Parse notes
Juniper Networks is warning that session smart routers are being targeted by a Mirai botnet infection campaign. The default passwords for these devices have been added to the virus database. Juniper warns that any devices using the default passwords should be assumed to be compromised. It has provided threat hunting advice and is urging admins to reimage any infected devices.
BeyondTrust identified a security incident in which an attacker obtained a Remote Support SaaS API key which it used to access some Remote Support SaaS instances and reset passwords for local application users. As part of its investigation, BeyondTrust discovered two CVEs that could allow for RCE but did not mark either as being actively exploited. BeyondTrust has patched all cloud instances against these CVEs and is working with customers to ensure that self-hosted instances are patched.
A new post-authentication vulnerability in Four-Faith industrial routers, CVE-2024-12856, is being exploited in the wild. Using default credentials for remote command injection, the attack targets specific router models over HTTP, allowing attackers to execute commands on vulnerable devices. VulnCheck has notified Four-Faith and customers about the issue and recommends contacting Four-Faith for information on patches and affected models.
A glossary of exploitation techniques for exploiting AWS resources that can be misconfigured to be publicly accessible. Each attack features relevant CLI commands to carry it out as well as sometimes featuring a sample resource policy that could allow for it. The first section focuses on resources that can be found from a black box perspective and includes: exploiting S3 buckets for public list, read, and write, exploiting S3 buckets for authenticated list and write, exploiting S3 static site hosting or misconfigured CloudFront distributions for unauthenticated bucket list, exploiting EC2 to discover AMIs, exploiting EBS and RDS to discover public snapshots, exploiting misconfigured OIDC roles, and exploiting public SSM documents. The second section focuses on resources that can't be discovered from a black box perspective and includes: exploiting public SQS queues and SNS topics, exploiting private API gateways, exploiting Lambda functions, and exploiting public and private ECR repositories.
This README explains a simulation of an attack by the Wicked Panda group targeting government networks. The attack involves stages like DodgeBox DLL loader and MoonWalk backdoor for data exfiltration via Google Drive API. The attackers use techniques like DLL sideloading and hashing to evade detection and establish communication channels.
This blog post covers various methods, like expanding the prompt or encoding it in base64, that can be used to extract system prompts from AI models, potentially bypassing developer-imposed limits. Understanding these tricks can show the vulnerabilities in AI models and how they can be manipulated to disclose hidden prompts.
A tool from TCM Security to apply various fixes and install tools for Kali Linux VMs
SmuggleShield is a browser extension that helps prevent basic HTML smuggling attacks by detecting common patterns. It works on Chrome and Edge for Mac and Windows, providing an extra layer of security during browsing or team exercises. The extension uses machine learning and allows for incognito mode protection with manual activation.
AWS is preparing for post-quantum cryptography (PQC) by implementing NIST-approved algorithms to protect against future quantum computer threats to public key cryptography. Its migration plan consists of four workstreams: creating an inventory of current crypto usage (prioritizing data-in-transit), updating asymmetric key derivation between AWS endpoints and customers, addressing long-term digital signature keys, and handling short-term session signature keys. AWS recommends organizations prepare by making an inventory of their cryptography usage and upgrading to TLS 1.3.
VPNs have become ubiquitous as a way for protecting access to sensitive resources in organizations and preserving privacy for individuals. This has made VPNs a valuable target for attackers with VPN vulnerabilities on the rise since 2022. This article examines attacks in VPNs from Check Point, Fortinet, Palo Alto Networks, and Ivanti. For each vulnerability, the author demonstrates how to exploit the vulnerability and its impact.
The MISP-standard.org has introduced a new Threat Actor Naming Standard for cybersecurity information sharing. This standard aims to provide a structured approach for naming threat actors to improve collaboration and interoperability in the cybersecurity community. It offers global consistency, interoperability with existing platforms like MISP, and benefits such as enhanced collaboration and streamlined analysis.
Recorded Future's CEO has celebrated being the first cybersecurity firm to be banned by Russia.
A study found over 3.1 million fake stars across repositories and notes that users should be cautious and verify repository quality beyond star ratings.
GitGuradian provides a detailed timeline of events leading up to the US Department of Treasury Breach due to a compromised API key used for technical support by BeyondTrust, allowing remote access to workstations and documents.