Search the archive

US FOOD DELIVERY SERVICE PURFOODS DISCLOSES DATA BREACH

Meal delivery service PurFoods says the personal and protected health information of more than 1.2 million individuals was stolen in a ransomware attack in early 2023.

HACKERS CAN SILENTLY GRAB YOUR IP THROUGH SKYPE

A security researcher has found that it’s possible to reveal a Skype app user’s IP address without the target needing to even click a link. Microsoft said the vulnerability does not need immediate attention.

US HACKS QAKBOT, QUIETLY REMOVES BOTNET INFECTIONS

The US government coordinated a crackdown on the QakBot malware family. The international team seized control of the botnet’s infrastructure and removed the malware from tens of thousands of infected devices.

DARKGATE - THREAT BREAKDOWN JOURNEY

A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate. It leverages hijacked email threads to trick recipients into downloading the malware. The attack uses phishing to direct users to an MSI payload subject to certain conditions. This article breaks down how this malware works and the technicalities behind it.

PIVOTING CLOUDS IN AWS ORGANIZATIONS

This is part 2 of a series on pen-testing AWS organizations. The first part of the series provided an overview of AWS organizations and some of the “easy wins.” Part 2 covers newer and more advanced AWS security mechanisms.

USING HASHICORP VAULT TO DYNAMICALLY CREATE MYSQL CREDENTIALS

A tutorial on how to configure Hashicorp Vault (and a MySQL database) to dynamically create time-limited credentials for a MySQL database.

NOSEY PARKER

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data.

AMAZON GUARDDUTY ADDS NEW ORGANIZATION MANAGEMENT CAPABILITIES

Amazon GuardDuty announced a new capability to allow Delegated Admins of an AWS Organization to enable GuardDuty features for all new and existing members of the organization.

PROMPT INJECTION PRIMER FOR ENGINEERS

A detailed overview of Prompt Injection that seeks to explain what it is, what the potential impact of prompt injection is, and how it can be prevented. A PDF version of the primer is available in the repo.

STATE OF CYBER INSURANCE 2023

The survey results find that most organizations are not approaching cyber insurance with the same diligence – they are simply looking to get covered. What they’re not checking is whether the policy they had last year is what they need now, or if their policy changed at renewal. This ‘cyber insurance gap’ could put a lot of organizations in a tough place when a cybersecurity incident occurs, and they want to utilize this financial safety net.

THE 2023 STATE OF RISK REDUCTION: A NEED FOR SPEED

Report providing fresh insight into how security pros handle the challenging vulnerability remediation life cycle from discovery to resolution. Some interesting tidbits include the time it takes to remediate critical security risks from start to finish (4 weeks) and the fact that 49% of security professionals do not know who to contact to fix or verify fixes.

AN AI THREAT MODELING FRAMEWORK FOR POLICYMAKERS

A thought piece from Daniel Miessler in which he proposes a framework for thinking about AI risks through the lens of threat modeling. His proposed model focuses on Actors, Technique, Harm, and Impact (ATHI). A GitHub repo is linked with community-sourced examples of ATHIs.

LINKEDIN AND X WILL WORK WITHOUT PASSWORDS IN THE FUTURE

LinkedIn and X look like the next major platforms to ditch passwords in favor of passkeys.

UKRAINE

Ukraine's cybersecurity success under Viktor Zhora was lauded at the Black Hat conference, but experts suggest that Western nations struggle to replicate their collaborative methods due to regulatory and legal hurdles.

GOOGLE DEBUTS DUET AI TO TACKLE CLOUD CYBERSECURITY CHALLENGES

Google debuted new AI-based solutions focused on enhancing the cybersecurity capabilities of the company's cloud and security solutions at Google Next, the tech giant's annual conference.

MALWARE

ReversingLabs found over a dozen malicious npm packages mimicking the roblox.js gaming API wrapper. The packages drop Luna, an info stealer malware, into the code. This attack is a continuation of a campaign seen in 2021. It targets Roblox community developers and highlights npm supply chain risks.

MOVEIT, THE BIGGEST HACK OF THE YEAR, BY THE NUMBERS

The mass exploitation of MOVEit's Transfer software has rapidly cemented itself as the largest hack of the year so far. While the full impact of the attack will likely remain unknown for months to come, there are now more than 1,000 known victims of the MOVEit breach, according to cybersecurity company Emsisoft. This report looks into the MOVEit attack by the numbers.

DUOLINGO DATA LEAK POSTED ON HACKING FORUM

Duolingo suffered a data breach when a public API endpoint leaked non-public profile information such as email addresses. The dataset was released on BreachForums for the equivalent of $2.13.

