Search the archive

associated with AI use. Get the guide

ARAA-SEARCH

A privacy-respecting, ad-free, self-hosted Google metasearch engine with strong security that offers full API support and utilizes Qwant for images and DuckDuckGo for auto-complete.

PYPI: PROJECT QUARANTINE

PyPI introduced a quarantine feature to mark harmful projects and prevent their easy installation. The feature helps PyPI admins manage potential malware and protect end users. Future improvements may include automating the quarantine process based on credible reports.

INTRODUCING CAPICHE DETECTION FRAMEWORK: AN OPEN-SOURCE TOOL TO SIMPLIFY CLOUD API-BASED HUNTING

The Capiche Detection Framework is an open-source tool to simplify detecting cloud API attacks. It helps defenders quickly create detection rules from different sets of APIs. The tool works by translating APIs into their SDK counterparts and generating various detection rule formats.

GOOGLE LOSES IN COURT, FACES TRIAL FOR COLLECTING DATA ON USERS WHO OPTED OUT

A federal judge denied Google's motion to dismiss a class-action lawsuit over privacy invasion. The case alleges Google collected user data through Firebase Analytics even when people opted out of Web & App Activity tracking. Google claims the data is pseudonymous and for developers only. A trial has been set for August.

FACEBOOK AWARDS RESEARCHER $100,000 FOR FINDING BUG THAT GRANTED INTERNAL ACCESS

Security researcher Ben Sadeghipour discovered a server vulnerability in Facebook's ad platform that allowed remote code execution. Meta fixed the issue within an hour of his report and awarded him a $100,000 bug bounty. The flaw stemmed from an unpatched Chrome browser vulnerability.

PROTON WORLDWIDE OUTAGE CAUSED BY KUBERNETES MIGRATION, SOFTWARE CHANGE

Proton, a Swiss tech company, experienced a global outage due to a migration to Kubernetes and a software change that caused an initial load spike. Users had trouble accessing services like ProtonMail and Proton Calendar, but the issues were resolved within about two hours. Proton has fixed the connection problems and is monitoring for any further issues.

SECOND AUDIT OF OBSIDIAN APPS COMPLETED BY CURE53

According to Cure53's second audit of Obsidian, no new vulnerabilities were found in public versions, with improvements made since the previous audit.

OPERATORS OF CRYPTOCURRENCY MIXERS CHARGED WITH MONEY LAUNDERING

Three Russian nationals have been charged by the US Justice Department with operating cryptocurrency mixers for money laundering.

FAKE POC EXPLOIT TARGETS CYBERSECURITY RESEARCHERS WITH MALWARE

A fake PoC exploit named "LDAPNightmare" targets cybersecurity researchers by pretending to be a patch for a Windows LDAP vulnerability.

Download now

IVANTI WARNS OF NEW ZERO-DAY ATTACKS HITTING CONNECT SECURE PRODUCT

Ivanti has announced two high severity vulnerabilities in Ivanti Secure Connect appliances. The first vulnerability is a stack-based buffer overflow that allows unauthenticated, remote attackers to execute arbitrary code. The second vulnerability is a privilege escalation vulnerability for local, authenticated attackers. Ivanti says that the first vulnerability is being actively exploited and urges customers to update vulnerable devices.

DATABASE TABLES OF STUDENT, TEACHER INFO STOLEN FROM POWERSCHOOL IN CYBERATTACK

PowerSchool, which serves 60 million K-12 students and teachers, suffered a data breach where hackers accessed personal information, including some Social Security Numbers and medical data, using stolen credentials. The company claims the data won't be shared publicly, though security firm Cyble suggests the breach may span years.

EXCELSIOR ORTHOPAEDICS FILES NOTICE OF DATA BREACH AFFECTING AN ESTIMATED 357,000

Excelsior Orthopaedics reported a data breach discovered in June 2024, exposing sensitive patient and employee data including Social Security numbers, medical records, and financial information. The company notified affected individuals on December 31, 2024, after investigating the unauthorized network access with cybersecurity experts.

HIDING LINUX PROCESSES WITH BIND MOUNTS

This post refines a methodology for hiding Linux processes by using a bind mount to mount a different directory on top of /proc/PID for the malicious process. The author was looking to refine the original methodology by creating a more realistic directory to overlay but realized that they could instead overlay the proc directory of a spontaneous process which is usually ignored by sysadmins. They note that this method would still be easy to detect if you are aware of the technique and provide a command to do so.

IMPLEMENTING SECURITY INVARIANTS IN AN AWS MANAGEMENT ACCOUNT

A Permission Boundary defines the maximum permissions that can be applied to a given principal. In an AWS management account, permissions boundaries are necessary because SCPs cannot be applied. This post introduces a set of security invariants that should be true in an AWS management account and provides an IAM policy to enforce them. It also links to a Lambda function that can be used to attach the policy to all newly created IAM principals.

