TLDR INFORMATION SECURITY 2025-01-15

See the full list here →

SCHOLASTIC EDUCATION GIANT BREACHED

A hacker going by the moniker Parasocial disclosed that they stole 8M records from Scholastic. The records contain a mix of names, email addresses, phone numbers, and home addresses with a total of over 4.2M unique emails. The hacker stated that they gained access via a compromised employee and don't plan to make the data public.

TELEFÓNICA CONFIRMS INTERNAL TICKETING SYSTEM BREACH AFTER DATA LEAK

Telefónica confirmed a security breach of its internal Jira ticketing system. Attackers using the aliases DNA, Grep, Pryx, and Rey accessed the system using compromised employee credentials and leaked approximately 2.3 GB of data on a hacking forum.

MILLIONS OF ACCOUNTS VULNERABLE DUE TO GOOGLE'S OAUTH FLAW

A security flaw in Google's OAuth login system allows attackers to access former employees' accounts by purchasing defunct startup domains. This affects millions due to startup failure rates. The vulnerability lets attackers access sensitive data in Slack, ChatGPT, HR systems, and more. Google initially dismissed but later acknowledged the issue.

COMPOUND PROBABILITY: YOU DON'T NEED 100% COVERAGE TO WIN

Compound probability is a concept in which the probability of two independent events occurring is the product of the probability of each event occurring. It explains how increasing attack surface coverage can significantly reduce an attacker's probability of evading detection. The article acknowledges some oversimplifications, particularly around EDR.

PASSWORD SPRAYING WITH SELENIUM AND FIREPROX

Password spraying attempts can often be hindered by IP based rate limiting. To circumvent this issue, this post walks through the setup of a dynamic proxy using Fireprox as well as Burp Suite Bambdas to modify the request to bypass CSP headers and other rate limiting. The post then concludes by showcasing how Selenium can be combined with the created proxy and crafted request to automate login attempts to achieve a password spraying attack.

RANSOMWARE ON ESXI: THE MECHANIZATION OF VIRTUALIZED ATTACKS

Ransomware attacks on VMware ESXi servers surged in 2024, with demands reaching $5 million and exposure of 8,000 hosts to the internet. Attackers targeted ESXi architecture through vCenter to gain control and disrupt operations. Strategies like updates, MFA, detection tools, and network segmentation are crucial in mitigating ransomware risks on ESXi.

Read the guide

SHIFT (PRODUCT LAUNCH)

Shift is a new paid Caido plugin that adds Copilot-like AI functionality to Caido.

EVIL-GO

Evil-Go is a fork of Go with some tweaks to make generated binaries more stealthy.

BUG BOUNTY WRITEUPS

This repository can be used as a reference while learning and performing Bug-Bounty hunting.

CRACKING THE CODE: HOW BANSHEE STEALER TARGETS MACOS USERS

Banshee Stealer is a macOS malware that first gained attention as a stealer-as-a-service in mid-2024. Its source code leaked in November 2024. Banshee steals system data, utilizes convincing pop-ups to convince users into entering their passwords, employs advanced evasion techniques, and exfiltrates data. The Banshee Stealer is a testament to the sophistication of modern macOS malware.

HOW BARCELONA BECAME AN UNLIKELY HUB FOR SPYWARE STARTUPS

Barcelona has emerged as a hub for spyware companies, including Palm Beach Networks (now Head and Tail), Paradigm Shift, and Epsilon. Companies are attracted by the city's lifestyle, lower costs, and easier spyware export regulations compared to Israel. Critics warn this development could fuel Europe's surveillance tech concerns.

MINISTERS CONSIDER BAN ON ALL UK PUBLIC BODIES MAKING RANSOMWARE PAYMENTS

The UK government plans to ban schools, NHS, councils, and critical infrastructure operators from making ransomware payments. Private companies must report intended payouts, which could be blocked if going to sanctioned groups. The measure aims to deter hackers, who collected $1.1bn globally in 2023.

MILLIONS OF OPENSEA USER EMAILS LEAKED IN 2022 NOW FULLY PUBLIC

7M emails obtained in a breach at OpenSea in 2022 have now been published.

JANUARY WINDOWS UPDATES MAY FAIL IF CITRIX SRA IS INSTALLED

Microsoft warns that January 2025 Windows updates may fail if Citrix SRA version 2411 is installed.

159-CVE JANUARY PATCH TUESDAY SMASHES SINGLE-MONTH RECORD

The January Patch Tuesday set a record with 159 CVEs, including 3 publicly disclosed and 3 exploited vulnerabilities, with critical impacts like Remote Code Execution.