Search the archive

full study [4] after the webinar. Register for free here

NTT COMMUNICATIONS SUFFERS DATA BREACH IMPACTING 18,000 COMPANIES

NTT Communications has disclosed a data breach affecting nearly 18,000 companies after detecting unauthorized access to its Order Information Distribution System on February 5. The breach exposed customer contract details, corporate contact information, and service usage data.

ETHEREUM PRIVATE KEY STEALER ON PYPI DOWNLOADED OVER 1K TIMES

The PyPI package "set-utils" targets Ethereum developers using the eth-account library. The package hooks the from_key and from_mnewmonic() functions in the ethereum package to intercept private keys, encrypt them, and upload them to the Polygon blockchain. Polygon transactions have very low processing fees, no rate limits, and free public RPC endpoints, enabling attackers to retrieve the keys at any point without requiring their own infrastructure.

UNDOCUMENTED COMMANDS FOUND IN BLUETOOTH CHIP USED BY A BILLION DEVICES

Researchers from Tarlogic Security discovered 29 undocumented commands in the firmware of the ESP32 Bluetooth device. The commands could allow for memory manipulation, MAC address spoofing, and LMP/LLCP packet injection. While the commands could open the door for supply chain attacks, a more realistic threat would be a physical attacker establishing persistence and performing further attacks through the ESP32's memory.

REVERSING SAMSUNG'S H-ARX HYPERVISOR FRAMEWORK

Mobile devices lead security with defense-in-depth strategies, moving sensitive data from untrusted kernels to higher trust levels like hypervisors and secure enclaves. Samsung's Real-time Kernel Protection (RKP), part of Knox on Exynos devices, uses H-Arx Hypervisor to protect the kernel. The post discusses how to reverse the hypervisor framework, which includes a common core (harx.bin) and loadable plug-ins in a proprietary uH format.

ABUSING VBS ENCLAVES TO CREATE EVASIVE MALWARE

VBS enclaves allow a Windows user to run code in an isolated memory region that even the “standard” kernel cannot access. This presents an appealing attack surface for malware, as VBS malware would be invisible to EDR running in the standard kernel, but the VBS enclave code must be signed by Microsoft. This post explores bypassing the Microsoft checks by abusing debuggable enclave modules or exploiting vulnerable enclaves.

NOT LOST IN TRANSLATION: ROSETTA 2 ARTIFACTS IN MACOS INTRUSIONS

Rosetta 2 technology creates AOT files on Apple Silicon Macs, essential for analyzing macOS intrusions, even if malware is erased. Mandiant found that sophisticated actors target cryptocurrency firms with x86-64 malware due to its wider compatibility and lenient execution policies compared to ARM64. These AOT files, stored in protected cache directories, can uncover critical intrusion evidence through timestamps, execution patterns, and binary features, even after deleting malicious files.

GuidePoint, Wipro, and Kroll, this report by Obsidian Security

covers:

JS-X-RAY

JavaScript & Node.js open-source SAST scanner - a static analyzer for detecting the most common malicious patterns.

IMPLANT.JS

implant.js is a proof-of-concept modular implant platform that leverages the V8 JavaScript engine.

ATT&CK EVALUATIONS LIBRARY

The ATT&CK Emulation Library hosts adversary emulation plans from published ATT&CK Evaluations. These plans emulate specific adversaries, like Turla, covering initial access to exfiltration. Organized by evaluation and threat actors, they simulate real breaches.

HACKED HEALTH FIRM HCRG DEMANDED JOURNALIST ‘TAKE DOWN' DATA BREACH REPORTING, CITING UK COURT ORDER

U.S. cybersecurity journalist "Dissent Doe" refused a U.K. court order to remove articles on the ransomware attack against healthcare provider HCRG. Citing First Amendment protections and U.S. jurisdiction, Doe noted that HCRG is taking legal action to stop the republication of stolen data.

DEVELOPER SABOTAGED EX-EMPLOYER WITH KILL SWITCH ACTIVATED WHEN HE WAS LET GO

A federal jury convicted Davis Lu, 55, of sabotaging his employer Eaton Corporation's systems after being let go. He created malware that crashed servers and a kill switch that locked thousands of employees out when he was fired in September 2019. Lu now faces up to ten years imprisonment.

1PASSWORD IS MAKING IT EASIER TO FIND PASSWORDS BASED ON YOUR LOCATION

1Password now lets users save a location with a password and view passwords in a "Nearby" tab. This feature could be useful for linking travel documents to airports or healthcare documents to doctors' offices. 1Password ensures that location data is not stored, shared, or tracked, with all nearby checks conducted on the device.

NEW CHIRP TOOL USES AUDIO TONES TO TRANSFER DATA BETWEEN DEVICES

Chirp translates characters into sound frequencies for transmission between Computers and Smartphones.