NVME: NEW VULNERABILITIES MADE EASY

This blog post showcases how researchers at CyberArk used Static Code Analysis tools to find a Pre-Auth Remote DoS vulnerability (CVE-2023-0122) caused by a NULL Pointer Dereference in the NVMe driver of the Linux kernel.

BYPASS TWO-FACTOR AUTHENTICATION OF FACEBOOK ACCOUNTS ($25,300)

This write-up explains how Facebook's Two-Factor Authentication was bypassed during Meta’s bug bounty Researchers conference in Seoul, South Korea, in 2023. The author was awarded $25,300 and ranked 2nd place on the conference Leaderboard.

METHODS TO BACKDOOR AN AWS ACCOUNT

An exploration of the different AWS mechanisms that an attacker that has gained privileged access to an AWS account can use to establish persistence. This is part three of a series - the previous two parts focus on escalating privileges on a compromised AWS account.

APPLICATION

Cerby has received capital to secure non-standard applications. Research has found that 52% of organizations have experienced cybersecurity incidents caused by their inability to secure these kinds of applications. Applications are defined as nonstandard if they do not support common identity and security standards such as SAML and SCIM.

IPFUSCATOR

A blazing-fast, thread-safe, straightforward, and zero memory allocation tool for swiftly generating alternative IP(v4) address representations in Go.

VILLAIN

Villain is a high-level C2 framework that can handle multiple TCP sockets and HoaxShell-based reverse shells. It features payload generation and file uploads. Villain was added to the Kali Linux repository in the most recent update.

LANDSCAPES

This document is a comprehensive overview of modern cybersecurity. It discusses the various threats that exist in the digital realm, such as ransomware, phishing, and various forms of social engineering. It also explores the role of nation-states in cyber warfare and the importance of fortifying one's digital stronghold. The document emphasizes the ongoing nature of cybersecurity and the need for vigilance and continuous learning.

BROWSER EXTENSION RISK REPORT: HIGH RISKS FOR SAAS DATA

Researchers at Spin.AI assessed 300,000 Chromium browser extensions and found that 51% of all installed extensions were high risk and had the potential to cause extensive damage to the organizations using them. The extensions all had the ability to capture sensitive data from enterprise apps, run malicious JavaScript, and surreptitiously send protected data, including banking details and login credentials, to external parties.

LAPSUS$: COURT FINDS TEENAGERS CARRIED OUT HACKING SPREE

An 18-year-old from Oxford has been found guilty of being a part of an international cyber-crime gang responsible for a hacking spree against major tech firms such as Uber, Nvidia, and Rockstar Games.

EXPANDING TESTING FOR END-TO-END ENCRYPTION ON FACEBOOK MESSENGER

Meta has once again reaffirmed its plans to roll out support for end-to-end encryption by default for one-to-one chats on Messenger by the end of the year.

MICROSOFT SIGNING KEYS KEEP GETTING HIJACKED

Microsoft’s digital keys have been hijacked to sign yet more malware for use by a previously unknown threat actor in a supply-chain attack that infected roughly 100 carefully selected victims.

CRYPTO STARTUP BANKRUPT AFTER LOSING PASSWORD TO WALLET

Prime Trust is a crypto startup designed to help other startups provide crypto retirement funds. It had to file for bankruptcy after losing the password to a physical crypto wallet with $38.9 million in it.

RISKS IN AWS SSM PORT FORWARDING

AWS Systems Manager Session Manager (SSM) allows for IAM users to access EC2 instances. One common use case for this is port forwarding to other services such as RDS. The SSM-SessionManagerRunShell document may be implicitly granted to the user. This article details how to fix this.

RANSOMWARE INFECTS ALL OF CLOUDNORDIC’S DATA

CloudNordic, a large Danish cloud provider, has suffered a ransomware attack that encrypted all customer data. The company cannot and will not meet the ransom demands and advises customers to consider their data lost. CloudNordic doesn’t believe that any data was accessed by the attackers.

AWS-TARGETING CRED STEALER EXPANDS TO AZURE, GCP

Cloud credentials stealing campaigns continue to grow. Cloud service credentials are increasingly targeted because teams are finding more ways to profit from them. One actor has expanded its tooling from AWS to target Azure and Google Cloud Platform. This report dives into how the tooling interacts with the cloud providers and what is new with the latest version.

WI-FI EVERY MINUTE

Secureworks researchers witnessed the Smoke Loader botnet dropping a custom Wi-Fi scanning executable to infected systems. The researchers named the malware ‘Whiffy Recon’. It triangulates infected systems' positions using nearby Wi-Fi access points and Google's geolocation API.

