Parse notes
A 2.9GB portion of Cisco data was leaked on Breach Forums by IntelBroker on December 16. The data, allegedly part of a 4.5TB dataset exposed in October, includes ISE, SASE, Webex, and other system information. Cisco maintains that no core systems were compromised.
Texas Tech University experienced a data breach affecting 1.4 million people due to a ransomware attack targeting its Health Sciences Center. Personal information like names, addresses, Social Security numbers, and medical details were compromised. The university is providing affected individuals with free credit monitoring services and has reported the incident to the US Department of Health and Human Services.
Ledger is a hardware cryptocurrency wallet that allows users to store, manage, and sell cryptocurrencies that use a multi-word recovery phrase for securing the wallets. A new phishing campaign is targeting Ledger owners with an email stating that a recovery phrase breach occurred and urging them to verify if their recovery phrase is secure. The link takes users to a fake Ledger page that prompts them to enter their recovery phrases and then transmits the phrase back to the attackers.
OpenID Connect is a mechanism for applications to authenticate without requiring long-lived credentials like API keys. This post provides tutorials for connecting GitHub and AWS to authenticate from GitHub Actions via OpenID Connect as well as sample workflows to build and push Docker containers to ECR and plan/apply Terraform changes. The post concludes by describing how OpenID Connect can be used with Amplify.
This article from Palo Alto Networks' Unit 42 team explains how LDAP, while essential for Active Directory management, is frequently exploited by threat actors like Stately Taurus and BlackCat ransomware groups who use tools such as AdFind and SharpHound for malicious reconnaissance. While detecting malicious LDAP activity is challenging due to high volumes of legitimate traffic, organizations can implement effective detection strategies by monitoring suspicious attributes, analyzing user context, and establishing behavioral baselines. The article concludes by highlighting how Palo Alto Networks' products like Cortex XDR, XSIAM, and Xpanse can help security teams detect and prevent LDAP-based attacks.
Reflected input in web attacks can sometimes be made exploitable by using the Range header to extract specific sections from a server response. By combining this technique with desync or header injection, attackers can turn previously unexploitable vectors into fully exploitable ones. The ability to manipulate the Range header can lead to successful attacks by extracting targeted content from server responses.
Keepit's platform is designed to make it easy for enterprises to back up and protect valuable data. Its benefits and capabilities include five-minute setup, instant restore, job monitoring, API support, customized retention, access control, audit logging and compliance, and data monitoring.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Applications and APIs.
Zizmor is a static analysis tool for finding common security issues in typical GitHub Actions CI/CD setups.
US officials are investigating TP-Link routers as a potential national security risk, considering a possible ban. The Chinese-founded company, which recently relocated to the US, has significant market presence including military bases. Microsoft reported that Chinese hackers were using TP-Link routers in attacks, though there is no evidence to suggest the company was complicit.
The EU has opened a second DSA investigation into TikTok, focusing on election risks after concerns about interference in Romania's presidential election. The probe examines TikTok's recommender systems and political content policies. The company faces potential fines of up to 6% of global turnover for violations.
In 2022, CISA published the Secure Cloud Business Applications (SCuBA) secure cloud baselines for Microsoft 365 with other cloud applications to come later. Citing a wave of recent attacks that were caused by improper configuration of cloud systems, CISA has issued a binding directive that federal agencies must abide by the SCuBA baselines. Federal civilian agencies will have until June 20, 2025, to implement the full binding directive with milestone deadlines along the way.
Meta was fined €251 million by Ireland's Data Protection Commission for a 2018 Facebook security breach affecting 29 million users' personal data that exposed information like names, contact details, and religious views.
The Play ransomware group has targeted Krispy Kreme, threatening to leak sensitive data just before Christmas.
Hackers are using Google Calendar to send fake invites and trick users into clicking malicious links.