Search the archive

>> Get a Free Demo

AMERICAN DEBT RELIEF SERVICE EXPOSES 1.5M

Set Forth, a debt relief firm, has disclosed a data breach affecting 1.5M individuals. The breached data includes names, SSNs, addresses, and dates of birth. Set Forth plans on taking steps to prevent future attacks such as deploying endpoint monitoring and performing global password resets. It is offering 12 months of free access to identity theft services by Cyberscout. Some lawyers are pursuing class action lawsuits.

MICROSOFT POWER PAGES LEAK MILLIONS OF PRIVATE RECORDS

Microsoft Power Pages websites are exposing sensitive data due to poorly configured access controls. The low-code platform, used by over 100 million users across various industries, offers security features that many developers aren't implementing properly. There are widespread data exposure risks on these sites.

210,000 IMPACTED BY SAINT XAVIER UNIVERSITY DATA BREACH

Saint Xavier University reported a data breach affecting 212,267 people between June and July 2023. Alphv/BlackCat ransomware claimed responsibility for the breach. It has been confirmed that personal data including SSNs was compromised.

MODELEAK: PRIVILEGE ESCALATION TO LLM MODEL EXFILTRATION IN VERTEX AI

Palo Alto Networks discovered two vulnerabilities in Google's Vertex AI platform: privilege escalation through custom jobs and model exfiltration via malicious models that could expose sensitive AI models and data. This post dives into the vulnerabilities and how they were identified.

WHAT I'VE LEARNED: MY TOP AWS WAF TIPS FOR STRONGER PROTECTION

A collection of tips for utilizing AWS WAF most effectively. Some of the tips are common best practices such as ensuring that all external endpoints are mapped, testing rules in counting mode before fully deploying, and making sure that logging and alerting are enabled. Some other tips involve utilizing features that are not enabled by default such as bot control and rate limiting.

NPM PROVENANCE: THE MISSING SECURITY LAYER IN POPULAR JAVASCRIPT LIBRARIES

NPM provenance could have prevented the recent security incident involving the lottie-player library. Many top NPM packages lack proper provenance attestation, leaving them vulnerable to supply chain attacks. Implementing provenance can strengthen package security by verifying where and how a package was built.

WEBSITE FINGERPRINTING LIBRARY

Website Fingerprinting Library (WFLib) is a PyTorch-based library that implements 11 different website fingerprinting attacks.

GHOST

Ghost is a shellcode loader designed to evade common detection mechanisms such as kernel callbacks, stack unwinding, and memory scanning.

EVILURL

EvilURL is a Python tool designed to analyze and identify potential Internationalized Domain Name (IDN) homograph attacks. These attacks exploit the visual similarity of characters from different Unicode scripts to create deceptive domain names for phishing and other malicious purposes. EvilURL helps assess the vulnerability of domains to these attacks.

USING CLOUDFLARE ON YOUR WEBSITE COULD BE BLOCKING RSS USERS

OpenRSS has flagged an issue where Cloudflare bot management is breaking RSS readers by forcing them to attempt a human challenge that they cannot fulfill. OpenRSS has suggested that domain admins could attempt to allowlist RSS readers by User Agent on reader IP but called upon Cloudflare for a more comprehensive solution. OpenRSS' latest update on the issue states that it is working with Cloudflare to become a “verified bot” but is still trying to press Cloudflare for a more comprehensive and universal solution.

PYPI NOW SUPPORTS DIGITAL ATTESTATIONS

In an effort to enhance supply chain security, PyPi has added the ability for package maintainers to publish digital attestations with their packages. Attestations provide an additional layer of security over digital signatures as they are tied to an identity, must be verifiable, and include a link to the upstream source. Attestations can be viewed via the new Identity API or using the web UI.

FIVE EYES INFOSEC AGENCIES LIST 2024'S MOST EXPLOITED SOFTWARE FLAWS

The Five Eyes intelligence alliance has revealed its top 15 exploited vulnerabilities - Citrix vulnerabilities lead the list, followed by Cisco IOS XE and Fortinet FortiOS issues.

EXPERTS UNCOVER 70,000 HIJACKED DOMAINS IN WIDESPREAD 'SITTING DUCKS' ATTACK SCHEME

Cybercriminals hijacked nearly 70,000 legitimate domains in the last three months for phishing and fraud schemes using a technique called Sitting Ducks.

