Researchers at ESET discovered the first-ever UEFI bootkit (titled Bootkitty) targeting Linux devices when it was uploaded to VirusTotal. Bootkitty hooks UEFI security authentication protocols. It then hooks various GRUB functions to turn off kernel signature verification and intercepts the Linux kernel's decompression process to allow for loading malicious kernel modules. Bootkitty replaces the first environment variable to always load the malicious library at process startup. The bootkit relies on self-signed certificates, specific byte-pattern matching, and hardcoded offsets, so it will only work on specific GRUB and kernel versions. It is still likely in development.
Terraform automation platforms like Atlantis and Terraform Cloud are very popular for creating pull-request based CI/CD workflows. The typical workflow involves opening a pull-request that will trigger a read-only terraform plan which will then be reviewed and can be applied by a more privileged user with a comment. A malicious user can either inject code via the entry point of a malicious provider or through a malicious data source to bypass the read-only protections of terraform plan. This vulnerability has been confirmed on five Terraform automation platforms.
Sponsored
Give your cloud security career the boost it deserves this Black Friday. The Cloud Security Alliance [9] is offering TLDR readers 50% off the CCSK + CCZT exam and online training bundle [8], or 50% off the exam-only bundle [10]. Use discount code TLDRDOUBLEDIP24 from today at 12am PST through 12am PST Tuesday, December 3. Don't miss out!
2024.11.29·knowledge.cloudsecurityalliance.org·Sponsor·TLDR InfoSec Visio Trust collects, analyzes, and monitors artifacts from vendors to deliver real-time, comprehensive assessments and provide security teams with the security intelligence needed to make informed decisions during procurement.
Security automation content in SCAP, Bash, Ansible, and other formats.
Am I Isolated is a security posture benchmarking tool that evaluates the isolation of a given container runtime.
Thai authorities have arrested two organized fraud gangs, one of which used "SMS blasting" technology to send nearly 1 million malicious texts in Bangkok to trick recipients with fake prize messages and potential cyber threats.
Geico and Travelers were fined $11 million by New York for data breaches affecting over 120,000 individuals. The attacks compromised insurance quoting tools to steal driver's license numbers. Some of the data was used to file fraudulent unemployment claims during COVID-19.
Uniswap has launched a new bug bounty with payouts ranging from $2K to $15.4M, which could potentially mark the highest bounty payout in history.
One common implementation of the paved roads philosophy is through Terraform modules that employ secure defaults for common tasks (such as creating S3 buckets).
Trellix researchers have discovered a malware campaign that utilizes an old and vulnerable Avast anti-rootkit driver to evade detection. The malware drops the vulnerable driver in the default Windows user folder, then creates a service using sc.exe and registers the driver. The driver then leverages the DeviceIOControl API to terminate processes from a hardcoded list of 142 processes associated with various security solutions.
Researchers are warning of a new campaign from the Russia-linked RomCom APT that exploits a use-after-free 0-day in Firefox and a privilege escalation vulnerability in Windows Task Scheduler. The attackers are using a fake website that redirects users to a secondary website which hosts the malicious payload. The payload executes shell code using the Firefox exploit which runs an embedded library to break out of the browser's sandboxed environment via the Task Scheduler exploit to install the RomCom RAT.
Blue Yonder, a software provider for stores like Starbucks, was hit by a ransomware attack that caused disruptions to operations. Starbucks had to switch to manual mode for employee scheduling after the attack. The company is working with cybersecurity firms to recover and investigate the breach, with no timeline for full restoration yet.
Vectored Exception Handler (VEH) is a global exception handler mechanism in Windows that has fewer limitations than Structured Exception Handling. This post provides code that dynamically locates the offset to register a custom VEH and discusses the complexities that arise in the process. It also provides a YARA rule to detect the registered pattern.
