Parse notes
Wiz Research discovered an exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup. The database, accessible without authentication, contained over a million log entries including chat histories, API keys, and sensitive backend data. DeepSeek promptly secured the database after being notified of the exposure.
Researchers discovered hackers exploiting vulnerable WordPress sites to trick visitors into downloading fake browser updates containing malware. The ongoing campaign affects thousands of websites, including popular ones, and targets both Windows and Mac users. The malware aims to steal passwords and personal information through deceptive update prompts.
This blog discusses new GitHub Copilot vulnerabilities, for example, using the word "Sure" can trigger unethical responses like SQL injection tutorials. It aims to highlight weaknesses in AI assistant security safeguards.
Lumen Technologies' Black Lotus Labs has been tracking a malicious campaign that targets Juniper enterprise routers. The malware is a passive agent that listens for one of five parameters sent in a “magic packet.” This post contains a technical analysis of the magic packets and indicators of compromise for threat hunters.
Sigma provides a backend-neutral detection signature language for logs that can be converted to a variety of different query languages such as Splunk SPL or Sentinel KQL. This post walks through a Sigma rule to explain the components and syntax. It then introduces some more advanced features such as pipelines to resolve mapping issues between rules and data sources and correlation rules to provide stateful detections.
Backline's AI agents act as software and security engineers, analyzing potential vulnerabilities, collecting context, and determining how to optimally address an issue for the customer's specific environment. The agents then autonomously implement the needed code and configuration changes.
SeCoRa is an AI-powered code review tool for detecting and remediating vulnerabilities in codebases.
YaraMonitor is a tool that monitors malware samples using YARA rules. It continuously analyzes and alerts on new uploads from sources like MalwareBazaar and can be extended to monitor additional sources. Running the main.py script from the root folder will automate the ingestion and scanning process for malware samples.
Cash App's security team devised a Data Safety Levels (DSL) Framework based on the CDC's biosafety levels to utilize for data classification. The framework takes a dataset level approach to devise standardized rubrics for evaluating data based on its usage such as Consumer Personal Data and Payment Card Data. The framework couples with automation to be able to classify data as part of Block teams' regular workflows as well as guidelines on how to handle data of various sensitivity levels.
An executive-level brief on common classes of security issues. The first three focus on vulnerabilities in code such as lack of input validation, lax or missing authentication, and lack of API protections. The last two focus on lack of appropriate tools like WAFs and insufficient or inefficient automations.
CISA released a fact sheet about a backdoor in Contec CMS8000 patient monitors that allows unauthorized access to patient data.
North Korean hackers posed as recruiters to steal credentials from over 1,500 developer systems worldwide in a coordinated cyber campaign.
DARPA is developing an ambitious project called Red-C that aims to create self-healing firmware capable of automatically detecting, responding to, and recovering from cyberattacks at the bus level of computer systems, though the project faces significant technical and adoption challenges.