Parse notes
Memorial Hospital in Georgia suffered a ransomware attack in November that affected 120,000 patients' personal and medical data. The Embargo group has claimed responsibility and leaked 1.15TB of data online. The hospital has offered affected individuals free identity protection and credit monitoring services.
Apple has pushed out security updates for iOS, iPadOS, and macOS. Specifically called out was an attack that could allow sophisticated attackers with access to a device to disable USB Restricted mode on a locked device. This vulnerability was reported by Citizen Lab and is being actively exploited.
KerioControl firewalls provide a network security suite for small and medium sized businesses. The ShadowServer Foundation reports that over 12K devices are currently exposed to attacks leveraging a 1-click RCE vulnerability. The vulnerability was caused by improper sanitization of a GET parameter which led to Reflected XSS and resulted in a 1-click RCE.
This post explores how to revive the abandoned Jooki children's audio players through firmware analysis and discovering exploits after the company's bankruptcy left devices non-functional. The solution uses Mender for software updates and can be controlled through a web interface, enabling customization and potential security risks. The author notes that by understanding its firmware, access points, and potential vulnerabilities, users can interact with Jooki more effectively and securely.
Some in the security community have argued that passkeys have failed at their promise of passwordless authentication and should instead be used as a second factor due to complexities such as account recovery on a new device. The author of this post argues that this reflects an improper way of thinking about passkeys and presents a login/registration flow that uses magic links for new device/registration and then uses passkeys for subsequent access.
The Australian Signals Directorate (ASD) has published a modern defensible architecture framework based on zero trust principles ("never trust, always verify," "assume breach," and "verify explicitly") and five key pillars (Identity, Devices, Networks, Applications/Workloads, and Data), emphasizing that organizations should prepare for "when" not "if" a cyber incident occurs. These principles, based on zero trust and secure-by-design practices, aim to enhance cyber resilience and protect critical assets. Organizations can use the Foundations to build a strong security framework adaptable to evolving technologies and threats.
Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs and a library that can be used by code to sandbox itself.
This repository contains a curated collection of useful FRIDA scripts and resources for dynamic instrumentation and reverse engineering.
Raink is a tool that solves general ranking problems using LLMs. It can be used to have an LLM answer questions such as determining which fix might best address a given security advisory.
The UK government allegedly secretly ordered Apple to create a backdoor in its encrypted iCloud storage, potentially affecting users worldwide. Critics and privacy advocates warn this sets a dangerous precedent as Apple may respond by discontinuing its Advanced Data Protection feature in the UK rather than compromise global security.
This article dives deep into user impersonation risks and mitigations, which is a common way to allow logging in as another user. This feature is often implemented by changing the sub property of a JWT but is inherently problematic as it requires maintaining an admin list and securing the feature, is insecure by design, and also muddies audit trails. One possible solution is to add a new claim to the JWT but this is error prone and instead advocates for using DOM recording to collect as much sanitized data about a user's session as possible instead.
The Amazon Redshift team has announced changes to the default settings for new Redshift clusters and those restored from snapshots. These clusters will now block public access and encrypt data at rest and in transit by default. Existing clusters will not be affected but Amazon recommends users implement the changes regardless.
Microsoft has expanded its Copilot AI Bounty Program by integrating online services vulnerability classifications, offering up to $5,000 for moderate severity cases.
A man in Alabama admitted to hacking the SEC's account to post a fake Bitcoin ETF approval announcement - he now faces 5 years in prison for identity theft and fraud.
Scammers are successfully tricking North American drivers into paying fake toll fees through SMS phishing attacks.