This blog discusses strategies for identifying phishing campaigns, particularly those associated with the threat actor 0ktapus, which uses various social engineering techniques to trick victims into giving up their credentials. Researchers can uncover and detect phishing domains linked to 0ktapus and other threat actors by analyzing phishing infrastructure and using techniques like monitoring newly registered domains. Employing these techniques can help in spotting and preventing future phishing campaigns before attackers succeed in their goals.
Researchers analyzed a Mimic ransomware variant named Elpaco using the Everything library for file searching and customization. Elpaco includes a GUI for attackers to customize ransomware operations, encrypt user data, demand ransom payments, and exhibit sophisticated features. The ransomware variant manipulates files, uses a ChaCha20 stream cipher, and evades detection by securely erasing its executable files.
A high-performance Windows User Space emulator that operates at the syscall level.
This repository includes YARA rules extracted from Defender mpavbase.vdm and mpasbase.vdm files. The mpavbase.vdm file contains the antivirus base definition module and the mpasbase.vdm file contains the antispyware base definition module.
Brainstorm is a web fuzzing tool that combines AI with traditional techniques to find hidden web application endpoints more efficiently. It uses local LLM models and ffuf to automate path generation and discover more endpoints with fewer requests. The tool is available on GitHub. It offers a more effective approach compared to traditional wordlists for web fuzzing tasks.
After multiple delays due to privacy concerns, Microsoft announced that users in the dev Windows Insider channel with Snapdragon PCs will only be able to enable Recall if they have Windows Hello, BitLocker, and Secure Boot enabled. Recall will automatically filter sensitive content and include anti-malware protections such as anti-hammering and rate-limiting. It will be removed by default from enterprise devices, but IT admins will have the option to enable it.
A SpacialSec team member posted a satirical review of a fictitious Black Team Ops certification and course that gained traction and was receiving legitimate inquiries. SpacialSec took this as an opportunity to set up a registration page for the fictitious course and use it as a honeypot to capture registration details for those who would be interested in a course that included criminal topics like SIM swapping. SpacialSec then replaced the domain with a fake FBI seizure notification and sent a fictitious message to registrants that they were subject to FBI investigation. This post includes excerpts from “support” conversations with registrants, statistics, and some funny logs.
"NachoVPN" vulnerabilities allow malicious VPN servers to install harmful updates on unpatched Palo Alto and SonicWall SSL-VPN clients. Attackers can trick users into connecting to rogue VPN servers through social engineering or phishing, potentially leading to credential theft and code execution. SonicWall and Palo Alto Networks have released patches to address the vulnerabilities. AmberWolf has provided additional details and an open-source tool.
Although two men were arrested for extorting companies using Snowflake, hacker Kiberphant0m, believed to be a US Army soldier stationed in South Korea, remains at large.
Cloudflare had an incident on November 14 that resulted in the loss of about 55% of logs sent to customers.
Sponsored
Fraud tactics are becoming ever more sophisticated - but real-time data and applying the most up-to-date best practices [4] can help protect your business. Learn the latest credit card fraud methods to help your team anticipate and counteract threats. Get the Flashpoint
Mexico's president confirmed the investigation of a ransomware attack on the government's legal affairs office. Ransomhub is reportedly threatening to release 313GB of sensitive files unless paid within 10 days.
ESET researchers have discovered two new Linux magister families that are connected to Chinese APTs. WolfsBane is dropped via a dropper named Cron, which disguises the launcher as a KDE desktop component which then disables SELinux and eventually loads a rootkit that hooks several syscalls to evade detection. FireWood is another rootkit that maintains persistence by creating an autostart file.
Hackers have breached Andrew Tate's online university and leaked data on 800K users. The hackers revealed their breach by flooding chat rooms with emojis that they uploaded while Tate was streaming. Emails of roughly 325K users and the contents of the over 500 public and private chat servers were leaked.
