Search the archive

PICKLESCAN

Picklescan is a CLI tool that can scan Python pickle files to detect suspicious actions. It can load files from directories, URLs, zip archives, or Hugging Face.

TERRAFORM PROVIDER FOR RCE VIA STATEFILE POISONING

OVER 600 VULNERABILITIES FOUND IN AVERAGE SOFTWARE CONTAINER

NetRise compiled advanced SBOMs for 70 of the most downloaded containers on DockerHub and found that the average container had over 600 vulnerabilities. 45% of the vulnerabilities were 2-10 years old and 7.9% were over 5 years old. 4.2% of high and critical vulnerabilities were being actively exploited. NetRise also noted that many components did not include manifests and emphasized the importance of advanced SBOMs.

HACKING TERRAFORM STATE FOR PRIVILEGE ESCALATION

This article discusses hacking Terraform state for privilege escalation by modifying the state file to control infrastructure changes without a "terraform apply." Attackers can manipulate the state file to delete resources or take over a deployment pipeline, which is why it is important to secure and lock the Terraform state to prevent unauthorized changes. The article highlights the need to use a read-only role for "terraform plan" executions to inspect changes without altering infrastructure until the deployment step.

RADIANT CAPITAL INCIDENT UPDATE

Radiant Capital faced a cyberattack resulting in a $50M loss. It was traced back to a DPRK-aligned threat actor using sophisticated malware. Despite following best practices, the attackers evaded detection by simulating benign transactions while executing malicious ones in the background. The incident highlights the need for stronger device-level security measures in the evolving DeFi industry to combat advanced threats.

ADMINISTRATOR OF ONLINE CRIMINAL MARKETPLACE ARRESTED IN KOSOVO

Liridon Masurica, an online criminal marketplace administrator known as "@blackdb," was arrested in Kosovo.

GOOGLE CLOUD EXPANDS VULNERABILITY DETECTION FOR ARTIFACT REGISTRY USING OSV

Google Cloud's Artifact Registry now offers enhanced vulnerability scanning using Open Source Vulnerabilities (OSV) platform that expands coverage for open-source packages and base images.

US BITCOIN ATM OPERATOR BYTE FEDERAL SUFFERED A DATA BREACH

US Bitcoin ATM operator Byte Federal disclosed a data breach affecting 58,000 customers caused by a server breach through a GitLab vulnerability.

Download now →

ANNA JACQUES HOSPITAL RANSOMWARE BREACH EXPOSED 300K PATIENTS

Anna Jacques suffered a data breach towards the end of 2023 that led to the publication of the breached data in early 2024. The hospital concluded a manual review of the breached data in November 2024 and has notified the over 300K individuals who were affected. The exposed information includes demographic information, medical history, health insurance information, SSNs, driver's license numbers, and financial information.

SENIOR DATING DATA BREACH EXPOSES MORE THAN 700K USERS

A data breach at the app Senior Dating has exposed the data of over 700K users. The owner of the site acknowledged the breach as well as a breach on Ladies.com which affected over 100K users in an email announcing the closing of both apps. The breached data includes bios, dates of birth, drinking habits, education levels, email addresses, genders, geographic locations, occupations, profile photos, relationship statuses, smoking habits, and social media profiles.

WPFORMS BUG ALLOWS STRIPE REFUNDS ON MILLIONS OF WORDPRESS SITES

A bug in WPForms allows users to issue Stripe refunds on over 6 million WordPress sites. The vulnerability was categorized as high-severity and a patch has been released in version 1.9.2.2. Website owners are advised to update to the latest version to prevent potential revenue loss and business disruption.

THE DARK SIDE OF DOMAIN-SPECIFIC LANGUAGES: UNCOVERING NEW ATTACK TECHNIQUES IN OPA AND TERRAFORM

Researchers from Tenable investigated the OPA policy-as-code language and the Terraform infrastructure-as-code language and discovered new attack techniques. When investigating OPA they found that data can be exfiltrated from IMDSv2 using the http.send function in Rego or via DNS tunneling if http.send is disabled. In Terraform, the team explored some known weaknesses in Terraform plans such as usage of the external, HTTP, or external data source as well as the local-exec and remote-exec provisioners. Tenable suggests only using trusted modules and policies, setting up cloud and application logging, limiting network access, and scanning to mitigate these risks.

