Parse notes
Casio confirmed that an October ransomware attack by the Underground gang compromised the personal data of 8,500 people, including 6,500 employees and 1,900 business partners. The attack stole 200GB of data, though customer credit card information remained secure.
The UN's International Civil Aviation Organization (ICAO) is investigating a potential data breach after cybercriminal "Natohub" claimed to have stolen 42,000 documents containing personal information. ICAO previously faced a 2016 cyberattack that they allegedly attempted to cover up.
Security Researcher Matt Brown purchased and reverse engineered the firmware of a Motorola automated license plate reader (ALPR) system. Brown used a unique error page to find 150 Internet exposed Motorola ALPR systems that did not implement any form of authentication. Wired journalists confirmed that these cameras are deployed by law enforcement and are leaking license plate number, car location, make and model, and other metadata from thousands of cars in just 20 minutes of sample time.
This post introduces some of the improvements that the new Yara-X Mach-O module makes over the original. The new Mach-O module parses many of the core structures that are used in Mach-O binaries including the symbol table, imports, exports, entitlements, remote paths, and dylibs. The module also allows for calculating binary similarities by hashing the above structures.
Part 1 of a series of blog posts exploring the Entra metaverse and demonstrating attacks against it. It introduces the concept of the Entra metaverse and demonstrates how the compromise of an Entra user can be used to fully compromise an on-premise AD user. The following posts explore cross-domain attacks and argue that the Entra Tenant is your trust boundary when using Entra.
This article describes a technique called "cross-cache attack" in Linux kernel exploitation that allows transferring a Use-After-Free (UAF) vulnerability from one object to another, even if they're allocated from different slabs. The attack involves a five-step process: spraying object-A sharing a slab with object-V, allocating a victim object-V, freeing object-V, freeing specific objects to trigger slab recycling through the buddy system, and finally spraying object-B to overlap with the freed object-V's memory. The article provides detailed code examples and experimental results, including a timing-based technique called SLUBStick that helps determine the state of slab allocation in the kernel.
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Element is designed to proactively identify and mitigate risks by continuously discovering and mapping assets, and feeding identified assets into a proprietary exploit engine to assess exploitability.
ConvoC2 provides C2 infrastructure that allows for executing system commands via Microsoft Teams.
Brian Krebs has notes on a sophisticated voice phishing operation called "Crypto Chameleon" that is exploiting Apple and Google's legitimate services to scam cryptocurrency owners, using a coordinated team approach and phishing panels to steal millions from victims including billionaire Mark Cuban, while operating openly on messaging platforms like Discord and Telegram where the criminals frequently betray each other.
The Chief Digital and Artificial Intelligence Office (CDAO) led an effort in coordination with the Crowdsourced AI Red-Teaming Assurance Program and healthcare agencies to evaluate the usage of LLMs in military medical services. The over 200 participants evaluated three popular LLMs for a clinical note summarization and advisory Chatbot. The effort was concluded with over 800 potential vulnerabilities and biases identified with suggested improvements to reduce the number in future efforts.
WatchTowr Labs researchers discovered over 4,000 active web backdoors that were hijacked by registering expired domains. The backdoors allowed unauthorized access to high-profile targets like government and university systems. The domains are now managed by The Shadowserver Foundation to prevent misuse by cybercriminals.
While magic links in emails are being promoted for easier logins, they can be problematic for users with multiple devices and slower connections.
Apple's new AI feature is rephrasing scam messages to look more legitimate on iPhones and Macs, potentially leading to more people falling for scams.
Researchers successfully cracked a 512-bit RSA key in the cloud for less than $8, demonstrating the importance of using secure key lengths in email security measures.