HACKERONE URGES U.S. TO ADVOCATE FOR RESEARCH PROTECTIONS IN UN CYBERCRIME TREATY

HackerOne is advocating for the U.S. government to ensure the UN cybercrime treaty includes explicit protections for ethical hackers and security researchers, warning that without such safeguards, legitimate security research could be criminalized globally.

BITDEFENDER RELEASED A DECRYPTOR FOR THE SHRINKLOCKER RANSOMWARE

Bitdefender has released a decryptor for the ShrinkLocker ransomware, which targets BitLocker configurations to encrypt system drives.

→ Dive deeper

→ Book a personalized demo

→ Learn how Hint Health [7] leveraged Frontegg for better security

2M RECORDS EXPOSED BY A TECH RECRUITMENT SERVICE

A publicly exposed, unprotected database belonging to Alltech Consulting Services containing 2M records of data belonging to over 200K job seekers was discovered. The records included salary expectations, work experience information, internal notes, names, email addresses, phone numbers, last four digits of SSNs, and passport numbers. The finding was responsibly disclosed to Alltech Consulting Services, which password-protected the database the following day.

AMAZON CONFIRMS EMPLOYEE DATA BREACH, BUT SAYS IT'S LIMITED TO CONTACT INFO

A breach at Amazon's property management vendor exposed work contact details (emails, phone numbers, and locations) of potentially millions of employees. The incident is linked to the 2023 MOVEit vulnerability, which affected multiple organizations.

MILLIONS OF HOT TOPIC CUSTOMERS IMPACTED BY DATA BREACH

A massive data breach at Hot Topic exposed nearly 57 million customers' personal information, including emails, names, addresses, and partial credit card data. A hacker, who allegedly accessed data through an employee's compromised computer and unprotected Snowflake account, has demanded $100,000 from Hot Topic.

EVASIVE ZIP CONCATENATION: TROJAN TARGETS WINDOWS USERS

Zip Concatenation is where a threat actor concatenates the binary data of two zip files to attempt to hide the malicious content. An attacker creates two zip files - one that contains a benign document and another that contains malware - and then concatenates the two zip files. The attacker then relies upon the victim and any relevant cybersecurity tools only seeing one of the archives and missing the malicious files. This post breaks down a real-world campaign that used zip concatenation to hide a Trojan in a second archive and shows how 7zip would miss the file but Windows Explorer and Winrar would not.

OPEN SOURCE SECURITY INCIDENTS AREN'T GOING AWAY

GOISSUE – THE TOOL BEHIND RECENT GITHUB PHISHING ATTACKS

A new phishing tool called GoIssue, which sells for $700-$3,000, enables attackers to harvest GitHub users' email addresses and send mass phishing emails. The tool poses significant risks as it targets developers' credentials, potentially enabling supply chain attacks and corporate network breaches.

reduce losses + protect customer trust. Get the guide.

SMUGGLESHIELD

SmuggleShield is an experimental browser extension that aims to prevent HTML smuggling attacks by detecting common patterns.

ZENITY (PRODUCT LAUNCH)

Zenity has built an agentless application security platform for securing low-code, no-code, and generative AI development solutions.

AUDITFORGE

AuditForge is a pentest reporting application that makes it simple and easy to write down findings and generate customizable reports.

SNOWFLAKE HACKERS IDENTIFIED AND CHARGED WITH STEALING 50 BILLION AT&T RECORDS

Two hackers, Connor Moucka and John Binns, have been accused by the US government of stealing approximately 50 billion AT&T customer call and text records. The breach, which occurred in April 2023, affected nearly all of AT&T's customers. The stolen data included call and message metadata.

COMPARING STATIC AND RUNTIME REACHABILITY

This article compares static and runtime reachability, two emerging approaches to determining whether vulnerabilities in code dependencies are actually exploitable. Both offer package-level and function-level capabilities. Static reachability analyzes code repositories to identify potential vulnerabilities during development but can't eliminate false positives completely, while runtime reachability uses agents to monitor actual code execution and provide near-certain identification of exploitable vulnerabilities. Static reachability integrates well with development workflows and doesn't require agent deployment. Runtime reachability offers superior accuracy in identifying truly exploitable vulnerabilities but requires agent installation and currently has limited vendor support.

NORTH KOREAN HACKERS CREATE FLUTTER APPS TO BYPASS MACOS SECURITY

North Korean hackers created malicious Flutter apps for macOS, passing Apple's security checks with legitimate developer IDs. These apps connect to DPRK servers and have the ability to execute scripts from a command and control server. Apple has revoked the signatures of these apps to prevent them from bypassing security measures on macOS systems.

