Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
US officials are investigating TP-Link routers as a potential national security risk, considering a possible ban. The Chinese-founded company, which recently relocated to the US, has significant market presence including military bases. Microsoft reported that Chinese hackers were using TP-Link routers in attacks, though there is no evidence to suggest the company was complicit.
The EU has opened a second DSA investigation into TikTok, focusing on election risks after concerns about interference in Romania's presidential election. The probe examines TikTok's recommender systems and political content policies. The company faces potential fines of up to 6% of global turnover for violations.
In 2022, CISA published the Secure Cloud Business Applications (SCuBA) secure cloud baselines for Microsoft 365 with other cloud applications to come later. Citing a wave of recent attacks that were caused by improper configuration of cloud systems, CISA has issued a binding directive that federal agencies must abide by the SCuBA baselines. Federal civilian agencies will have until June 20, 2025, to implement the full binding directive with milestone deadlines along the way.
Meta was fined €251 million by Ireland's Data Protection Commission for a 2018 Facebook security breach affecting 29 million users' personal data that exposed information like names, contact details, and religious views.
The Play ransomware group has targeted Krispy Kreme, threatening to leak sensitive data just before Christmas.
Hackers are using Google Calendar to send fake invites and trick users into clicking malicious links.
Researchers from WPScan have discovered a remote code execution vulnerability in the WordPress plugin Hunk Companion. Hunk Companion is used to complement the features provided by ThemeHunk which is a plugin designed to install new themes. The vulnerability allows for the installation of plugins via an unauthenticated POST request. Attackers have been actively exploiting this vulnerability to install PHP droppers which allow for maintaining persistent access.
Jeremiah Fowler discovered an unencrypted, non-password protected database containing 4.8 million records belonging to AI optometry software company Care1. The database contained eye exams in PDF format which included patient PII, doctor's comments, and images of the exam results. The database also included spreadsheets that contained patient addresses, personal health numbers, and other PHI. Care1 removed the database after it was notified of the exposure.
ConnectOnCall, a telehealth platform, experienced a data breach that affected over 900,000 individuals. The breach exposed personal and medical information, prompting the company to take swift action and offer identity and credit monitoring services to affected individuals. ConnectOnCall is working with cybersecurity experts and law enforcement to address the security incident.
An in-depth look at a sophisticated campaign conducted by TA4557/FIN6 that utilized a resume lure to compromise a system. The fake resume zip contained a malicious .lnk file which was used to start an execution flow with several LOLBins payloads to establish a foothold. The threat actor then established persistence by deploying C2 software and creating a new user before performing recon to discover a target for lateral movement. The threat actor then compromised and pivoted to a Veeam backup server which they used to compromise another server. The attacker then utilized Cloudflared and Cobalt Strike for persistence but didn't perform any more actions before being evicted.
This technical analysis examines several vulnerabilities discovered in Qualcomm's adsprpc driver, which Google's Threat Analysis Group found was being exploited in the wild. The researchers identified six different bugs, including CVE-2024-43047, which involved a use-after-free vulnerability that could be triggered through map collisions in the driver's memory management system. By analyzing kernel panic logs from the exploit, the researchers determined that attackers were likely using inotify_event_info objects to exploit the vulnerability, highlighting how chipset drivers remain one of the weakest links in Android's security model in 2024.
This is a comprehensive guide to Android Static Analysis, which is a method of examining Android applications for security vulnerabilities without executing them. It covers several essential tools including APKTool, MobSF, Dex2jar, JD-GUI, Androguard, Ghidra, and APKleaks, explaining how each tool can be installed and used to analyze different aspects of Android applications such as permissions, hardcoded credentials, and potential security risks. The tools work together to create a robust security analysis approach, with each tool offering unique capabilities - from decompiling APKs to inspecting code and identifying vulnerabilities in the early stages of development.
Sponsored
You need to secure developer access, curb permission sprawl, and stop identity-related breaches—all while delivering a seamless user experience that doesn't hinder productivity. Is it even possible? Learn the 4 essential criteria [10] for identity security solutions to balance ease of use with stringent access controls. Get the guide from
Skuld is an infostealer malware that is designed for stealing user data in Discord, Browsers, Crypto Wallets, and more. The malware also includes persistence and evasion functions.
