Parse notes
Sponsored
Everybody knows data breaches can cost millions and negatively impact your brand. That's why robust security programs and inbound security reviews are critical to building customer trust. But when lengthy security processes begin stalling deals and creating internal friction, leadership starts to question security's ROI.
Two cybercriminals, Tyrone Rose and Shamara Simmons, were arrested for stealing hundreds of digital event tickets, including for Taylor Swift's Eras Tour. They intercepted legitimate StubHub URLs after purchases and resold about 900 tickets for over $600,000. The pair face grand larceny charges and potentially 3-15 years in prison.
ChatGPT Operator is an advanced AI agent equipped with web browsing and reasoning capabilities that can interact with websites on behalf of users. It is vulnerable to Prompt Injection attacks via instructions embedded into text or web content that can cause the model to browse sensitive pages and leak the information to attacker-controlled websites. OpenAI has implemented defenses such as prompting the user for confirmation, but researchers have shown that these mitigations can be bypassed.
Researchers at SquareX Labs developed a new “polymorphic” attack allowing malicious Chrome extensions to steal sensitive data. Once a user is tricked into installing the extension, it scans for password managers, impersonates them, and prompts users to reauthenticate, sending the information to attackers. SquareX Labs has urged Google to restrict extensions' ability to alter their appearance or behavior, but no mitigations currently exist for this attack.
This post details the concepts and tools behind EntrySign, the AMD Zen microcode signature validation vulnerability disclosed last month. It delves into microcode fundamentals, AMD's anti-tampering measures, and the specific vulnerability involving the CMAC hash function. It also announces the release of the Zentool suite, which consists of tools for microcode patch examination, including limited disassembly, microcode patch authoring using a limited amount of reverse-engineered assembly, microcode patch signing, and microcode patch loading.
Grant access to a specific IAM role using the Principal element of the resource-based policy, an AWS account using the Principal element, a particular IAM role in an account using the AWS:PrincipalArn condition, and an entire AWS organization using the AWS:PrincipalOrgId condition. This post includes an example scenario with an S3 bucket and discusses tradeoffs associated with each method.
Palo Alto's Unit 42 is monitoring a new malware known as Auto-Color. Upon startup, if the malware is not named Auto-Color, it will try to install a malware implant that imitates libcext.so. It also copies itself to /var/log/cross/auto-color and adds this library to ld.preload. Besides its command and control capabilities, the harmful library implant uses custom encryption and strives to conceal network communications by hooking into libc's open function.
Sponsored
Organizations have been using SIEMs for decades — but the needs of SOC leaders and practitioners have changed dramatically.
Aryon scans the cloud application and infrastructure for security issues or policy violations before deployment. If any issues are detected, the platform alerts the developers with suggestions for resolving the problem.
copa is a CLI tool written in Go and based on buildkit that can be used to directly patch container images given the vulnerability scanning results from popular tools like Trivy.
CaptainCredz is a modular password-spraying tool with a cache mechanism and fine-grained timing control.
Badbox Android botnet was disrupted by a coordinated effort by Google, Human Security, and others to stop the compromised devices from talking to C2 servers. It was distributing malware through compromised Android-based TV boxes.
The UK government took down encryption advice from its websites shortly after requesting backdoor access to Apple's iCloud. The National Cyber Security Centre has stopped recommending encryption for individuals at high risk of being attacked.
UK Government's Digital Security by Design (DSbD) is championing technologies like CHERI to improve memory safety to add hardware-level memory safety that could work with existing C/C++ codebases. CHERI provides extensions to hardware ISAs to enable fine-grained memory safety.
The US Justice Department has charged APT27 hackers with conducting global cyberattacks on government agencies since 2011.
Scammers used AI deepfake technology to impersonate YouTube's CEO in a phishing scam targeting content creators.
The U.S. Secret Service seized the domain of sanctioned Russian crypto exchange Garantex with the DOJ's Criminal Division, FBI, and Europol.