LIVING OFF SECURITY TOOLS (WEBAPP)

Living Off Security Tools (LOST) is a project that shows how attackers can use security tools for post-exploitation.

MICROSOFT EXCHANGE ADDS WARNING TO EMAILS ABUSING SPOOFING FLAW

Microsoft Exchange has issued a warning for a high-severity vulnerability that allows attackers to impersonate senders in emails to make malicious messages more convincing.

VMWARE MAKES WORKSTATION AND FUSION FREE FOR EVERYONE

VMware has made its Fusion and Workstation desktop hypervisors free for commercial, educational, and personal use.

Watch the recorded session here

* Turn security and compliance into a revenue accelerator

D-LINK WON'T FIX CRITICAL FLAW AFFECTING 60,000 OLDER NAS DEVICES

Over 60,000 older D-Link NAS devices are at risk due to a critical security flaw that won't be fixed by the company. The vulnerability allows attackers to inject commands using specially crafted HTTP requests. D-Link has advised users to retire these vulnerable products or restrict their internet access.

CISCO BUG LETS HACKERS RUN COMMANDS AS ROOT ON UWRB ACCESS POINTS

Cisco has disclosed a new critical CVE that allows for RCE on Ultra-Reliable Wireless Backhaul (URWB) access points. Attackers can exploit improper input validation on the web-based management interface of vulnerable devices by sending crafted requests to execute arbitrary commands. The vulnerability only affects URWB devices running vulnerable software with the URWB operating mode enabled which can be checked by seeing if the show mpls-config CLI command is available.

CISA WARNS OF CRITICAL PALO ALTO NETWORKS BUG EXPLOITED IN ATTACKS

The CISA warned that attackers are actively exploiting a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool for migrating firewall configurations from other vendors to PanOS. The vulnerability allows attackers with network access to takeover Expedition admin accounts and potentially access configuration secrets, credentials, and other data. All Expedition usernames, passwords, API keys, and any firewalls processed by Expedition should be rotated after upgrading. Various proof-of-concept attack chains that exploit the vulnerability to obtain admin access to Palo Alto Networks firewalls are available in the article.

A NEW ERA OF MACOS SANDBOX ESCAPES: DIVING INTO AN OVERLOOKED ATTACK SURFACE AND UNCOVERING 10+ NEW VULNERABILITIES

Researchers have discovered multiple vulnerabilities in macOS sandbox escapes that allow attackers to bypass app sandbox restrictions and execute arbitrary system commands. Exploiting overlooked XPC services in system frameworks can lead to full sandbox escapes where dropped files are not quarantined, enabling attackers to escape sandbox restrictions. Apple addressed some of these vulnerabilities in macOS Ventura 13.3 by implementing checks on incoming XPC clients to prevent unauthorized sandbox escapes.

BEYOND RCE: AUTONOMOUS CODE EXECUTION IN AGENTIC AI

Anthropic's Computer Use is a new feature of Claude that allows Claude to use a virtual environment to complete tasks on the user's computer. Claude can be deceived into running malicious web content in computer use mode. The model does include some protections against hijacking as well as some protections against running some malicious commands but can still be “phished” to execute arbitrary commands. Claude can be convinced to curl an arbitrary file and pipe it to bash by a document telling it that it was a necessary codec. The model can be fooled into opening the calculator application by a remote PDF.

DELEGATING SECURITY REMEDIATIONS TO EMPLOYEES VIA SLACK

Slack interactions come in four categories: remind, alert, delegate, and respond. Remind and alert actions are more commonplace. Remind interactions remind users to take an action (such as mandatory training) and alert actions alert the security team to various alerts from other sources. There are two new categories in SlackSecOps called delegate and respond. Delegate actions involve an alert asking a user if a behavior was intentional (adding a contractor to a sensitive permission, sharing documents, etc) and only alerts the security team based on the response. Respond interactions are when a security team receives a request and can respond to it directly via Slack such as approving an access request and granting the access directly in Slack.

FLASK-VAULT

Flask-Vault is a robust library that empowers Flask applications to securely store and manage sensitive credentials.

ACSECURITY

AcSecurity is a Python module designed to scan applications for common security vulnerabilities. It checks for hardcoded secrets, dependency vulnerabilities, and code quality issues.

SAFE-HTTPX

safe-httpx is a small Python library that helps developers protect their applications from SSRF by implementing a wrapper around httpx.AsynchronousClient.get(), which performs DNS validation on the supplied URL and protects against DNS rebinding attacks.