AKIRA RANSOMWARE GANG USED AN UNSECURED WEBCAM TO BYPASS EDR

The Akira ransomware gang used an unsecured webcam to evade Endpoint Detection and Response (EDR) systems and carry out encryption attacks on a victim's network.

CHROMECAST (2ND GEN) AND AUDIO CANNOT CAST IN 'UNTRUSTED' OUTAGE

Chromecast (2nd gen) and Chromecast Audio users have been unable to Cast audio or video content due to an "Untrusted device" error message.

Download your copy here →

CYBERCRIMINALS ARRESTED FOR STEALING HUNDREDS OF CONCERT TICKETS THROUGH STUBHUB EXPLOIT

Two cybercriminals, Tyrone Rose and Shamara Simmons, were arrested for stealing hundreds of digital event tickets, including for Taylor Swift's Eras Tour. They intercepted legitimate StubHub URLs after purchases and resold about 900 tickets for over $600,000. The pair face grand larceny charges and potentially 3-15 years in prison.

CHATGPT OPERATOR PROMPT INJECTION EXPLOIT LEAKING PRIVATE DATA

ChatGPT Operator is an advanced AI agent equipped with web browsing and reasoning capabilities that can interact with websites on behalf of users. It is vulnerable to Prompt Injection attacks via instructions embedded into text or web content that can cause the model to browse sensitive pages and leak the information to attacker-controlled websites. OpenAI has implemented defenses such as prompting the user for confirmation, but researchers have shown that these mitigations can be bypassed.

MALICIOUS CHROME EXTENSIONS CAN SPOOF PASSWORD MANAGERS IN NEW ATTACK

Researchers at SquareX Labs developed a new “polymorphic” attack allowing malicious Chrome extensions to steal sensitive data. Once a user is tricked into installing the extension, it scans for password managers, impersonates them, and prompts users to reauthenticate, sending the information to attackers. SquareX Labs has urged Google to restrict extensions' ability to alter their appearance or behavior, but no mitigations currently exist for this attack.

ZEN AND THE ART OF MICROCODE HACKING

This post details the concepts and tools behind EntrySign, the AMD Zen microcode signature validation vulnerability disclosed last month. It delves into microcode fundamentals, AMD's anti-tampering measures, and the specific vulnerability involving the CMAC hash function. It also announces the release of the Zentool suite, which consists of tools for microcode patch examination, including limited disassembly, microcode patch authoring using a limited amount of reverse-engineered assembly, microcode patch signing, and microcode patch loading.

FOUR WAYS TO GRANT CROSS-ACCOUNT ACCESS IN AWS

Grant access to a specific IAM role using the Principal element of the resource-based policy, an AWS account using the Principal element, a particular IAM role in an account using the AWS:PrincipalArn condition, and an entire AWS organization using the AWS:PrincipalOrgId condition. This post includes an example scenario with an S3 bucket and discusses tradeoffs associated with each method.

AUTO-COLOR: AN EMERGING AND EVASIVE LINUX BACKDOOR

Palo Alto's Unit 42 is monitoring a new malware known as Auto-Color. Upon startup, if the malware is not named Auto-Color, it will try to install a malware implant that imitates libcext.so. It also copies itself to /var/log/cross/auto-color and adds this library to ld.preload. Besides its command and control capabilities, the harmful library implant uses custom encryption and strives to conceal network communications by hooking into libc's open function.

what questions you should be asking of your next SIEM.

ARYON SECURITY (PRODUCT LAUNCH)

Aryon scans the cloud application and infrastructure for security issues or policy violations before deployment. If any issues are detected, the platform alerts the developers with suggestions for resolving the problem.

COPA

copa is a CLI tool written in Go and based on buildkit that can be used to directly patch container images given the vulnerability scanning results from popular tools like Trivy.

CAPTAINCREDZ

CaptainCredz is a modular password-spraying tool with a cache mechanism and fine-grained timing control.

BADBOX ANDROID BOTNET DISRUPTED THROUGH COORDINATED THREAT HUNTING

Badbox Android botnet was disrupted by a coordinated effort by Google, Human Security, and others to stop the compromised devices from talking to C2 servers. It was distributing malware through compromised Android-based TV boxes.

UK QUIETLY SCRUBS ENCRYPTION ADVICE FROM GOVERNMENT WEBSITES

The UK government took down encryption advice from its websites shortly after requesting backdoor access to Apple's iCloud. The National Cyber Security Centre has stopped recommending encryption for individuals at high risk of being attacked.

MEMORY SAFETY WILL BE KEY TO TACKLE FUNDAMENTAL CYBER SECURITY

UK Government's Digital Security by Design (DSbD) is championing technologies like CHERI to improve memory safety to add hardware-level memory safety that could work with existing C/C++ codebases. CHERI provides extensions to hardware ISAs to enable fine-grained memory safety.