CROSS-IDP IMPERSONATION: HIJACKING SSO TO ACCESS DOWNSTREAM APPS

Cross-IdP impersonation is an attack in which an attacker signs up for an account on an app that can function as an IdP and links it to the employee's company email address via a “use existing email” option. The attacker then either bypasses verification or verifies the domain by clicking a link in the email (or socially engineering an employee to click the link). The attacker can then sign into downstream apps by using the “sign in with” option with their impersonated IdP. Application protections against this attack vary significantly so Push Security suggests that companies alert on activation links to employee's emails, warn users of the risks associated with phishing, where possible configure SaaS apps to require reauthentication to add a new IdP, and where possible prevent the conversion of a personal account to a corporate account.

INSIDE ZLOADER'S LATEST TRICK: DNS TUNNELING

Zloader, a malware originally designed for banking trojans, has evolved into a sophisticated ransomware deployment tool. It now uses DNS tunneling, anti-analysis capabilities, and an interactive shell. Zloader attacks have become more targeted, and the malware has been updated with new features to evade detection. A specific variant, "BB3", is linked to Black Basta ransomware operations. Zloader's authors are focused on making the malware more resilient against security controls.

entitlements, and approvals with ZSP. Download now

VMI

Vmi (Virtual Machine Introspection) is a Rust library that provides safe abstractions for analyzing and manipulating virtual machine state from outside.

AN OFFENSIVE RUST ENCORE

This is a list of various Rust resources and tools to write secure Rust code.

GOCRACK

GoCrack is a management frontend tool from Mandiant that provides APIs for managing password cracking tasks.

I BOUGHT US-EAST-1.COM: A LOOK AT SECURITY, DNS TRAFFIC, AND PROTECTING AWS USERS

In 2021, Gabriel Koo noticed that the us-east-1.com domain was available and purchased it to prevent potential phishing. The most frequent DNS query that Koo observed was to a presumably production database (prod-backend-db.randomHash.us-east-1.com). Other top queries were to a loopback streaming service, a Cisco static file reputation host, and various cloud storage services. Koo encourages users to utilize tools like Route 53 Resolver DNS Firewall to prevent possible typos like this one.

WHAT SUCKS IN SECURITY? RESEARCH FINDINGS FROM 50+ SECURITY LEADERS

In this article, Maya Kaczorowski distills lessons from interviews from 57 security leaders and discovers that the top three pain points in security are access management (overwhelmed by access request tickets), vulnerability management (struggling with too many vulnerabilities to patch), and SaaS logs (difficulty accessing and analyzing logs during incidents). Beyond technical issues, cultural complications like vendor sprawl, unclear ownership of assets, and challenges in communicating security risks make these problems even more difficult to address. While there's excitement about AI improving security tooling, many core security challenges remain fundamentally unchanged, with few true breakthrough innovations that have eliminated entire classes of security issues.

FEDERAL APPEALS COURT UPHOLDS LAW THAT COULD BAN TIKTOK

A DC circuit appeals court has upheld the law requiring TikTok to sell to an American owner or face an effective ban.

WYDEN PROPOSES BILL TO SECURE US TELECOMS AFTER SALT TYPHOON HACKS

Senator Ron Wyden proposed a bill to enhance cybersecurity for U.S. telecom networks after Chinese state hackers breached major carriers earlier this year.

“CP3O” PLEADS GUILTY TO MULTI-MILLION DOLLAR CRYPTOMINING SCHEME

A man named Charles O Parks III, also known as "CP3O," pleaded guilty to wire fraud charges for running an illegal cryptomining operation that stole over $3.5 million worth of cloud computing resources.

Don't miss this comprehensive guide from Wiz

SOLANA WEB3.JS LIBRARY BACKDOORED TO STEAL PRIVATE KEYS

The Solana web3.js SDK was backdoored by a malicious commit for roughly 5 hours on December 2. The backdoor was hidden in a new addToQueue function which sent the user's private key in seemingly benign headers to an attacker-controlled server. Calls to the function were then placed in strategic locations in the key generation and loading process. The developers urge any developers who think they might have been compromised to rotate their keys.

ATRIUM HEALTH DATA BREACH IMPACTS 585,000 PEOPLE

Atrium Health reported a data breach affecting 585,000 individuals due to online tracking technologies on its patient portal between 2015 and 2019. Potential personal information may have been shared with third parties like Google and Facebook, though no financial data was compromised.

ULTRALYTICS AI LIBRARY COMPROMISED: CRYPTOCURRENCY MINER FOUND IN PYPI VERSIONS

Two versions of the Ultralytics AI library were compromised to deliver a cryptocurrency miner, leading to a spike in CPU usage for users. The malicious code injection occurred in the PyPI deployment workflow, allowing unauthorized modifications to be inserted after the code review step. Users are advised to update to the latest version of the library to avoid potential security risks.