FROSTY TRAILS: THREAT-HUNTING FOR IDENTITY THREATS IN SNOWFLAKE

Snowflake's popularity makes it an attractive target, requiring vigilance against emerging threats. This post explores using built-in logging to enhance security operations. It covers ten threat scenarios, relevant exposed data, and a script for quick threat hunting.

BitLocker's protection depends on its configuration, so with a discrete Trusted Platform Module and no password, the BitLocker decryption gets bound to the hardware. This article navigates through how to use physical hacking to obtain the decryption key and hack into a BitLocker-protected computer.

STRATEGIES FOR FINDING SSRF VULNERABILITIES IN BUG BOUNTIES

This X thread shares strategies for finding Server Side Request Forgery (SSRF) attacks for bug bounties. These include trying different URL schemes, stealing NT LAN Manager hashes with Responder, trying alternative representations of IP addresses, and searching for references to Kubernetes and hitting its API. The author of the thread suggests being aware of a target's technologies and using open redirects to find SSRF vulnerabilities.

GOOGLE WORKSPACE ANNOUNCES NEW ANTI-PHISHING CONTROLS

Google Workspace has announced 11 new defensive controls to protect against social engineering attacks. Multi-party approval will require sensitive enterprise actions to be approved by a separate admin than the one that initiated the change. Other features include DLP, AI, and logging support.

MONKEY

The Infection Monkey is an open source security tool for testing a data center's resiliency to perimeter breaches and internal server infection. It uses various methods to self propagate across a data center and reports success to a centralized Monkey Island server.

IAMBIC

IAMbic is designed to be a version control system for IAM systems. IAMbic monitors IAM sources for any changes and makes a commit to a git repository containing the details of the change. At present, AWS, Azure AD, Google Workspace, and Okta are supported.

BOTS ARE BETTER AND FASTER AT SOLVING CAPTCHAS THAN HUMANS

Bots can solve captchas nearly instantly and with high accuracy. In a recent study, humans solved captchas with a 50-84% accuracy, taking between 9-15 seconds, while bots had an accuracy rate of 85-100% and solved captchas in less than a second.

TORNADO CASH CRYPTO MIXER DEVS CHARGED WITH MONEY LAUNDERING

US prosecutors have charged two of the developers of the crypto mixer, Tornado Cash, with money laundering. The prosecutors allege that Roman Semenov and Roman Storm facilitated the anonymization of hacked funds on the platform while knowing that the funds were stolen.

FBI: PATCHES FOR RECENT BARRACUDA ESG ZERO-DAY INEFFECTIVE

The FBI has warned that the patches Barracuda recently released for an Email Security Gateway (ESG) vulnerability were not effective and that the flaw is still being targeted in the wild. It is advising organizations to remove all affected ESG appliances immediately and scan their networks for abnormal activity.

DEFAULT BEHAVIOR STICKS

This blog post describes an instance where 40% of their users directly copied an example domain from their documentation when setting up custom DNS zones as well as other places where examples were given in documentation. This can lead to more easily identifiable canaries. The post concludes with lessons learned about the dangers of defaults and examples.

HACKERS

The FBI published 6 cryptocurrency wallets linked to North Korean hackers, holding ~$40M+ in likely stolen funds. The cryptocurrency was stolen by the Democratic People’s Republic of Korea's TraderTraitor-affiliated actors (also known as the Lazarus Group and APT38).

MALWARE FOOTPRINT

Microsoft has discovered a Chinese government-backed APT actor called Flax Typhoon that targets Taiwanese organizations with minimal malware use and stealthily persists by exploiting legitimate software tools. Flax Typhoon uses known vulnerabilities in public-facing servers and legitimate tools built into the Windows operating system to quietly remain in these networks, making it challenging to detect and mitigate the attack.

TESLA INSIDERS LEAK DATA OF 75,000 EMPLOYEES

Tesla filed a data breach notification that two former employees leaked more than 75,000 individuals’ personal information to a foreign media outlet. The leaked data includes social security numbers among other personally identifiable information. Tesla has sued the former employees and the German media outlet that received the data claims that they will not (and cannot) use it.

IVANTI SENTRY EXPLOITED IN THE WILD, PATCHES EMITTED

Ivanti has disclosed the exploitation of a critical MobileIron/Ivanti Sentry gateway authentication bypass bug, CVE-2023-38035. The vulnerability allows the takeover of sensitive network components. It requires access to admin port 8443 and impacts unpatched Sentry v9.18 and earlier.