker can then sign into downstream apps by using the “sign in with” option with their impersonated IdP. Application protections against this attack vary significantly so Push Security suggests that companies alert on activation links to employee's emails, warn users of the risks associated with phishing, where possible configure SaaS apps to require reauthentication to add a new IdP, and where possible prevent the conversion of a personal account to a corporate account.
Zloader, a malware originally designed for banking trojans, has evolved into a sophisticated ransomware deployment tool. It now uses DNS tunneling, anti-analysis capabilities, and an interactive shell. Zloader attacks have become more targeted, and the malware has been updated with new features to evade detection. A specific variant, "BB3", is linked to Black Basta ransomware operations. Zloader's authors are focused on making the malware more resilient against security controls.
Sponsored
Developers need privileged access to cloud resources without getting bogged down by complex processes. Security teams need some level of oversight and control. ZERO STANDING PRIVILEGES (ZSP) help both teams strike the right balance. Get the CyberArk whitepaper [12] to learn how security teams can minimize risk by controlling time,
Vmi (Virtual Machine Introspection) is a Rust library that provides safe abstractions for analyzing and manipulating virtual machine state from outside.
This is a list of various Rust resources and tools to write secure Rust code.
GoCrack is a management frontend tool from Mandiant that provides APIs for managing password cracking tasks.
In 2021, Gabriel Koo noticed that the us-east-1.com domain was available and purchased it to prevent potential phishing. The most frequent DNS query that Koo observed was to a presumably production database (prod-backend-db.randomHash.us-east-1.com). Other top queries were to a loopback streaming service, a Cisco static file reputation host, and various cloud storage services. Koo encourages users to utilize tools like Route 53 Resolver DNS Firewall to prevent possible typos like this one.
In this article, Maya Kaczorowski distills lessons from interviews from 57 security leaders and discovers that the top three pain points in security are access management (overwhelmed by access request tickets), vulnerability management (struggling with too many vulnerabilities to patch), and SaaS logs (difficulty accessing and analyzing logs during incidents). Beyond technical issues, cultural complications like vendor sprawl, unclear ownership of assets, and challenges in communicating security risks make these problems even more difficult to address. While there's excitement about AI improving security tooling, many core security challenges remain fundamentally unchanged, with few true breakthrough innovations that have eliminated entire classes of security issues.
A DC circuit appeals court has upheld the law requiring TikTok to sell to an American owner or face an effective ban.
Senator Ron Wyden proposed a bill to enhance cybersecurity for U.S. telecom networks after Chinese state hackers breached major carriers earlier this year.
A man named Charles O Parks III, also known as "CP3O," pleaded guilty to wire fraud charges for running an illegal cryptomining operation that stole over $3.5 million worth of cloud computing resources.