Okta Fine-Grained Authorization (FGA) offers a dynamic permissions scheme called Relationship Based Access Control (ReBAC). ReBAC allows developers to define complex relationships between entities that can be evaluated by the policy engine to make access decisions. This blog post discusses how FGA can be integrated with AWS API Gateway as a Lambda Authorizer.
This post is part of a series that explores unique ways to achieve persistence on macOS via methods that don't use the traditional LauchDaemons or LaunchAgents. The author discovered an unused IO registry key called apple-trusted-trampoline in the IODeviceTree:/options entry (corresponding to the NVRAM) which is executed during the boot task if the rc.trampoline flag is set. They note that this is not a practical attack as it requires SIP to be disabled among other limitations.
This post takes a critical look at conventional wisdom around Disaster Recovery (DR) and how it fails in practice. Much of Cloud DR planning focuses on spreading loads across multiple data centers or even clouds. Failures are much more likely to be caused by user errors that lead to partial failures. DR strategies must be flexible enough to handle partial failures, have clear instructions (including who can initiate a DR incident), and need to be well documented.
Sponsored
Cloud-native organizations are facing rapidly changing environments, exponentially more identities, and difficulty managing privileged developer access. CyberArk and Wiz are joining forces [11] to tackle these challenges. Customers can now strengthen their multi-cloud security posture with best-in-class visibility and control over human
RIIG can deliver threat actor detection and cyber resilience training to employees. It meets the needs of organizations across multiple sectors, including government entities, delivering seamless integration and enhanced security.
Squealer scans git repositories and filesystems for secrets leaked deep within commit histories.
A lightweight Python library that adds security headers to a variety of Python web frameworks.
The DOJ has shut down PopeyeTools, a cybercrime marketplace that has been operating since 2016. The site sold stolen credit card data and hacking tools to 227,000 users, generating $1.7M. Authorities seized $283,000 in cryptocurrency during the operation.
Japan's Consumer Affairs Center has urged citizens to plan their "digital end of life," recommending that citizens share device access, maintain password lists, and designate digital heirs to manage subscriptions.
The Nearest Neighbor Attack is a new attack method where threat actors compromised one organization to access nearby Wi-Fi networks of other organizations. The attackers moved through multiple organizations without deploying malware by leveraging stolen credentials, highlighting the importance of strong network security measures. Volexity worked with affected organizations to uncover the attacker's tactics and implement mitigations to prevent further intrusions.
Foodinho was fined €5M by Italy's privacy regulator for illegally processing 35,000 riders' data, including unauthorized geolocation sharing and biometric data use.
GitHub is investing 1.25 million dollars in a program to help developers improve the security and sustainability of their open-source projects.
Microsoft is blocking the Windows 11 24H2 update on computers with Ubisoft games like Assassin's Creed and Star Wars Outlaws due to crashes and audio issues caused by changes in the operating system.
Sponsored
With Kubernetes clusters running on various platforms and in different configurations, organizations often face challenges in gaining visibility — leaving them vulnerable to potential security threats.
that drives Cloud Native Transformation across distributed clouds – on-premises, AI or at the edge. With centralized cluster management and streamlined deployments, Rancher Prime offers robust features to secure your clusters and applications.
A threat actor has leaked data belonging to 44K Ford customers. The breached data includes full names, physical locations, purchase details, dealer information, and record timestamps. Ford has responded to the allegations by stating that internal investigations have shown no evidence of breach and that the data comes from a third-party supplier as well as publicly available dealer information.
A threat actor has allegedly breached Mediboard, a software by Software Medical Records for managing Electronic Patient Records. Software Medical Records stated that upon investigation it determined that the breach affected one client's privileged Mediboard account which they used according to its standard function and that the attacks had not compromised any of Software Medical Records' infrastructure. The breached data may include full names, dates of birth, gender information, home addresses, phone numbers, email addresses, physician history, prescription information, and health card history.
Satellite company Maxar has confirmed a data breach affecting employee personal information, including names, addresses, and Social Security numbers. The hacker had access to the files for approximately one week before detection.