Test-Driven Development is a software engineering philosophy that often uses an Arrange-Act-Assert design pattern where a state is set up, an action is taken, and then it is determined whether the results were what was expected. In detection engineering, the Arrange step can be modeled by deploying detection logic and setting up a test system. The Act step would then involve executing a test/tool/malware sample. The Assert step would evaluate what response was taken. Depending on the maturity and precision of the alert, the Assert step may make sure that the logs which observe the action are collected, a detection is fired off, or preventative action is taken.
2024.11.22·links.tldrnewsletter.com·12 min read·TLDR InfoSec Resource Control Policies is a new AWS feature that allows users to define a data perimeter in AWS Organizations by centrally restricting external access to AWS resources. RCPs complement SCPs, which offer central control over the maximum permissions of IAM users and roles by offering central control over the maximum resources on AWS resources. At launch, RCPs can apply to resources of the following AWS services: S3, STS, KMS, SQS, and Secrets Manager.
Google's AI-powered fuzzing project, OSS-Fuzz, found 26 new vulnerabilities in open source projects, including a critical one in OpenSSL. The team increased code coverage and automated the process of vulnerability discovery and patching by using AI-generated fuzz targets. They aim to make this technology widely available for defenders to find and fix vulnerabilities more efficiently.
Sponsored
Find and fix broken authentication, logic bugs, outdated dependencies, and more. Set up ZeroPath [11] in minutes and get continuous, human-level application security, PR reviews, and much more - with no human involvement required. Book a demo here [12] and
Abstract is an AI-powered assistant for centralized management of analytics. The platform correlates data to provide organizations with actionable insights for both compliance and data security.
A fast, customizable service detection tool powered by a flexible fingerprint system. It helps users identify services, APIs, and network configurations across infrastructure.
Nudge is an application that reminds users to apply macOS updates.
Microsoft has launched Zero Day Quest, a massive hacking event with $4 million in bounties. Researchers can win spots at Microsoft's HQ, collaborate with AI engineers, and help improve cloud and AI security through vulnerability research and disclosure.
MITRE released a list of the top 25 vulnerabilities of the year after analyzing over 31K CVE records with a stronger focus on those in CISA's KEV. Cross Site Scripting, Out-of-bounds write, and SQL Injection lead the group while Uncontrolled Resource Consumption and Code Injections all had large increases this year. MITRE encourages users to review the list and update security practices and priorities accordingly.
Unredacted court documents revealed that NSO Group used Pegasus spyware to infect 1,400 WhatsApp users' phones in 2019, violating laws. WhatsApp's security team successfully blocked Pegasus intrusions targeting journalists, activists, and officials. NSO Group developed exploits to infiltrate devices without user interaction. This has led to a lawsuit and ongoing accountability efforts.
Federal prosecutors have charged five men in Los Angeles for hacking major U.S. tech companies using SMS phishing attacks.
Microsoft has formed a new Windows Resiliency Initiative to keep security vendors out of the kernel mode coming from the CrowdStrike fiasco.
Microsoft will soon allow Teams users to clone their voices for meetings in different languages.
Sponsored
When you treat risk and compliance like a project, you're setting yourself up for failure. Build a process that can support your business, even as needs and regulations evolve, with Drata [4]:
Alex Cheema of EXO Labs discovered a seemingly benign PR that attempted to inject malware into EXO's GitHub repo. The PR attempted to modify the models.py file with a set of Unicode characters that translated to a code snippet that would download and run a file titled stage1payload. The (now deleted) GitHub user that opened the PR was named evildojo666, which suggested security researcher Mike Bell was responsible. Bell has stated that this was an impersonator and that he has no connection to the attempted backdoor.
Researchers from WordFence have discovered a new vulnerability in the Really Simple Security WordPress plugin. The vulnerability involves an error in handling an invalid login nonce in the 2FA procedure that can allow an unauthenticated user to login as an administrator. Users should ensure that they're on the latest version of the plugin. WordFence is working with the plugin developers and WordPress.org to force users to update to the latest version. The WordPress.org stats site reported 3.5M sites that were potentially vulnerable at the time of publication.
Apple released emergency security updates to fix two zero-day vulnerabilities that were being exploited in attacks on Intel-based Mac systems. The flaws allowed attackers to execute code remotely and launch cross-site scripting attacks. Apple has addressed these vulnerabilities in macOS Sequoia and other Apple operating systems.
Amazon Cognito is a user management offering from AWS that can include security features such as threat detection. Cognito can use custom authentication flows to support passwordless authentication methods. It now supports using advanced security features on custom authentication flows. This post walks through how to set up passwordless authentication using webauthn and enable and configure threat detection.
This article reverse engineers iOS 18's new inactivity reboot security feature by analyzing both debug strings in the SEPKeyStore kernel extension and decrypted Secure Enclave Processor (SEP) firmware. The SEP tracks device unlock times and triggers a forced reboot after 72 hours of inactivity. The feature is not wireless-dependent as previously rumored, but rather is implemented through direct SEP-to-kernel communication that forces devices into a secure "Before First Unlock" state. The SEP's involvement makes this feature highly tamper-resistant, requiring kernel-level code execution within the first three days to prevent the reboot, effectively creating an asymmetric defense that particularly impacts criminals while leaving law enforcement a narrow window for forensic analysis.
Sharp Panda's new loader, now renamed Sharp Dragon, is deploying a new dropper to target Southeast Asia countries. The malware disguises itself as a Word document to trick victims and drops a malicious DLL for further exploitation. The malware may contain keylogging features and uses various APIs.