HERE'S HOW HUCKSTERS ARE MANIPULATING GOOGLE TO PROMOTE SHADY CHROME EXTENSIONS

Google Chrome's Web Store policy prohibits developers from manipulating extension search results, yet hundreds violate this rule. Developers exploit language translation features to hide thousands of misleading keywords in alternative language descriptions, affecting search results and promoting unrelated or potentially abusive extensions.

about the implications on the Check Point blog

SLACK JACK

Slack Jack is a tool that allows penetration testers to hijack a Slack bot using its token to perform various exploitation and enumeration functions.

SYZKALLER

Syzkaller is a kernel fuzzer that finds bugs in various operating systems like Linux and Windows. Originally for Linux, it now supports other OS kernels. It is a coverage-guided tool developed by Google but is not an official product.

WAFW00F

WAFW00F is a tool that helps identify and fingerprint Web Application Firewall products protecting websites. It works by sending HTTP requests and analyzing responses to determine the type of WAF in place. Users can easily install WAFW00F from PyPI, run it in a Docker container, or build it from the source code available on GitHub.

100 DAYS OF YARA

100 Days of YARA is a community challenge to write a YARA rule every day for 100 days. This repository hosts individuals' YARA rules for the challenge as well as any tools or tips that users post.

SCHEMING REASONING EVALUATIONS

Apollo Research tested 6 popular LLMs to determine how they would react when given a prompt that gave them a goal, instructed them to achieve their goal at all costs, and then gave them a task to review files that contain proof that the developers have a different goal. 5 out of the 6 models tested would attempt to circumvent hurdles or safeguards to their goals and in some cases, models would lie about the actions on consultations. The researchers found that some models could deliberately underperform or otherwise scheme to attempt to achieve their goals.

EU COURT FINES EUROPEAN COMMISSION FOR BREACHING ITS OWN DATA PRIVACY LAWS

The EU General Court fined the European Commission €400 for violating GDPR by transferring a German citizen's personal data to U.S. companies through a conference registration system using Facebook login, marking the Commission's first such penalty.

2024 CYBER SECURITY VENDOR FUNDING REPORT

Report on cyber security vendor funding, with funding raised by cybersecurity firms increasing to $9.5 billion in 2024 a decrease in funding volume.

SPACE BEARS RANSOMWARE: WHAT YOU NEED TO KNOW

Space Bears is a new Moscow-based ransomware group that emerged in April 2024, notable for its unique corporate-style presentation and professional marketing approach, which includes using business-like stock images and offering "guarantees" to victims while operating as part of the Phobos ransomware-as-a-service organization.

OWASP TOP 10 NON-HUMAN IDENTITY RISKS FOR 2025: WHAT YOU NEED TO KNOW

The OWASP Top 10 Non-Human Identity Risks for 2025 focuses on the growing challenges of managing Non-Human Identities (NHIs) in enterprise cybersecurity.

CASIO SAYS HACKERS STOLE PERSONAL DATA OF 8,500 PEOPLE DURING OCTOBER RANSOMWARE ATTACK

Casio confirmed that an October ransomware attack by the Underground gang compromised the personal data of 8,500 people, including 6,500 employees and 1,900 business partners. The attack stole 200GB of data, though customer credit card information remained secure.

TURBULENCE AT UN AVIATION AGENCY AS PROBE INTO POTENTIAL DATA THEFT BEGINS

The UN's International Civil Aviation Organization (ICAO) is investigating a potential data breach after cybercriminal "Natohub" claimed to have stolen 42,000 documents containing personal information. ICAO previously faced a 2016 cyberattack that they allegedly attempted to cover up.

MISCONFIGURED LICENSE PLATE READERS ARE LEAKING DATA IN REAL TIME

Security Researcher Matt Brown purchased and reverse engineered the firmware of a Motorola automated license plate reader (ALPR) system. Brown used a unique error page to find 150 Internet exposed Motorola ALPR systems that did not implement any form of authentication. Wired journalists confirmed that these cameras are deployed by law enforcement and are leaking license plate number, car location, make and model, and other metadata from thousands of cars in just 20 minutes of sample time.

USING THE MACH-O MODULE IN YARA-X

This post introduces some of the improvements that the new Yara-X Mach-O module makes over the original. The new Mach-O module parses many of the core structures that are used in Mach-O binaries including the symbol table, imports, exports, entitlements, remote paths, and dylibs. The module also allows for calculating binary similarities by hashing the above structures.

ATTACKING ENTRA METAVERSE: PART 1

Part 1 of a series of blog posts exploring the Entra metaverse and demonstrating attacks against it. It introduces the concept of the Entra metaverse and demonstrates how the compromise of an Entra user can be used to fully compromise an on-premise AD user. The following posts explore cross-domain attacks and argue that the Entra Tenant is your trust boundary when using Entra.

