Parse notes
A critical SQL injection vulnerability in PostgreSQL, working alongside a BeyondTrust zero-day, was essential to the December US Treasury breach. The bug affects all PostgreSQL versions but requires complex exploitation, which is why it may have caught the Treasury's security team by surprise.
The Watergate Hotel is notifying 2,200 victims of a data breach that occurred in April 2024. The breached data includes names, financial and credit card information, health insurance and medical information, SSNs, government IDs, and driver's license numbers. The Qilin ransomware gang took credit for this attack in May 2024 but Watergate has not confirmed the details.
Valve is notifying users who downloaded the PirateFi free-to-play game that they discovered that it was malware. The game seems to have been a Trojan that steals browser cookies from the infected system. A user reported that the game was being circulated via bots on Telegram channels offering $17/hour to be an in-game chat moderator.
Google's new Android fraud protection feature aims to detect and block scam attempts in real-time, identifying suspicious apps and activities before they reach users. While a significant improvement for security, it's not foolproof - users still need to practice basic cybersecurity and remain vigilant against evolving threats.
The Quiq team undertook a project to identify malicious or overprivileged Chrome extensions using osquery. They developed a query that would surface the uid of any Chrome extension with clipboardWrite, all_urls, tabs, or cookies permissions. The team then examined the Chrome extension store page of each application and allowlisted or removed them.
Google has thousands of web apps that it needs to protect from three fundamental weaknesses of the design of the web: lack of encryption, lack of isolation, and injection. To combat this, Google has developed a high-assurance web framework that is built upon safe coding, adaptability, and observability. This post also includes a case study and table of different key security controls and how they map to elements of the framework.
Sponsored
Microsoft's security baseline covers just 137 of 2000+ policies,
helps you secure Microsoft 365 by closing attack vectors, enforcing zero trust, and hardening access. Learn key configurations for Exchange, SharePoint, Teams, and more.
QuSecure is designed to help organizations migrate to Post Quantum Cryptography without overhauling existing infrastructure. The company touts a software-based security architecture that overlays onto current networks, providing cryptographic agility and multi-layered protection.
PyCript WebSocket is a Burp Suite extension that enables users to encrypt and decrypt WebSocket messages.
Terraform-AWS-Vulne-Soldier (aka vulne-soldier) provides a Terraform module for automating the remediation of EC2 vulnerabilities based on Amazon Inspector findings.
Doge.gov documenting Elon Musk's team's federal cost-cutting efforts had glaring security flaws that allowed anyone to edit its database as demonstrated by experts by adding unauthorized entries.
AWS IAM has launched a new capability that supports sending encrypted SAML assertions from an IDP to AWS. This protects the assertions by allowing them to be encrypted in transit through any intermediaries.
A China-linked threat actor, previously known for espionage activities using the PlugX backdoor, conducted a ransomware attack against a South Asian software company in late 2024, demanding up to $2 million in ransom. The attack utilized the same toolset seen in earlier espionage campaigns, including a malicious DLL sideloaded through a legitimate Toshiba executable, which was linked to the Fireant (aka Mustang Panda) espionage group. While several theories were proposed for this unusual combination of espionage and ransomware activity, Symantec notes that the most likely explanation is that an individual actor was attempting to profit personally using their employer's toolkit.
After 3 months of testing in Canary releases, Google Chrome now uses AI for "Enhanced protection" to guard against dangerous websites and downloads in real-time.
Microsoft Threat Intelligence reported that Storm-2372, an advanced persistent threat (APT) group, has been using a device code phishing technique since August 2024 to bypass multi-factor authentication (MFA) and gain unauthorized access to targeted accounts.
Veriti Research reported that cybercriminals are exploiting public interest in the recently declassified files related to John F. Kennedy (JFK), Robert F. Kennedy (RFK), and Martin Luther King Jr. (MLK) by launching phishing campaigns, distributing malware, and setting up fake domains to steal user credentials and compromise systems.