US CHARGES CHINESE HACKERS LINKED TO CRITICAL INFRASTRUCTURE BREACHES

The US Justice Department has charged APT27 hackers with conducting global cyberattacks on government agencies since 2011.

HACKERS DEPLOY AI DEEPFAKE OF YOUTUBE CEO IN CREDENTIAL THEFT SCAM

Scammers used AI deepfake technology to impersonate YouTube's CEO in a phishing scam targeting content creators.

US SEIZES DOMAIN OF GARANTEX CRYPTO EXCHANGE USED BY RANSOMWARE GANGS

The U.S. Secret Service seized the domain of sanctioned Russian crypto exchange Garantex with the DOJ's Criminal Division, FBI, and Europol.

CISCO WARNS OF WEBEX FOR BROADWORKS FLAW EXPOSING CREDENTIALS

A vulnerability in Webex for BroadWorks could allow for the disclosure of sensitive credentials if insecure transport is configured for the SIP communication. The vulnerability is caused by sensitive information exposed in the SIP headers that can be viewed in plain text in the client and server logs. Cisco has no evidence of exploitation but has pushed a configuration change to fix this vulnerability and is urging customers to restart their Webex clients.

NEW ELEVEN11BOT BOTNET INFECTS 86K DEVICES FOR DDOS ATTACKS

Eleven11bot has infected over 86,000 devices. The botnet consists mostly of webcams and Network Video Recorders that use common, weak, or default admin credentials. GreyNoise has published a list of IPs that are associated with botnets.

RANSOMWARE THUGS THREATEN TATA TECHNOLOGIES WITH LEAK IF DEMANDS NOT MET

Tata Technologies reportedly suffered a ransomware attack by Hunters International. The gang claims to have stolen 730,160 files (1.4 TB) and has threatened to release them next Monday if no ransom is paid.

THOUSANDS OF WEBSITES HIT BY FOUR BACKDOORS IN 3RD PARTY JAVASCRIPT ATTACK

Attackers exploited a third-party JavaScript file to inject four backdoors into 1,000 WordPress websites. The attack involved uploading malicious plugins, injecting SSH keys, and executing remote commands.

DYNAMIC APPLICATION SECURITY TESTING (DAST)

DAST can scan dynamic web applications for vulnerabilities. Using tools like ZAPROXY, testers can simulate attacker perspectives, identifying weaknesses through manual and automated scans such as spidering and active scanning to improve web application security.

CELLEBRITE ZERO-DAY EXPLOIT USED TO TARGET PHONE OF SERBIAN STUDENT ACTIVIST

In this post, Amnesty International investigates the exploit, techniques, and delivery mechanisms used by Cellebrite to target the Android phones of Serbian student activists. The exploit targeted core Linux kernel USB drivers, potentially affecting over a billion Android devices. Evidence shows an attempt to install a mysterious Android app after the phone was unlocked using Cellebrite.

RAD SECURITY (PRODUCT LAUNCH)

Rad Security is an AI-driven defense platform that enhances operational efficiency for security teams and facilitates safe AI use in organizations.

PENTAGI

PentAGI is an advanced tool designed for automated security testing that utilizes state-of-the-art artificial intelligence technologies.

TITLEIST

Titleist monitors newly registered domains for possible misspellings or bitflips. It utilizes the CertStream Python library and can be tailored to identify specific types of suspicious domains.

NEARLY 10% OF EMPLOYEE GEN AI PROMPTS INCLUDE SENSITIVE DATA

Harmonic, an AI data security company, revealed that 8.5% of employee prompts to popular LLMs included sensitive data. Harmonic's report showed that 46% of submitted sensitive data included billing and authentication data, 27% included employee PII and payroll data, and 15% included legal and financial data. Employees who enter sensitive data to free tiers of LLMs may be inadvertently leaking data, as the report demonstrated that 54% of sensitive prompts were entered on ChatGPT's free tier.

LOCKED OUT, DROPBOXED IN: WHEN BEC THREATS INNOVATE

Invictus IR identified a threat actor who established persistence by leveraging a third-party mail client to phish contacts. The attack was initiated with a seemingly legitimate Dropbox invoice that directed the victim to a phishing page, where their credentials were harvested. The attacker used these credentials to log into the eM Client mail client, register accounts with Dropbox and WeTransfer, and spam contacts with fake invoices to compromise additional victims.

AMAZON VERIFIED PERMISSIONS NOW SUPPORTS THE CEDAR JSON ENTITY FORMAT

Amazon Verified Permissions (AVP) is a service that manages permissions and provides fine-grained authorization for customer-built applications. AWS has now added support to AVP for the same JSON format that the Cedar SDK supports.