TLSH is a locality-sensitive, fuzzy hashing mechanism that can be used to compare two files to determine how similar they are. In this post, Target's security team walks through how they utilize TLSH for hunting malware variants of known malware families using Strelka. This approach requires files to be over 50 bytes in length, regularly updating a list of known malicious TLSH values, carefully tuning similarity thresholds, and may not work on packed or obfuscated malware.
The article discusses how Chrome DevTools Recorder enables non-intrusive web reconnaissance by isolating its scripts from the application's environment. By capturing user interactions without interference, the Recorder provides valuable insights for building secure and reliable tools. Lessons from DevTools can guide the design of tools that support security researchers in uncovering vulnerabilities without disrupting normal application behavior.
A collection of tools that can be useful for a SOC Analyst, divided by category. Categories include: network traffic, analysis, and detection tools, system logs collection and analysis tools, disk imaging, live analysis, and offline analysis tools, memory capture and analysis tools, and threat intelligence tools.
CF-Hero is a tool that uncovers the real IP addresses of Cloudflare-protected websites through DNS reconnaissance and intelligence sources like Censys and Shodan. It distinguishes between domains protected by Cloudflare and those that are not to help validate findings and minimize false positives. The tool offers advanced features like custom JA3 fingerprint support, concurrent scanning, and proxy support for comprehensive analysis.
OGP-CTF is a series of 13 challenges ranging from easy to hard aimed towards training developers in bug hunting and secure coding. The CTF is built on Vercel + NextJS, CTFd, and Cloudflare Access.
AWS introduced the AssumeRoot API operation that allows for an IAM user in a management account of an organization to gain temporary credentials to the root user of a member account. The Elastic security team showcases how this privilege can be abused by an attacker to elevate compromised credentials in a management account to full compromise of a member account. The post includes Terraform code to setup the testing environment and detections to detect the attack.
Lukasz Olejnik raises concerns about how Google's policy change to allow device fingerprinting for advertising leads to privacy erosion. This shift contradicts previous commitments to user privacy, potentially setting a new standard for data collection in the online ecosystem. The use of fingerprinting raises questions about transparency, user control, and the future of internet privacy.
Vectra's Kat Trexler writes about "insecure by design" flaws in cloud and contrasts them against traditional bugs and feature abuse. Insecure-by-design flaws in cloud services often stem from fundamental design issues, requiring more than simple patches for remediation. Mitigating these vulnerabilities involves a holistic strategy that involves implementing preventative controls like guardrails and focusing on detection and response measures.
All the videos from the 38th Chaos Communication Congress (38C3) have been posted.
Lumen has reported that it has locked out the Salt Typhoon hacking group from its network after targeting U.S. telecom firms.
A 20-year-old U.S. Army soldier named Cameron Wagenius has been arrested for allegedly selling and leaking confidential phone records from AT&T and Verizon.
Juniper Networks is warning that session smart routers are being targeted by a Mirai botnet infection campaign. The default passwords for these devices have been added to the virus database. Juniper warns that any devices using the default passwords should be assumed to be compromised. It has provided threat hunting advice and is urging admins to reimage any infected devices.
BeyondTrust identified a security incident in which an attacker obtained a Remote Support SaaS API key which it used to access some Remote Support SaaS instances and reset passwords for local application users. As part of its investigation, BeyondTrust discovered two CVEs that could allow for RCE but did not mark either as being actively exploited. BeyondTrust has patched all cloud instances against these CVEs and is working with customers to ensure that self-hosted instances are patched.
A new post-authentication vulnerability in Four-Faith industrial routers, CVE-2024-12856, is being exploited in the wild. Using default credentials for remote command injection, the attack targets specific router models over HTTP, allowing attackers to execute commands on vulnerable devices. VulnCheck has notified Four-Faith and customers about the issue and recommends contacting Four-Faith for information on patches and affected models.
A glossary of exploitation techniques for exploiting AWS resources that can be misconfigured to be publicly accessible. Each attack features relevant CLI commands to carry it out as well as sometimes featuring a sample resource policy that could allow for it. The first section focuses on resources that can be found from a black box perspective and includes: exploiting S3 buckets for public list, read, and write, exploiting S3 buckets for authenticated list and write, exploiting S3 static site hosting or misconfigured CloudFront distributions for unauthenticated bucket list, exploiting EC2 to discover AMIs, exploiting EBS and RDS to discover public snapshots, exploiting misconfigured OIDC roles, and exploiting public SSM documents. The second section focuses on resources that can't be discovered from a black box perspective and includes: exploiting public SQS queues and SNS topics, exploiting private API gateways, exploiting Lambda functions, and exploiting public and private ECR repositories.
This README explains a simulation of an attack by the Wicked Panda group targeting government networks. The attack involves stages like DodgeBox DLL loader and MoonWalk backdoor for data exfiltration via Google Drive API. The attackers use techniques like DLL sideloading and hashing to evade detection and establish communication channels.
