Parse notes
Crypto exchange Bybit has suffered a major hack, losing approximately $1.4 billion worth of Ethereum from a multisig wallet. CEO Ben Zhou confirmed the breach, which represents the largest crypto theft in history and potentially the largest single theft ever.
SpyLend is a malicious app masquerading as a finance app called Finance Simplified on the Google Play store. The app evaded detection by running a WebView which instructed users to download an APK for a loan app if the user was in India. It collected a large amount of data and used it to extort users to accept high interest rate loans.
Threat actors have been abusing major Counter Strike 2 tournaments to steal Steam accounts and crypto via stream jacking. They are impersonating professional CS2 players on live streams and promoting fake skin and cryptocurrency giveaways. The attackers use hacked YouTube accounts with looped footage of past streams to trick viewers to scan QR codes or send them crypto.
A manufacturing company suffered a sophisticated cyberattack where threat actors used a spam email flood as a decoy to contact employees via Teams, posing as IT support. Using Windows Quick Assist, they gained access and achieved network infiltration in just 48 minutes, much faster than typical attacks. This blog dives into how this became possible.
This blog post describes the Vulnwatch tool from Databricks, an AI-powered system that automatically identifies and prioritizes vulnerabilities in third-party libraries, achieving 85% accuracy in identifying business-critical CVEs while reducing manual security team workload by 95%. The system combines multiple scoring methods including severity score (based on CVSS, EPSS, and community impact), component score (measuring library criticality to Databricks services), and topic score (using LDA to cluster libraries by service context). Using fine-tuned LLMs and vector similarity matching, the system can identify vulnerable dependencies on day zero, enabling the security team to focus only on the most critical 5% of vulnerabilities rather than sifting through hundreds of daily CVE publications.
AI vulnerabilities shift the traditional patching paradigm from patching individual vulnerabilities to a data modeling problem. This post from NCC Group explores the Gatekeeper and State Machine architectural pattern for securing the data that enters and exits an AI system. Each architecture includes an explanation of the architecture and examples of how it can be applied.
BforeAI uses predictive attack intelligence technology to create a list of domains that are likely to be used for malicious purposes in the future instead of leveraging blocklists consisting of domains that have already been seen in attacks.
SHAREM is a shell code analysis framework that is capable of emulating more than 20K WinAPIs and virtually all Windows syscalls.
OSX-PROXMOX allows you to install OSX (aka Hackintosh) on any computer. The README describes the various steps one can take and even claims to be able to install on a cloud VM.
Apple has discontinued Advanced Data Protection (ADP), its end-to-end encrypted iCloud storage service, for new UK users and will require existing users to disable it. This follows reports of UK security services requesting backdoor access to encrypted backups.
Cryptographer Matthew Green discusses the backdoor request that the UK government made from Apple and Apple's subsequent decision to disable their encrypted cloud backup feature. He discusses three different points around how seriously Apple has taken encryption for customers, the exact asks from the UK government as well as the ramifications, and how Apple might respond. Green ends on a note that the exit makes the UK Government's request for backdoor moot, but it's unclear what will happen to users who already had Advanced Data Protection enabled, whether they would retain the encryption or be forced to downgrade.
In this transcript of a talk that David Kennedy gave at BSides London 2024, Kennedy breaks down how existing binaries like Cloudflared and SSH can be used for tunneling and port forwarding in network security scenarios. He notes that the initial example relies on SSH existing on the system and also discusses how the binary can be copied into a Windows system easily. Kennedy also explores defensive measures such as monitoring for specific command line switches and DNS logging to detect potential attacks involving these binaries.
Microsoft has increased bug bounty payments for moderate-severity vulnerabilities from nothing to a maximum of $5,000 and expanded the range of vulnerabilities it will pay people to find and report vulnerabilities.
OpenAI has banned accounts that were misusing ChatGPT for suspected surveillance activities, including analyzing real-time data on anti-China protests.
Google Chrome is disabling uBlock Origin and other extensions in favor of Manifest V3.