Parse notes
Sponsored
Flashpoint identified 4,500+ ransomware attacks in 2024, with 53% targeting U.S. companies. Ransomware operations have grown more sophisticated — strategically combining phishing, infostealers, and vulnerability exploits to breach defenses.
The popular macOS terminal emulator iTerm2 released a critical security fix for versions 3.5.6-3.5.10. The vulnerability arises from a bug in the SSH integration feature which causes input and output to be logged to a file /tmp/framer.txt on the remote host. Users are advised to upgrade and remove any /tmp/framer.txt files that may have been created.
Clickjacking attacks are when an attacker utilizes an iframe to trick a user into clicking on content from a legitimate page that an attacker is hiding from the user and is largely prevented by modern browser defenses. A security researcher has introduced a new technique called DoubleClickjacking where the attacker launches a new window that covers the original page and prompts the user to double click to solve a captcha or the like. The page will then listen for the first click and close itself while having the parent navigate to the target site and capture the second click, bypassing browser defenses.
Scans from the ShadowServer security threat monitoring platform Shadowserver has shown that around 3.3 million hosts are running POP3/IMAP services without TLS encryption enabled and expose usernames and passwords in plain text when transmitted over the Internet. IMAP is recommended for accessing emails on multiple devices, while POP3 downloads emails to a single device. Enabling TLS encryption can protect usernames and passwords from being exposed in plain text during email exchanges.
Dave Bogle of Red Canary steps through the process of investigating a strange behavior in GCP where a service account's access to GCP wasn't revoked when the access key was deleted. Bogle discovered that the token that GCP creates for service account's access access is not revocable but ultimately this is mentioned in the GCP documentation. In this post, Bogle walks through how he created detection logic around this behavior based on his research.
TLSH is a locality-sensitive, fuzzy hashing mechanism that can be used to compare two files to determine how similar they are. In this post, Target's security team walks through how they utilize TLSH for hunting malware variants of known malware families using Strelka. This approach requires files to be over 50 bytes in length, regularly updating a list of known malicious TLSH values, carefully tuning similarity thresholds, and may not work on packed or obfuscated malware.
The article discusses how Chrome DevTools Recorder enables non-intrusive web reconnaissance by isolating its scripts from the application's environment. By capturing user interactions without interference, the Recorder provides valuable insights for building secure and reliable tools. Lessons from DevTools can guide the design of tools that support security researchers in uncovering vulnerabilities without disrupting normal application behavior.
A collection of tools that can be useful for a SOC Analyst, divided by category. Categories include: network traffic, analysis, and detection tools, system logs collection and analysis tools, disk imaging, live analysis, and offline analysis tools, memory capture and analysis tools, and threat intelligence tools.
CF-Hero is a tool that uncovers the real IP addresses of Cloudflare-protected websites through DNS reconnaissance and intelligence sources like Censys and Shodan. It distinguishes between domains protected by Cloudflare and those that are not to help validate findings and minimize false positives. The tool offers advanced features like custom JA3 fingerprint support, concurrent scanning, and proxy support for comprehensive analysis.
OGP-CTF is a series of 13 challenges ranging from easy to hard aimed towards training developers in bug hunting and secure coding. The CTF is built on Vercel + NextJS, CTFd, and Cloudflare Access.
AWS introduced the AssumeRoot API operation that allows for an IAM user in a management account of an organization to gain temporary credentials to the root user of a member account. The Elastic security team showcases how this privilege can be abused by an attacker to elevate compromised credentials in a management account to full compromise of a member account. The post includes Terraform code to setup the testing environment and detections to detect the attack.
Lukasz Olejnik raises concerns about how Google's policy change to allow device fingerprinting for advertising leads to privacy erosion. This shift contradicts previous commitments to user privacy, potentially setting a new standard for data collection in the online ecosystem. The use of fingerprinting raises questions about transparency, user control, and the future of internet privacy.
Vectra's Kat Trexler writes about "insecure by design" flaws in cloud and contrasts them against traditional bugs and feature abuse. Insecure-by-design flaws in cloud services often stem from fundamental design issues, requiring more than simple patches for remediation. Mitigating these vulnerabilities involves a holistic strategy that involves implementing preventative controls like guardrails and focusing on detection and response measures.
All the videos from the 38th Chaos Communication Congress (38C3) have been posted.
Lumen has reported that it has locked out the Salt Typhoon hacking group from its network after targeting U.S. telecom firms.
A 20-year-old U.S. Army soldier named Cameron Wagenius has been arrested for allegedly selling and leaking confidential phone records from AT&T and Verizon.