Virtualization-based security enclaves are a Windows 11 feature that allows code to be run in a Secure Enclave that runs at a higher privilege mode than the kernel. The author of this post decided to attempt to write a simple Pong game that would run the core game logic in a VBS enclave and only run the code to write the display and read keypresses in the user mode. The theory was that if a game could run in a VBS enclave, then an attacker would only be able to cheat if they hooked into the Windows boot chain before the VBS enclave was loaded. Ultimately, the author found that the performance and API limitations that result from using VBS enclaves makes it an infeasible option.
AWS Resource Control Policies (RCPs) are like Service Control Policies (SCPs) for setting access limitations across your entire AWS Organization. RCPs help control resource sharing and enforce policy standards, making it easier to manage data perimeters and prevent undesired actions from external accounts. Deploy RCPs carefully across your organization to avoid potential issues and ensure security measures are maintained.
The 2024 macOS threat report by Moonlock Lab highlights a significant increase in malware targeting macOS users, with a focus on stealers. The rise of malware-as-a-service (MaaS) has made macOS threats more accessible and cost-effective, leading to an evolution in cybercriminal operations and techniques. The report emphasizes the need for users to stay vigilant as macOS malware continues to evolve rapidly and adapt to evade detection.
Sponsored
Cyber threats are inter-connected. Vulnerabilities are gateways in your attack surface that can be exploited to deploy ransomware, infostealers, and other cyber threats. Learn how you can build a strong vulnerability management program (VMP) [11] and reduce your attack surface with this comprehensive guide by Flashpoint [11].
Oversight is a modular LLM reverse engineering, red teaming, and vulnerability research platform. It currently has a single loader that supports loading plugins directly from Hugging Face but more are planned.
PermCheck is a little tool that checks if the files in a PHP project have the executable bit set properly.
Amberwolf's NachoVPN is an open-source tool that demonstrates how vulnerabilities in popular corporate VPN clients can be exploited by attackers to gain remote code execution. NachoVPN simulates rogue VPN servers to showcase insecure behaviors in VPN clients and help security professionals understand and mitigate risks. Detailed advisories for vulnerabilities in clients like Palo Alto GlobalProtect and SonicWall NetExtender are also provided to aid organizations in protecting against threats.
An Apple employee has accused the company of privacy violations due to its monitoring of personal iCloud accounts when using personal devices for work. The employee alleges that Apple-provided devices have too many restrictions to be used, virtually forcing employees to use personal devices.
AWS has announced a new type of management policy for AWS Organizations. Declarative policies enforce a security baseline that persists even when services add new APIs or features and when new principals or accounts are added to an Organization. Currently, declarative policies support blocking public access to VPCs, blocking public access to EBS snapshots, and various configurations for EC2 such as restricting available AMIs.
The EU has adopted two new cybersecurity laws establishing a pan-European Cybersecurity Alert System and introducing certification schemes for managed security services. These measures aim to enhance cooperative threat detection, improve information sharing, and strengthen cyber resilience across member states through coordinated technological and regulatory approaches.
Crypto.com has launched a bug bounty program with a maximum payout of $2M, the largest sum on HackerOne.
2024.12.06·infosecurity-magazine.com·2 min read·TLDR InfoSec AWS introduced Virtual Private Cloud (VPC) Block Public Access (BPA) for enhanced network security, allowing administrators to block Internet traffic for their VPCs.
Sponsored
What's next for GRC? Join the live panel discussion [4] to hear predictions from three established experts [4]: Jonathan Harbin, Principal Practice Manager at AWS; Drata CISO Matt Hillary; and Danny Manimbo, Principal AI Assessment Leader at Schellman.
The Bank of Uganda announced that offshore hackers stole nearly 17M USD from accounts in the country's central bank. Uganda's largest independent newspaper reported that the hack may have involved collusion from malicious insiders. Conversely, a state-owned newspaper published that over half of the stolen currency had been recovered and downplayed the attack.
Cybersecurity researcher Michael Heinzl discovered 4 critical and 1 high vulnerability in mySCADA's myPRO system. The vulnerabilities in the ICS software include OS command injection, improper and missing authentication, and path traversal. CISA which coordinated the disclosure has not observed any evidence of exploitation.