This blog post covers various methods, like expanding the prompt or encoding it in base64, that can be used to extract system prompts from AI models, potentially bypassing developer-imposed limits. Understanding these tricks can show the vulnerabilities in AI models and how they can be manipulated to disclose hidden prompts.
A tool from TCM Security to apply various fixes and install tools for Kali Linux VMs
SmuggleShield is a browser extension that helps prevent basic HTML smuggling attacks by detecting common patterns. It works on Chrome and Edge for Mac and Windows, providing an extra layer of security during browsing or team exercises. The extension uses machine learning and allows for incognito mode protection with manual activation.
2025.01.02·links.tldrnewsletter.com·13 min read·TLDR InfoSec AWS is preparing for post-quantum cryptography (PQC) by implementing NIST-approved algorithms to protect against future quantum computer threats to public key cryptography. Its migration plan consists of four workstreams: creating an inventory of current crypto usage (prioritizing data-in-transit), updating asymmetric key derivation between AWS endpoints and customers, addressing long-term digital signature keys, and handling short-term session signature keys. AWS recommends organizations prepare by making an inventory of their cryptography usage and upgrading to TLS 1.3.
VPNs have become ubiquitous as a way for protecting access to sensitive resources in organizations and preserving privacy for individuals. This has made VPNs a valuable target for attackers with VPN vulnerabilities on the rise since 2022. This article examines attacks in VPNs from Check Point, Fortinet, Palo Alto Networks, and Ivanti. For each vulnerability, the author demonstrates how to exploit the vulnerability and its impact.
The MISP-standard.org has introduced a new Threat Actor Naming Standard for cybersecurity information sharing. This standard aims to provide a structured approach for naming threat actors to improve collaboration and interoperability in the cybersecurity community. It offers global consistency, interoperability with existing platforms like MISP, and benefits such as enhanced collaboration and streamlined analysis.
Recorded Future's CEO has celebrated being the first cybersecurity firm to be banned by Russia.
A study found over 3.1 million fake stars across repositories and notes that users should be cautious and verify repository quality beyond star ratings.
GitGuradian provides a detailed timeline of events leading up to the US Department of Treasury Breach due to a compromised API key used for technical support by BeyondTrust, allowing remote access to workstations and documents.
WhatsApp has won a lawsuit against NSO Group, maker of Pegasus spyware, over hacking 1,400 devices of activists, journalists, and officials. The court rejected NSO's defense that clients used Pegasus for legitimate investigations and the case will proceed to determine damages.
Ascension, a large U.S. healthcare system, had the personal and health data of 5.6 million patients and employees stolen in a ransomware attack. The breach led to the company offering free identity theft protection services to those affected for 24 months. The ransomware attack impacted electronic health records and forced the healthcare giant to temporarily halt some services.
Bishop Fox identified over 400K SonicWall VPN Firewalls with either a management interface or SSL VPN interface that are internet exposed. Of these devices, over 20K are running end-of-life firmware versions. However, a larger total of over 25K firewalls that are exposed are vulnerable to a critical vulnerability, and nearly 100K are exposed to a high vulnerability.
Real-Time Operating Systems (RTOS) are specialized systems that handle time-critical tasks with strict deadlines. Unlike general operating systems, RTOS prioritizes predictable execution timing and is essential in applications from car brakes to video games where split-second precision is crucial. This blog post dives into everything RTOS and their uses for cybersecurity.
The author decided to examine the Wazuh EDR tool via fuzzing and found 2 vulnerabilities that could lead to total network compromise. Wazuh consists of an agent that runs on the device, a server that accepts events from the agent, and an analysis engine that parses the event to trigger actions. The author describes how they discovered a command injection vulnerability in the host_deny active response which they chained with a heap buffer overflow that allowed for RCE to achieve unauthenticated RCE as root to compromise a full network.
The Winnti hacking group has begun using a new Glutton backdoor to attack targets in the US and China. Glutton is a PHP malware that masquerades as a php-fpm process that facilitates fileless execution and injects malicious code into PHP files. It is an advanced backdoor that establishes persistence and supports 22 commands for C2. Notably, the Winnti group has been hiding Glutton in tools sold on cybercrime forums to attack other cybercrime groups and steal their information.
Krueger, a .NET post-exploitation tool, can remotely disable Endpoint Detection and Response (EDR) during lateral movement procedures. It utilizes Windows Defender Application Control (WDAC), a Microsoft application control utility capable of blocking code at both user and kernel-mode levels. With administrative privileges on a remote target, Krueger can deploy a WDAC policy and remotely reboot the device, preventing the EDR service from starting.