The Misconfiguration Manager repository on GitHub is a central hub for Microsoft Configuration Manager tradecraft and defense guidance. It aims to simplify SCCM attack path management for defenders and educate offensive security professionals. The project includes attack and defense matrices, techniques, and resources for the SCCM community to contribute and learn from.
The author of this post was investigating the efficacy of Microsoft Recall's “sensitive information” filter, which comes enabled by default in the current Windows Insider build, and found that it still captured credit card information and SSNs. The researcher tested entering credit card numbers into a Notepad file with clear text delineating it as a credit card number, filled out a PDF of a loan application in Microsoft Edge that included an SSN and other personal information, and even created an HTML page that had a text input explicitly requesting credit card information and found that Recall copied all of them. Recall did omit capturing information inputted in actual shopping sites though.
Kali Linux 2024.4 has been released as the last release of the year. This release adds 14 new tools, GNOME 47 on the desktop release, a new default Python version, and increased support for the Raspberry Pi imager. The release also ends support for i386 images, disallows the installation of pip packages by default, and deprecates SSH DSA keys.
The blog post discusses a security vulnerability in the OpenWrt supply chain due to a truncated SHA-256 collision and command injection. The attacker exploited the truncated hash to force the server to return a malicious firmware, potentially compromising devices. The issue was reported and fixed after investigation by the OpenWrt team.
According to Australia's official cyber security guidelines, traditional asymmetric algorithms (like RSA and ECDH), shorter hash lengths (SHA-224/256), and smaller AES key sizes will be deprecated by 2030 due to quantum computing threats.
A playlist containing 63 talks on security from AWS Re:Invent.
Sponsored
In 2024, Flashpoint identified 123 skimming breaches, which could have potentially cost companies $80 million in fraud losses [4].
A sophisticated supply-chain attack has been targeting security and technical personnel for a year using Trojanized open-source software from GitHub and NPM to steal login credentials. The campaign employs infected packages and spear phishing techniques to infiltrate researchers' devices with a stealthy backdoor.
Rhode Island's RIBridges public assistance system was taken offline after a cyberattack potentially exposing personal data of hundreds of thousands of people. The state plans to provide call center support, credit monitoring, and alternative application methods while investigating the breach.
A GitHub repository hosting a WordPress tool was used to steal over 390,000 credentials by a threat actor named MUT-1244. The attacker targeted security researchers and pentesters, exfiltrating sensitive data like SSH keys and AWS access keys. The malicious campaign involved phishing, trojanized GitHub repositories, and a cryptocurrency miner payload.
This post discusses different methods to establish persistence with a Linux loadable kernel module type rootkit. Two simple methods that are briefly touched upon are to use a user space persistence mechanism that runs with root privileges to load the module or add the module to /etc/modules. Instead, this author explores using a systemd-modules-load file with the Diamorphine LKM rootkit which will hide any file that contains a given magic string from the kernel to hide the configuration file. The author then describes how timestamps or checking for a tainted kernel can be used to detect this attack.
The Ultralytics Python project was recently targeted in a supply-chain attack through compromised GitHub Actions workflows and PyPI API tokens. PyPI experts were able to analyze the attack and emphasize the importance of securing software forges and building workflows for open source projects. To improve PyPI security, developers are advised to use trusted publishers, audit workflows for security vulnerabilities, and follow best practices like using 2FA and rotating secrets.
Many detection rules rely on artifacts that are mutable by the attacker. This author sought to investigate detections that relied on immutable artifacts with the example of an attacker that enumerated WiFi networks and dumped passwords directly via the WinAPI as opposed to using tools such as netsh. The author initially ran into issues as the program they wrote to enumerate networks did not cause any obvious registry calls, spawn netsh, or read the Wlansvc\Profiles\Interfaces file. The only method that the author found to detect the attack was by enabling the noisy Sysmon Event ID 7 where a rule can be created by searching for an event where the ImageLoaded is wlanapi.dll and the Image contains an unfamiliar .exe.
Sponsored
Datadog analyzed security posture data from thousands of organizations on AWS /Azure / GCP. The findings [11] suggest ongoing challenges with long-lived credentials and risks related to Kubernetes distributions, alongside adoption of proactive cloud security mechanisms such as S3 Public Access Block or IMDSv2 in AWS. Read the
Silent Push proactively detects potential cyber threats using an automated global intelligence system to monitor and predict attack patterns, helping organizations defend against various digital threats through advanced monitoring and data enrichment techniques.
