Parse notes
Sponsored
TOMORROW: Join ThreatLocker Co-Founder & CEO Danny Jenkins and a Forrester expert to reveal key insights from the new Total Economic Impact™ of ThreatLocker [4] study by Forrester. On the agenda:
and improved labor efficiency by 50%. * Practical strategies to enhance security, streamline compliance, and minimize risk.
NTT Communications has disclosed a data breach affecting nearly 18,000 companies after detecting unauthorized access to its Order Information Distribution System on February 5. The breach exposed customer contract details, corporate contact information, and service usage data.
The PyPI package "set-utils" targets Ethereum developers using the eth-account library. The package hooks the from_key and from_mnewmonic() functions in the ethereum package to intercept private keys, encrypt them, and upload them to the Polygon blockchain. Polygon transactions have very low processing fees, no rate limits, and free public RPC endpoints, enabling attackers to retrieve the keys at any point without requiring their own infrastructure.
Researchers from Tarlogic Security discovered 29 undocumented commands in the firmware of the ESP32 Bluetooth device. The commands could allow for memory manipulation, MAC address spoofing, and LMP/LLCP packet injection. While the commands could open the door for supply chain attacks, a more realistic threat would be a physical attacker establishing persistence and performing further attacks through the ESP32's memory.
Mobile devices lead security with defense-in-depth strategies, moving sensitive data from untrusted kernels to higher trust levels like hypervisors and secure enclaves. Samsung's Real-time Kernel Protection (RKP), part of Knox on Exynos devices, uses H-Arx Hypervisor to protect the kernel. The post discusses how to reverse the hypervisor framework, which includes a common core (harx.bin) and loadable plug-ins in a proprietary uH format.
VBS enclaves allow a Windows user to run code in an isolated memory region that even the “standard” kernel cannot access. This presents an appealing attack surface for malware, as VBS malware would be invisible to EDR running in the standard kernel, but the VBS enclave code must be signed by Microsoft. This post explores bypassing the Microsoft checks by abusing debuggable enclave modules or exploiting vulnerable enclaves.
Rosetta 2 technology creates AOT files on Apple Silicon Macs, essential for analyzing macOS intrusions, even if malware is erased. Mandiant found that sophisticated actors target cryptocurrency firms with x86-64 malware due to its wider compatibility and lenient execution policies compared to ARM64. These AOT files, stored in protected cache directories, can uncover critical intrusion evidence through timestamps, execution patterns, and binary features, even after deleting malicious files.
Sponsored
Drawing from the industry's largest SaaS breach data repository and direct involvement in over 150 incident responses alongside firms like
covers:
JavaScript & Node.js open-source SAST scanner - a static analyzer for detecting the most common malicious patterns.
implant.js is a proof-of-concept modular implant platform that leverages the V8 JavaScript engine.
The ATT&CK Emulation Library hosts adversary emulation plans from published ATT&CK Evaluations. These plans emulate specific adversaries, like Turla, covering initial access to exfiltration. Organized by evaluation and threat actors, they simulate real breaches.
U.S. cybersecurity journalist "Dissent Doe" refused a U.K. court order to remove articles on the ransomware attack against healthcare provider HCRG. Citing First Amendment protections and U.S. jurisdiction, Doe noted that HCRG is taking legal action to stop the republication of stolen data.
A federal jury convicted Davis Lu, 55, of sabotaging his employer Eaton Corporation's systems after being let go. He created malware that crashed servers and a kill switch that locked thousands of employees out when he was fired in September 2019. Lu now faces up to ten years imprisonment.
1Password now lets users save a location with a password and view passwords in a "Nearby" tab. This feature could be useful for linking travel documents to airports or healthcare documents to doctors' offices. 1Password ensures that location data is not stored, shared, or tracked, with all nearby checks conducted on the device.
Chirp translates characters into sound frequencies for transmission between Computers and Smartphones.
The Akira ransomware gang used an unsecured webcam to evade Endpoint Detection and Response (EDR) systems and carry out encryption attacks on a victim's network.
Chromecast (2nd gen) and Chromecast Audio users have been unable to Cast audio or video content due to an "Untrusted device" error message.