FBI and CISA have noted that the China-linked hacking group Salt Typhoon still has access to U.S. telecommunications networks, causing concerns for officials. Steps are being taken to strengthen network security against these hackers. Efforts are ongoing to remove the hackers completely, with some progress being made by companies working with the government.
Tailscale's infrastructure team is composed of only three engineers. The company is able to simplify networking infrastructure by utilizing Tailnets to connect resources across VPCs and different cloud providers while handling access at the Tailscale ACL level. Tailscale ACLs combined with setec, an in-house secrets manager to simplify secrets management as well.
Phishing attacks have increased by nearly 40 percent, with many targeting new domain extensions like .shop and .xyz due to their low prices and minimal registration requirements. These new gTLDs accounted for 37 percent of cybercrime domains reported in the past year. Despite this trend, ICANN plans to introduce more new gTLDs in the future, raising concerns about further opportunities for cybercriminals.
Jonathan Walker of Security Runners crawled through AWS documentation to create a list of all possible service buckets and determine if any were available for bucket namesquatting. During his research, Walker discovered buckets created for a large number of regions that didn't yet exist such as us-east-3. While ultimately unsuccessful at discovering an available bucket for namesquatting, Walker's discovery that AWS reserves buckets in a large list of uncreated regions to protect against attacks like this is interesting.
RequestShield is an open source tool written in Python designed to analyze HTTP access.log files and identify suspicious HTTP requests and potential security threats. It uses factors like geolocation, abuse history, request volume, and suspicious request paths to assign a risk score to each IP, providing actionable insights for security monitoring. RequestShield helps security teams detect and mitigate threats by analyzing access logs in real-time.
Semgr8s is an admissions controller for Kubernetes that uses Semgrep rules to validate k8s resources before deployment.
NativeBypassCredGuard is a Red Team tool that bypasses Credential Guard by patching WDigest.dll using NTAPI functions. It can force plaintext credential storage in memory, making user credentials easily retrievable. The tool offers options to check current values or write new values, with the ability to remap the ntdll library for bypassing security mechanisms.
TryHackMe has started its annual Advent of Cyber event, which includes daily challenges across cybersecurity domains. The challenges are geared towards beginners and are contributed by various creators in the cybersecurity space. Prizes for answering the questions include certification vouchers, various peripherals, and premium subscriptions to TryHackMe.
This recently released guide by CISA provides best practices for strengthening the visibility and security of communication networks against cyber threats, including those affiliated with the PRC. It covers monitoring, hardening systems, and collaboration between network defenders and engineers to ensure network protection. Specific guidance is given for Cisco systems to prevent exploitation by cyber threat actors.
APT35, a threat group linked to Iran, is targeting aerospace and semiconductor industries in various countries using forged recruitment sites to lure victims into downloading malicious programs. The attackers utilize legitimate internet resources like OneDrive and Google Cloud to carry out their activities, making threat detection and protection tools essential for defense against these attacks. ThreatBook has identified key indicators of compromise (IOCs) related to this attack event to enhance threat intelligence detection and protection efforts.
Cloudflare reports that Cyber Monday saw the highest global Internet traffic, with Black Friday following closely behind, and DDoS attacks were prominent during Cyber Week, particularly targeting shopping sites.
The FTC banned data brokers from selling Americans' sensitive location data linked to places like churches and healthcare facilities.
Cybercriminals are increasingly misusing Cloudflare's 'pages.dev' and 'workers.dev' domains for phishing and malicious activities, taking advantage of Cloudflare's trusted reputation.
Sponsored
Seemingly simple AWS misconfigurations can open the door for attackers, with devastating consequences.
ProjectSend is a moderately popular open source web application for hosting file-sharing servers. An authentication bypass vulnerability that was discovered in January 2023 and has had Nuclei and Metasploit templates available for months has just been assigned a CVE. The delay in the assignment of the CVE is problematic as VulnCheck researchers have noted only 1% of servers being patched and evidence of active exploitation on many others.
AnnieMac Home Mortgage experienced a data breach affecting 171,000 people, with hackers accessing personal information like names and Social Security numbers between August 21-23. The company is offering free credit monitoring. It has assured that it hasn't seen any misuse of the stolen data.
Researchers found a Linux malware exploit called LogoFAIL that hijacks device boot processes by bypassing Secure Boot. The weaponized code, discovered on a web server, can inject malicious firmware and potentially install a Linux bootkit, marking a shift from theoretical to real-world threat.