Nuke It From Orbit (nifo) can disable AV/EDR products from Windows machines even if they have BitLocker enabled if an attacker has physical access.
A Kubernetes attack graph tool that automatically calculates attack paths between assets in a cluster.
GoCrack is a management frontend that provides APIs for managing password cracking tasks.
Google Play Services' newest APK seems to include references to a Shielded Email feature. This feature would allow users to create email aliases when signing up for websites that can be turned off to avoid spam. The feature is available in the Autofill settings but it doesn't seem to be enabled at present.
LLMs show promise for finding vulnerabilities due to their potential to understand code behaviors and go beyond the exact pattern matching that is used in traditional SAST tools. LLMs provide inconsistent results, have privacy issues, are time-intensive to train, and their use can lead to vendor lock-in. Many of these issues could be mitigated by modifying their usage. This article lists some possible improvements. CodeLlama, LLaMA, Mixtral, and Mistral are particularly problematic for these tasks.
There has been positive progress on the secure-by-design pledge, which was launched in May and has now been signed by 248 companies who committed to implementing seven key digital security practices within a year of signing. The pledge focuses on improvements like expanding multi-factor authentication, reducing default passwords, and better vulnerability disclosure. Companies like Microsoft and Google are already showing significant progress through monthly technical exchanges and public reporting. While CISA plans to partner with a civil society organization to independently assess companies' progress and launch a website tracking their commitments, it won't remove companies who fail to meet goals - it will instead let their lack of progress be evident through an absence of public updates.
A handy list of the 27 IAM policy conditions categorized with explanations and examples for each one.
Strava is limiting how user data can be shared with third-party apps to prioritize privacy and user control.
Sponsored
Attackers move fast—you need to be faster. Intruder offers real-time discovery and prioritization of attack surface weaknesses, allowing you to focus on the fixes that matter most. Join thousands of companies worldwide protecting their digital assets.
Tibber is a provider of green energy options for customers in Northern Europe and Germany. It reported that customer data belonging to 50K German customers of its smart hardware online store was stolen. The leaked data includes names, email addresses, order amounts, and incomplete address data.
Three variants of a new macOS malware have been detected. One variant was written in Python, one in Golang, and one using Flutter, which heavily obfuscates code by default. The malware was embedded in a clone of Minesweeper. No evidence of exploitation has been found - the callback domain returns a 404. The malware appeared to target cryptocurrency developers. It had several of the hallmarks of a Lazarus group attack.
The Gogs self-hosted Git service version 0.13.0 has a vulnerability (CVE-2024-44625) that allows remote code execution. Attackers can exploit this by gaining access to an account that can push to a repository and editing files from the web interface. The issue remains unaddressed by Gogs developers despite multiple reports, prompting users to take security measures and consider migrating to Gitea.
This in-depth guide to bypassing SELinux on Android devices begins with an overview of how SELinux works and breaks down the relevant sections of the implementation code. It then discusses some bypasses that don't work either for hypervisor blocks or read only memory such as disabling SELinux by setting the enforcing mode to permissive, overwriting the permissive map, AV Cache poisoning, and SELinux initialization overwriting. Two bypasses that do eventually work involve overwriting the SELinux hooks and overwriting the allow_unknown field in the selinux_state.
This is the first out of two articles that cover DOMPurify security bypasses discovered in early 2024 by various researchers. Affecting versions 3.1.0-3.1.2, the vulnerabilities include exploits that use deep nesting and DOM clobbering techniques.
A technical analysis that explores ChatGPT's sandbox environment. It covers how to gain file system access, command execution capabilities, and prompting techniques to extract system information. The author emphasizes responsible disclosure and educational goals and requests readers notify OpenAI of any issues prior to publication.
Sponsored
As a security leader, it's your job to approach AI with a dose of healthy skepticism. Download this guide by BigID [13] to learn how to navigate the world of AI from a CISO's perspective - and how to start finding opportunities rather than focusing solely on threats. Get the
Whispr is a CLI tool for injecting secrets from various secret vaults into an app environment. It supports vault services from AWS, Azure, and GCP.
PowerHuntShares is PowerShell tool designed to help cybersecurity teams and penetration testers better identify, understand, attack, and remediate SMB shares in the Active Directory environments they protect.
SurePath AI provides visibility and control over gen-AI use across public and private models, with role-based access controls that decide what data is allowed to leave the organization and what end-users have access to.
This past February, NIST announced that it did not have enough resources to keep up with the CVE enrichment backlog and stated that changes would be made to keep up. Now, the NIST has announced that it is fully staffed, has partnered with other federal agencies and industry partners, and has provided enriched CVE data for all vulnerabilities in the KEV. However, NIST also stated that the format that it receives data from its Authorized Data Provider is difficult to import and enhance.
A common cybersecurity trope is to never use unsecured, public WiFi without a VPN. The author of this article challenged this notion by monitoring the HTTPS and non-HTTPS connections made by their iPhone and Chromebook. They found that anyone monitoring their connection could only see 0.25% of requests from their Chromebook and that there were zero connections to HTTP websites and services from their iPhone.
PyPI has introduced digital attestations (PEP 740) to improve package security. Digital attestations offer better usability and verifiability than PGP signatures. Attestations are automatically enabled for publishers using Trusted Publishing with pypa/gh-action-pypi-publish v1.11.0+.
Ilya Lichtenstein has received a 5-year sentence for the 2016 Bitfinex hack.
Threat actors are using SVG attachments in phishing emails to avoid detection, with some of them displaying HTML and then executing JavaScript when the image is loaded.
Microsoft has announced that it will use the Common Security Advisory Framework, which helps organizations understand and fix security issues faster, for vulnerability disclosures.