Parse notes
Sponsored
Security researchers from Check Point's open-appsec tested the efficacy of several leading WAF solutions using a comprehensive dataset: 1,040,242 legitimate HTTP requests from 692 real websites [4], and 73,924 malicious payloads from common attack vectors.
Grubhub reported a data breach through a third-party provider that affects customers, merchants, and drivers. Hackers accessed personal information including names, emails, phone numbers, and partial payment data for some campus diners. While hashed passwords were exposed, bank details and Social Security numbers weren't compromised.
Zyxel has issued a security advisory about actively exploited flaws in CPE series devices that it has no plans to fix. VulnCheck released the full details of two CVEs - one is for insecure default passwords and the other is for improper command validation leading to command injection. According to FOFA and Censys, there are over 1,500 potentially vulnerable devices that are internet exposed.
A security flaw in AMD's SEV could allow an attacker to inject malicious CPU microcode with admin access. The vulnerability, tracked as CVE-2024-56161, has a high severity score of 7.2 and could lead to loss of confidentiality and integrity in a virtual machine environment. Google researchers discovered the flaw and AMD is working on a fix to address the issue.
Security has a unique position as a systems requirement. While "building security from the ground up" is a popular way of starting, using established security mechanisms and following best practices might be more practical.
This article examines an Attacker-in-the-Middle technique for stealing access and refresh tokens from the OAuth 2.0 authorization flow. The attacker first allows the user to go through the initial steps of the OAuth 2.0 flow until a response from the upstream server that has a header containing “nativeclient?code=“ is seen. This code can be used to request access and refresh tokens from the /oauth2/token endpoint.
Watchtowr Labs researchers discovered abandoned Amazon S3 buckets and monitored incoming requests to them. They found vulnerabilities in how these abandoned buckets were accessed and used by organizations, highlighting security risks. They registered and monitored the abandoned buckets to raise awareness and improve internet security.
An automated GitHub Actions-based crawler that fetches and updates public scopes from popular bug bounty platforms (like HackerOne, Bugcrowd, and Intigriti, etc) that updates every 10 minutes.
Seccomp-Diff is a tool that analyzes binaries and containers to extract and disassemble seccomp-bpf profiles. It includes a CLI tool for comparing seccomp profiles between containers and a web interface for visually comparing system calls within a Kubernetes cluster. The project is open-source under the MIT License but has limitations regarding architecture support and Kubernetes deployment.
The People Researcher Agent from Langchain AI searches the web for information about a person and organizes it based on a JSON schema provided by the user. The agent follows a multi-step process to research, extract, and evaluate data, allowing for thorough information collection. Users can customize the schema for the structured data output and evaluate the agent's performance using a provided dataset and evaluation script.
Anthropic has released Constitutional Classifiers, a new system for preventing AI model jailbreaks. The system uses natural language rules and extensive training data to detect and block prohibited content requests. It has withstood 3,000+ hours of bug bounty testing. Anthropic invites public testing through to February 10.
US prosecutors charged Andean Medjedovic, 22, for allegedly hacking Indexed Finance ($16M) in 2021 and KyberSwap ($48M) in 2023. The Canadian math prodigy, who's been a fugitive since 2021, faces fraud, money laundering, and extortion charges.
An in-depth look at the user-mode Treyarch Anti-Cheat (TAC) system used in Call of Duty Black Ops Cold War. The system uses Arxan as an obfuscation/protection tool which includes features such as runtime executable decryption, continuous executable checksum monitoring, Jmp and entry point obfuscation, and pointer encryption. Layered on top of this is TAC, which features various anti-cheat systems like network monitoring, API hook detection, debug register detection, anti-debugging capabilities, visuals detection, and custom syscall encryption, among others, and terminates the process on detection.
Android and iOS apps from Google Play and Apple App Store have a malicious SDK that steals cryptocurrency wallet recovery phrases using image recognition.
Over 700 vulnerabilities were publicly reported as exploited for the first time in 2024, a significant increase from the previous year.
A new ValleyRAT malware variant is spreading through fake Chrome downloads, targeting high-value individuals in organizations like finance and sales to steal sensitive data.