Parse notes
WhatsApp has won a lawsuit against NSO Group, maker of Pegasus spyware, over hacking 1,400 devices of activists, journalists, and officials. The court rejected NSO's defense that clients used Pegasus for legitimate investigations and the case will proceed to determine damages.
Ascension, a large U.S. healthcare system, had the personal and health data of 5.6 million patients and employees stolen in a ransomware attack. The breach led to the company offering free identity theft protection services to those affected for 24 months. The ransomware attack impacted electronic health records and forced the healthcare giant to temporarily halt some services.
Bishop Fox identified over 400K SonicWall VPN Firewalls with either a management interface or SSL VPN interface that are internet exposed. Of these devices, over 20K are running end-of-life firmware versions. However, a larger total of over 25K firewalls that are exposed are vulnerable to a critical vulnerability, and nearly 100K are exposed to a high vulnerability.
Real-Time Operating Systems (RTOS) are specialized systems that handle time-critical tasks with strict deadlines. Unlike general operating systems, RTOS prioritizes predictable execution timing and is essential in applications from car brakes to video games where split-second precision is crucial. This blog post dives into everything RTOS and their uses for cybersecurity.
The author decided to examine the Wazuh EDR tool via fuzzing and found 2 vulnerabilities that could lead to total network compromise. Wazuh consists of an agent that runs on the device, a server that accepts events from the agent, and an analysis engine that parses the event to trigger actions. The author describes how they discovered a command injection vulnerability in the host_deny active response which they chained with a heap buffer overflow that allowed for RCE to achieve unauthenticated RCE as root to compromise a full network.
The Winnti hacking group has begun using a new Glutton backdoor to attack targets in the US and China. Glutton is a PHP malware that masquerades as a php-fpm process that facilitates fileless execution and injects malicious code into PHP files. It is an advanced backdoor that establishes persistence and supports 22 commands for C2. Notably, the Winnti group has been hiding Glutton in tools sold on cybercrime forums to attack other cybercrime groups and steal their information.
Krueger, a .NET post-exploitation tool, can remotely disable Endpoint Detection and Response (EDR) during lateral movement procedures. It utilizes Windows Defender Application Control (WDAC), a Microsoft application control utility capable of blocking code at both user and kernel-mode levels. With administrative privileges on a remote target, Krueger can deploy a WDAC policy and remotely reboot the device, preventing the EDR service from starting.
OPA 1.0 is a major release that enhances Policy as Code development, focusing on improving the developer experience and consistency of the language. Users are encouraged to upgrade to OPA 1.0 for new features, syntax improvements, and performance enhancements, with detailed instructions provided for a smooth transition. The release signifies a significant milestone for the project, offering a solid foundation for Policy as Code projects and inviting community feedback to shape future releases.
Flare watches for signs on the dark web that its customers' logins are being circulated and then automatically resets the impacted passwords before the thieves can gain access. It also watches for stolen session cookies that can trick computers into thinking the hacker is a previously authenticated user.
Much of the common wisdom around Cloud Security as well as CNAPP tooling does not consider the discoverability aspect of exploiting resources. This post enumerates some prior work on AWS reconnaissance techniques such as exploiting CDK naming, brute forcing SQS queues, abusing misconfigured ECR policies, and domain takeover via deleted S3 buckets. The author then introduces a new tool that they created called awseye that can enumerate discoverable resources given an AWS account ID.
AWS Secrets Manager offers transforms that will add a nested CloudFormation stack for HostedLambdaRotation that allows for pre-built Lambdas for secrets rotations for a subset of supported secrets. AWS has now enhanced this offering to support automatic upgrades of the Lambda functions as well as more CloudFormation resource attributes. The blog post contains upgrade instructions but also notes that the new transforms are not backwards compatible.
This detailed blog post from Google Project Zero explores the regf file format used by the Windows Registry since Windows NT 3.1, which uniquely represents registry data simultaneously on disk and in memory. The format consists of several key components including a base block (header), bins that store data in 4KB chunks, and cells that contain the actual registry data like keys, values, and security descriptors. The post also explains how Windows implements self-healing properties when loading potentially corrupted hives, attempting to fix or isolate damaged data while preserving overall hive integrity whenever possible.
Rostislav Panev, a developer of the LockBit ransomware group, has been arrested by the United States for his role in cyberattacks causing billions in damages.
CISA has released guidance for protecting mobile communications following Chinese state hackers targeting major US telecom carriers.
The top 10 software weaknesses are XSS, OOB write, SQL injection, CSRF, path traversal, OOB read, OS command injection, use after free, missing AuthZ, and unrestricted upload of files with dangerous types.