PAVED ROADS? SECURE-BY-DESIGN? MORE BUZZWORDS???

Paved roads is a common security buzzword that refers to the process of creating a standardized path for common security pitfalls. Security reviews should look to identify common pain points across different reviews as candidates for paved roads and then work with teams that will pioneer the paved path. Following this methodology, full classes of vulnerabilities can be fixed at scale as opposed to individually as they appear in individual reviews.

PISHI: COVERAGE GUIDED MACOS KEXT FUZZING

This author provides a deep dive on macOS internals and their process in building a KEXT fuzzer. The post begins by detailing the difficulties of kernel-level binary instrumentation in macOS. The author then describes how they came to decide on an architecture that uses a custom-built trampoline to instrument basic blocks that were identified in the Boot Kext Collection and then feed the coverage results into the next iteration of the fuzzer.

of the modern data landscape. Join live on January 30

ETHYCA (PRODUCT LAUNCH)

Ethyca's platform helps organizations inventory data through automated system mapping to remain compliant with consent management across their entire data workflows.

FIDES

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments and the enforcement of privacy regulations in code.

CHAINREACTOR

ChainReactor is a project that leverages AI planning to find exploitation chains for privilege escalation on Unix systems.

EUROCOPS TAKE DOWN 'SECURE' CRIMINAL CHAT SYSTEM KNOWN AS MATRIX

French and Dutch police dismantled the Matrix encrypted chat app used by criminals, seizing 2.3 million messages about illegal activities across 40 servers. The operation led to three arrests and exposed the app's supposed security.

LET'S TALK DENIAL OF WALLET

Denial of Wallet attacks occur when an attacker makes use of cloud services which charge based on usage to generate large bills for victims. They can be caused by scaling traditional DDoS attacks or other vectors such as cryptojacking or LLM hijacking. This is the first post in a series on Denial of Wallet attacks and mitigations to protect against them.

NEW WINDOWS ZERO-DAY EXPOSES NTLM CREDENTIALS, GETS UNOFFICIAL PATCH

A new zero-day vulnerability in Windows lets attackers steal NTLM credentials by tricking users into viewing a malicious file in Windows Explorer. The issue affects various Windows versions, from Windows 7 to Windows 11. An unofficial patch is available from the 0patch team until Microsoft releases an official fix.

THE HIDDEN CHALLENGES OF AUTOMATING SECRETS ROTATION: WHY AUTOMATIC CREDENTIAL ROTATION ISN'T A ONE-CLICK SOLUTION

While automatic secrets rotation is a desirable goal, it requires significant organizational maturity in secrets management, proper infrastructure, and careful planning rather than being a simple one-click solution, as credential rotation involves complex processes that can impact production systems if not handled correctly.

9 THOUGHTS ON “U.S. OFFERED $10M FOR HACKER JUST ARRESTED BY RUSSIA”

The U.S. offered $10 million for information leading to the arrest of a Russian hacker known as "Wazawaka," who was involved in ransomware attacks.

APPLE SUED OVER ABANDONING CSAM DETECTION FOR ICLOUD

Apple is being sued for not implementing a system to scan iCloud photos for child sexual abuse material.

ANDROID'S CVE-2020-0401 (PACKAGEMANAGERSERVICE)

This blog post dives into CVE-2020-0401 after an old OnePlus phone sparked curiosity about the vulnerability. The vulnerability allows malicious apps to register as installers without proper permissions so the author tried to exploit it.

👉 Register to save your spot

7-ZIP VULNERABILITY LETS ATTACKERS EXECUTE ARBITRARY CODE

7-Zip has released an update for a high (7.8) vulnerability that can allow for RCE. The vulnerability exists in the implementation of the Zstandard decompression where improper validation of user-supplied data can result in an integer underflow before writing to memory. It allows attackers to run arbitrary code under the current user.

760,000 EMPLOYEE RECORDS FROM SEVERAL MAJOR FIRMS LEAKED ONLINE

A massive data leak exposed over 760,000 employees' information from major organizations like Bank of America and Morgan Stanley. Originating from last year's MOVEit hack, the breach is attributed to the Cl0p ransomware gang. It revealed names, emails, and work details, potentially enabling sophisticated social engineering attacks.

TELECOM GIANT BT GROUP HIT BY BLACK BASTA RANSOMWARE

The Black Basta ransomware gang has attacked BT Group's Conferencing division, stealing 500 GB of sensitive data. The telecom giant claims limited impact, with core services unaffected. The leak could include financial information and even passport copies.