CROSS CACHE ATTACK CHEATSHEET

This article describes a technique called "cross-cache attack" in Linux kernel exploitation that allows transferring a Use-After-Free (UAF) vulnerability from one object to another, even if they're allocated from different slabs. The attack involves a five-step process: spraying object-A sharing a slab with object-V, allocating a victim object-V, freeing object-V, freeing specific objects to trigger slab recycling through the buddy system, and finally spraying object-B to overlap with the freed object-V's memory. The article provides detailed code examples and experimental results, including a timing-based technique called SLUBStick that helps determine the state of slab allocation in the kernel.

CYBERBRO

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

ELEMENT SECURITY (PRODUCT LAUNCH)

Element is designed to proactively identify and mitigate risks by continuously discovering and mapping assets, and feeding identified assets into a proprietary exploit engine to assess exploitability.

CONVOC2

ConvoC2 provides C2 infrastructure that allows for executing system commands via Microsoft Teams.

11 THOUGHTS ON “A DAY IN THE LIFE OF A PROLIFIC VOICE PHISHING CREW”

Brian Krebs has notes on a sophisticated voice phishing operation called "Crypto Chameleon" that is exploiting Apple and Google's legitimate services to scam cryptocurrency owners, using a coordinated team approach and phishing panels to steal millions from victims including billionaire Mark Cuban, while operating openly on messaging platforms like Discord and Telegram where the criminals frequently betray each other.

800+ “POTENTIAL VULNERABILITIES AND BIASES” MAY AFFLICT AI-INFUSED MEDICAL SERVICES

The Chief Digital and Artificial Intelligence Office (CDAO) led an effort in coordination with the Crowdsourced AI Red-Teaming Assurance Program and healthcare agencies to evaluate the usage of LLMs in military medical services. The over 200 participants evaluated three popular LLMs for a clinical note summarization and advisory Chatbot. The effort was concluded with over 800 potential vulnerabilities and biases identified with suggested improvements to reduce the number in future efforts.

BACKDOORING YOUR BACKDOORS - ANOTHER $20 DOMAIN, MORE GOVERNMENTS

WatchTowr Labs researchers discovered over 4,000 active web backdoors that were hijacked by registering expired domains. The backdoors allowed unauthorized access to high-profile targets like government and university systems. The domains are now managed by The Shadowserver Foundation to prevent misuse by cybercriminals.

MAGIC/TRAGIC EMAIL LINKS: DON'T MAKE THEM THE ONLY OPTION

While magic links in emails are being promoted for easier logins, they can be problematic for users with multiple devices and slower connections.

APPLE'S NEW AI FEATURE REWORDS SCAM MESSAGES TO MAKE THEM LOOK MORE LEGIT

Apple's new AI feature is rephrasing scam messages to look more legitimate on iPhones and Macs, potentially leading to more people falling for scams.

HOW WE CRACKED A 512-BIT DKIM KEY FOR LESS THAN $8 IN THE CLOUD

Researchers successfully cracked a 512-bit RSA key in the cloud for less than $8, demonstrating the importance of using secure key lengths in email security measures.

EFFECTIVE PHISHING CAMPAIGN TARGETING EUROPEAN COMPANIES AND ORGANIZATIONS

Palo Alto Network's Unit42 discusses a phishing campaign targeting European companies and organizations, highlighting indicators to identify similar attacks. These indicators include a tone of urgency and failed authentication checks like SPF and DKIM. The threat actor employed evasion techniques, such as using trusted devices and VPN proxies, to disguise their malicious activities.

FIRESCAM ANDROID SPYWARE CAMPAIGN POSES 'SIGNIFICANT THREAT WORLDWIDE'

A new Android spyware, "FireScam," masquerades as Telegram Premium to steal sensitive data using Firebase for data exfiltration. The malware spreads through a fake RuStore website on Github.io, highlighting evolving threats that exploit legitimate platforms and user trust.

BIOS FLAWS EXPOSE ISEQ DNA SEQUENCERS TO BOOTKIT ATTACKS

Eclypsium found that the BIOS firmware of Illumina iSeq 100 devices ran an outdated version of the BIOS firmware which was not write protected and did not implement Secure Boot. Attackers could exploit these vulnerabilities to manipulate results or brick the systems. Illumina has issued a patch to affected customers.

OPEN PORT CHRONICLE: WHAT PORT 80 REVEALED ABOUT THE INTERNET

RedHunt Labs scanned billions of IP addresses for open port 80s and discovered 42 million accessible IPs. Its research revealed 25,000 unique HTTP headers, 2.1 million favicon hashes, 500,000 email addresses, 600,000 social media links, and 25,000 cloud storage buckets, highlighting internet security's current state.