Vanir is a source code-based static analysis tool that automatically identifies the list of missing security patches in the target system. By default, Vanir pulls up-to-date CVEs from Open Source Vulnerabilities (OSV) together with their corresponding signatures so that users can transparently scan missing patches for an up-to-date list of CVEs.
A CLI tool to encode and decode JWTs, written in Rust. It works as a pipe command and can be helpful to decode access tokens from other commands like curl.
Optum restricted access to an internal AI chatbot after it was found publicly accessible online. The chatbot, designed to help employees handle insurance claims, did not contain sensitive data but raised concerns about AI's role in claims processing.
Germany's cybersecurity agency reported that 30,000 media devices were infected with BadBox malware before sale. The agency has sinkholed communication with command servers, advised internet providers, and recommended users disconnect and scan potentially compromised devices from pre-infected Android equipment.
To ensure the security of its customers' secrets, 1Password utilizes end-to-end encryption to ensure that the data is not accessible by anyone, even at 1Password. To achieve this goal, 1Password utilizes AWS Nitro Enclaves to create a cryptographically verifiably, isolated confidential compute environment. 1Password publishes each enclave release to a public transparency log and then verifies the attestation when the client opens an encrypted channel. This ensures that no 1Password or AWS employees can access the code or communications running in the enclaves.
CISA and EPA urge water facilities to protect online interfaces for HMIs that help operators control industrial machines remotely from cyberattacks.
Amnesty International has reported that Serbian authorities used Cellebrite to unlock a journalist's phone and plant spyware for surveillance.
The FTC warns about a rise in online job scams, called "task scams," that resemble gambling, where victims are lured into earning money by completing simple tasks and depositing their own money for higher earnings.
Sponsored
If you're an MSP, you could seriously upgrade your value proposition [4] by offering network pentesting to your customers.
Researchers from Lookout have discovered a spyware app developed by Wuhan Chinasoft Token Information Technology Co., Ltd and used by Chinese law enforcement. The spyware collects messages from chat apps, screen recordings, screenshots, audio recordings, location information, network activity, installed apps, browser bookmarks, and external storage files. Lookout found evidence that the app is still in active development and that an iOS equivalent may exist.
Researchers from Oasis Security discovered an MFA bypass on one of Microsoft Azure's MFA methods that could lead to the compromise of Microsoft 365 accounts. The researchers discovered that the endpoint did not implement rate limiting and that the auth period lasted for a full three minutes as opposed to the recommended 30 seconds. The researchers also discovered that an attacker could rapidly make many auth attempts to enumerate the full 6-digit MFA space.
Researchers at Aquasec have found over 336,000 exposed Prometheus servers and exporters, risking data breaches and DoS attacks. Vulnerabilities like "RepoJacking" can lead to code execution through compromised exporters. To mitigate risks, organizations should prioritize authentication, limit public exposure, and secure debugging endpoints.
AWS Lambda functions are popular attack vectors for credentials theft and lateral movement. This post presents a realistic application architecture and walks through a scenario in which an attacker exploits a vulnerability in a Lambda function to achieve code execution and pivots to data exfiltration. It suggests using hardened IAM roles, secure coding practices, and monitoring to mitigate Lambda attacks.
Google has made a large push to move to memory safe languages but in the process is embracing hardening C++ to bridge the gap. The security team has attempted to harden libc++ by adding bounds checking to improve spatial security. The team started by integrating the changes into the test and preproduction environment for a year before promoting to production for all but a few exceptions. The safety checks only add a 0.3% performance overhead, but they have resulted in the discovery of over 1,000 bugs and successfully interfered with a red team engagement.
This second part of a guide on "Everyday Ghidra" explains how to create custom Ghidra Data Type (GDT) files from Windows headers to improve reverse engineering. You can ensure accurate and efficient analysis of binaries by using a compiler to preprocess headers before submission to Ghidra. Training Ghidra to use NDIS data types enhances the decompilation process and reveals new structures and variables for better analysis.
Sponsored
Since July 2024, ZeroPath's software has autonomously uncovered critical zero-day vulnerabilities—including RCE, authentication bypasses, and IDORs—in widely-used AI and open source tools. These include security flaws in projects owned by Netflix, Salesforce, and Hulu. See the full list [11] and read more about the methodology and research [11].
Pipe offers authenticated pub sub pipes over SSH with zero install.