OPA 1.0 is a major release that enhances Policy as Code development, focusing on improving the developer experience and consistency of the language. Users are encouraged to upgrade to OPA 1.0 for new features, syntax improvements, and performance enhancements, with detailed instructions provided for a smooth transition. The release signifies a significant milestone for the project, offering a solid foundation for Policy as Code projects and inviting community feedback to shape future releases.
Flare watches for signs on the dark web that its customers' logins are being circulated and then automatically resets the impacted passwords before the thieves can gain access. It also watches for stolen session cookies that can trick computers into thinking the hacker is a previously authenticated user.
Much of the common wisdom around Cloud Security as well as CNAPP tooling does not consider the discoverability aspect of exploiting resources. This post enumerates some prior work on AWS reconnaissance techniques such as exploiting CDK naming, brute forcing SQS queues, abusing misconfigured ECR policies, and domain takeover via deleted S3 buckets. The author then introduces a new tool that they created called awseye that can enumerate discoverable resources given an AWS account ID.
AWS Secrets Manager offers transforms that will add a nested CloudFormation stack for HostedLambdaRotation that allows for pre-built Lambdas for secrets rotations for a subset of supported secrets. AWS has now enhanced this offering to support automatic upgrades of the Lambda functions as well as more CloudFormation resource attributes. The blog post contains upgrade instructions but also notes that the new transforms are not backwards compatible.
This detailed blog post from Google Project Zero explores the regf file format used by the Windows Registry since Windows NT 3.1, which uniquely represents registry data simultaneously on disk and in memory. The format consists of several key components including a base block (header), bins that store data in 4KB chunks, and cells that contain the actual registry data like keys, values, and security descriptors. The post also explains how Windows implements self-healing properties when loading potentially corrupted hives, attempting to fix or isolate damaged data while preserving overall hive integrity whenever possible.
2024.12.23·googleprojectzero.blogspot.com·89 min read·TLDR InfoSec Rostislav Panev, a developer of the LockBit ransomware group, has been arrested by the United States for his role in cyberattacks causing billions in damages.
CISA has released guidance for protecting mobile communications following Chinese state hackers targeting major US telecom carriers.
The top 10 software weaknesses are XSS, OOB write, SQL injection, CSRF, path traversal, OOB read, OS command injection, use after free, missing AuthZ, and unrestricted upload of files with dangerous types.
A 2.9GB portion of Cisco data was leaked on Breach Forums by IntelBroker on December 16. The data, allegedly part of a 4.5TB dataset exposed in October, includes ISE, SASE, Webex, and other system information. Cisco maintains that no core systems were compromised.
Texas Tech University experienced a data breach affecting 1.4 million people due to a ransomware attack targeting its Health Sciences Center. Personal information like names, addresses, Social Security numbers, and medical details were compromised. The university is providing affected individuals with free credit monitoring services and has reported the incident to the US Department of Health and Human Services.
Ledger is a hardware cryptocurrency wallet that allows users to store, manage, and sell cryptocurrencies that use a multi-word recovery phrase for securing the wallets. A new phishing campaign is targeting Ledger owners with an email stating that a recovery phrase breach occurred and urging them to verify if their recovery phrase is secure. The link takes users to a fake Ledger page that prompts them to enter their recovery phrases and then transmits the phrase back to the attackers.
OpenID Connect is a mechanism for applications to authenticate without requiring long-lived credentials like API keys. This post provides tutorials for connecting GitHub and AWS to authenticate from GitHub Actions via OpenID Connect as well as sample workflows to build and push Docker containers to ECR and plan/apply Terraform changes. The post concludes by describing how OpenID Connect can be used with Amplify.
This article from Palo Alto Networks' Unit 42 team explains how LDAP, while essential for Active Directory management, is frequently exploited by threat actors like Stately Taurus and BlackCat ransomware groups who use tools such as AdFind and SharpHound for malicious reconnaissance. While detecting malicious LDAP activity is challenging due to high volumes of legitimate traffic, organizations can implement effective detection strategies by monitoring suspicious attributes, analyzing user context, and establishing behavioral baselines. The article concludes by highlighting how Palo Alto Networks' products like Cortex XDR, XSIAM, and Xpanse can help security teams detect and prevent LDAP-based attacks.
2024.12.20·unit42.paloaltonetworks.com·10 min read·TLDR InfoSec Reflected input in web attacks can sometimes be made exploitable by using the Range header to extract specific sections from a server response. By combining this technique with desync or header injection, attackers can turn previously unexploitable vectors into fully exploitable ones. The ability to manipulate the Range header can lead to successful attacks by extracting targeted content from server responses.
Keepit's platform is designed to make it easy for enterprises to back up and protect valuable data. Its benefits and capabilities include five-minute setup, instant restore, job monitoring, API support, customized retention, access control, audit logging and compliance, and data monitoring.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Applications and APIs.
Zizmor is a static analysis tool for finding common security issues in typical GitHub Actions CI/CD setups.