Parse notes
Sponsored
Microsoft offers more than 2000 customizable policies for Office applications… but its security baseline covers just 137 by default. Haven't set these policies? Then you're potentially giving threat actors hundreds of ways to target your organization.
Ivanti has announced two high severity vulnerabilities in Ivanti Secure Connect appliances. The first vulnerability is a stack-based buffer overflow that allows unauthenticated, remote attackers to execute arbitrary code. The second vulnerability is a privilege escalation vulnerability for local, authenticated attackers. Ivanti says that the first vulnerability is being actively exploited and urges customers to update vulnerable devices.
PowerSchool, which serves 60 million K-12 students and teachers, suffered a data breach where hackers accessed personal information, including some Social Security Numbers and medical data, using stolen credentials. The company claims the data won't be shared publicly, though security firm Cyble suggests the breach may span years.
Excelsior Orthopaedics reported a data breach discovered in June 2024, exposing sensitive patient and employee data including Social Security numbers, medical records, and financial information. The company notified affected individuals on December 31, 2024, after investigating the unauthorized network access with cybersecurity experts.
This post refines a methodology for hiding Linux processes by using a bind mount to mount a different directory on top of /proc/PID for the malicious process. The author was looking to refine the original methodology by creating a more realistic directory to overlay but realized that they could instead overlay the proc directory of a spontaneous process which is usually ignored by sysadmins. They note that this method would still be easy to detect if you are aware of the technique and provide a command to do so.
A Permission Boundary defines the maximum permissions that can be applied to a given principal. In an AWS management account, permissions boundaries are necessary because SCPs cannot be applied. This post introduces a set of security invariants that should be true in an AWS management account and provides an IAM policy to enforce them. It also links to a Lambda function that can be used to attach the policy to all newly created IAM principals.
Google Chrome's Web Store policy prohibits developers from manipulating extension search results, yet hundreds violate this rule. Developers exploit language translation features to hide thousands of misleading keywords in alternative language descriptions, affecting search results and promoting unrelated or potentially abusive extensions.
Sponsored
In November 2024, CyberRatings[dot]org - a non-profit that evaluates cybersecurity products - released independent test results [11] on the effectiveness of cloud vendors' firewalls. The findings demonstrate variability in protection across the three major cloud platforms - with AWS Firewall blocking only 0.3% of exploits tested. Read more
Slack Jack is a tool that allows penetration testers to hijack a Slack bot using its token to perform various exploitation and enumeration functions.
Syzkaller is a kernel fuzzer that finds bugs in various operating systems like Linux and Windows. Originally for Linux, it now supports other OS kernels. It is a coverage-guided tool developed by Google but is not an official product.
WAFW00F is a tool that helps identify and fingerprint Web Application Firewall products protecting websites. It works by sending HTTP requests and analyzing responses to determine the type of WAF in place. Users can easily install WAFW00F from PyPI, run it in a Docker container, or build it from the source code available on GitHub.
100 Days of YARA is a community challenge to write a YARA rule every day for 100 days. This repository hosts individuals' YARA rules for the challenge as well as any tools or tips that users post.
Apollo Research tested 6 popular LLMs to determine how they would react when given a prompt that gave them a goal, instructed them to achieve their goal at all costs, and then gave them a task to review files that contain proof that the developers have a different goal. 5 out of the 6 models tested would attempt to circumvent hurdles or safeguards to their goals and in some cases, models would lie about the actions on consultations. The researchers found that some models could deliberately underperform or otherwise scheme to attempt to achieve their goals.
The EU General Court fined the European Commission €400 for violating GDPR by transferring a German citizen's personal data to U.S. companies through a conference registration system using Facebook login, marking the Commission's first such penalty.
Report on cyber security vendor funding, with funding raised by cybersecurity firms increasing to $9.5 billion in 2024 a decrease in funding volume.
Space Bears is a new Moscow-based ransomware group that emerged in April 2024, notable for its unique corporate-style presentation and professional marketing approach, which includes using business-like stock images and offering "guarantees" to victims while operating as part of the Phobos ransomware-as-a-service organization.
The OWASP Top 10 Non-Human Identity Risks for 2025 focuses on the growing challenges of managing Non-Human Identities (NHIs) in enterprise cybersecurity.