Parse notes
Law firm Wolf Haldenstein suffered a data breach in December 2023 that affected 3.4 million individuals. The breach exposed sensitive information including Social Security numbers, medical data, and employee IDs. The firm enhanced security measures and offered credit monitoring to affected individuals, who were notified in May 2024.
Cybersecurity researchers have uncovered a campaign targeting PHP servers to promote gambling sites in Indonesia using Python-based bots. The attacks involve the deployment of GSocket to exploit web shells on servers running popular platforms like Moodle. Site owners have been advised to update plugins, block rogue domains, and remove suspicious accounts to defend against the malware.
A malicious PyPi package is attempting to squat the official Discord Python library. The malicious package steals Discord auth tokens and relays them to an external server as well as setting up a backdoor on port 6969. The package is reportedly still available and was published by a verified publisher account.
Binary Security has identified three SSRF vulnerabilities in Azure DevOps: an endpoint proxy vulnerability, a DNS rebinding bypass, and a hooks SSRF with CRLF injection.
Sigstore's Rekor provides a signature transparency log and Fulcio provides a certificate transparency which can be used to enhance auditability and discoverability of artifact metadata and code signing. Rekor-monitor can be utilized for checking the consistency of transparency logs or monitoring for compromised accounts. A demo is included in the post.
There is a significant security vulnerability in TPM2-based disk encryption systems where an attacker with brief physical access can bypass disk encryption on machines using systemd-cryptenroll or clevis without a PIN. The vulnerability exists because most TPM2 unlock setups fail to verify the LUKS identity of the decrypted partition, allowing attackers to create a malicious partition that can extract the original encryption key while maintaining the TPM state. This post demonstrates successful attacks on both Fedora and NixOS systems. It recommends either using a TPM PIN or implementing proper PCR 15 verification as mitigation strategies, though it notes that the latter is not easily available on most distributions.
Sponsored
Discover how to make edge computing your competitive edge. Grab a copy of the Gartner Innovation Insight report [10] on integration strategies, edge computing applications, and best practices for edge-driven transformation. SUSE - a premium provider of open source Linux edge solutions - is sharing this must-read briefing for free.
SCALIBR (Software Composition Analysis Library) is an extensible file system scanner used to extract software inventory data (e.g. installed language packages) and detect vulnerabilities. It is a versatile file system scanner that detects vulnerabilities and extracts software inventory data. OSV-SCALIBR combines SCALIBR with OSV-scanner for software inventory extraction and vulnerability scanning. It can be used as a standalone tool, as a library for custom scans, or to analyze container images.
Copycat is a library that helps intercept system calls in a more efficient way on Linux systems 5.9 or higher. It offers faster performance compared to traditional ptrace-based methods by utilizing the SECCOMP Notifier API. Users can set rules for intercepting system calls by defining source and destination mappings either through environment variables or a configuration file.
A repository of credential stealer YARA rules for system information.
President Biden issued a broad cybersecurity executive order in his final days that covers federal network security, software supply chain protection, and AI security measures. Though comprehensive, critics note that the timing, near Trump's presidency, makes implementation uncertain, as many deadlines extend into the new administration.
Raspberry Pi's RP2350 microcontroller was subjected to security testing for a $20,000 prize challenge. Four teams discovered vulnerabilities requiring physical access, including power glitching, laser injection, and antifuse memory extraction techniques. Raspberry Pi openly acknowledged these findings, planning fixes in future versions while maintaining its "security through transparency" approach.
Privacy group noyb has filed GDPR complaints against six Chinese tech companies (TikTok, AliExpress, SHEIN, Temu, WeChat, and Xiaomi) for unlawfully transferring European users' data to China. Given China's surveillance practices, noyb argues these transfers violate EU data protection laws and requests immediate suspension and fines.
AWS has added a new course on securing generative AI workloads to its Skill Builder catalog.
OSV saw significant growth in ecosystem support in 2024, especially with Linux distributions like Ubuntu and Red Hat adopting the OSV Schema.
Amazon discusses how it combines physical and logical security measures to protect attendees and data at events like re:Invent in Las Vegas.