Check Point researchers have detected a new malware campaign that has infected over 17K machines since late June. The new campaign uses the Godot cross-platform gaming engine to execute GDScript code, which can trigger the GodLoader malware loader. The current variant of this malware employs several sandbox-evasion techniques such as checking for the presence of 3D acceleration and checking for the amount of free space available. After infection, the script adds the full C:\\ disk to the Microsoft Defender exclusion list and then downloads further malware from Bitbucket. The current variant targets Windows systems but Check Point researchers have provided PoCs for Linux and macOS.
Cybersecurity is an ongoing cat-and-mouse game between attackers and defenders. Phishing techniques have evolved from simple credit card theft to sophisticated attacks using device mimicry, social engineering, and evasion tactics like randomized resources, multi-step redirections, and AI-powered tools to bypass traditional security measures. This post dives into these techniques.
This article discusses a novel technique that blocks EDR (Endpoint Detection and Response) communications by manipulating the Windows Name Resolution Policy Table (NRPT) to redirect DNS queries for EDR domains to localhost or invalid IP addresses. The NRPT method can effectively prevent Microsoft Defender for Endpoint from sending data by manipulating DNS resolution, though it requires administrative permissions. The article also covers detection opportunities through PowerShell command execution and registry changes and suggests mitigation strategies for EDR vendors such as monitoring NRPT changes and implementing backup IP addresses for critical FQDNs.
Sponsored
Today's security teams must secure developer access, curb permission sprawl and stop identity-related breaches in hybrid and cloud environments — without sacrificing UX or productivity. Learn 4 essential criteria [11] that identity security solutions must offer to balance ease of use with stringent access controls. Get the guide by
Analysis Tools is a list of peer-verified linters and static analysis tools for various programming languages.
C/side helps businesses monitor, optimize, and secure third-party scripts, improving client-side protections to prevent zero-day attacks and the exploitation of known vulnerabilities.
A humble and fast security-oriented HTTP headers analyzer.
The US Department of Agriculture (USDA) primarily uses personal identity verification (PIV) cards for authentication but found that it could not solely rely on PIV cards for situations like when there were temporary employees or for the waiting period before a PIV card can be issued. To solve these issues, users were originally given an exception policy that allowed for username and password login, which was phishing prone. To improve its systems, USDA leveraged a centralized Entra ID system to roll out FIDO MFA using either Windows Hello for Business or FIPS-140 security keys. Leveraging FIDO + SSO allowed the USDA to protect over 600 applications through gradual organizational maturity.
AWS IAM Identity Center is streamlining its CloudTrail events to simplify user identification in CloudTrail and enhance the correlation between IAM Identity Center users and external directory services like Okta or Microsoft Active Directory. Specifically, IAM Identity Center will replace userName and principalID fields under the user identity element in CloudTrail events with the user ID and Identity Store ARN when a user signs into the console or accesses the AWS CLI. IAM Identity Center will also be omitting the value of a group's display name in CloudTrail events when a group is created or updated. Specific examples and transition guidance are provided in the blog post.
Cybercriminals are actively recruiting cybersecurity professionals on underground forums to develop sophisticated ransomware and dark AI models. They are aiming to enhance their malware's resilience and reduce vulnerability detection, reflecting a more professional approach to malicious software development.
McAfee discovered 15 malicious SpyLoan apps on Google Play that were downloaded over 8 million times, primarily targeting users in South America, Southeast Asia, and Africa with predatory loans while secretly collecting extensive sensitive data to facilitate extortion.
QNAP's recent security bulletin addresses 9 vulnerabilities - the most critical include an authentication bypass in Notes Station 3 that allows unauthorized command execution and an OS injection flaw in QuRouter that enables remote command execution.
A 2019 ransomware attack on Canadian medical testing company LifeLabs compromised 15 million patients' lab results and 8.6 million people's personal data.
Banshee Stealer, a macOS malware-as-a-service targeting browsers and crypto wallets, shut down after its source code leaked online. Developed by Russian hackers in August 2024, the malware's GitHub-published code may increase macOS cybersecurity threats.
A North West England NHS trust experienced a cybersecurity incident, forcing sites to revert to pen-and-paper operations. Systems were isolated and some appointments were affected. The trust is working with national cybersecurity services to restore normal operations.