Search the archive

XECRETS CLI

A Cross Platform AxCrypt compatible Open Source Encryption command line tool in C# for .NET 8+.

MIRI

Miri is a rust lang Undefined Behavior detection tool that seeks to detect unsafe code that fails to uphold safety requirements.

MICROSOFT HAS DELAYED COPILOT+'S ‘RECALL' FEATURE YET AGAIN

Microsoft's Recall feature, which captures PC screenshots for AI searching, will be delayed until December. Originally planned for June with the release of Copilot+ laptops, it was postponed due to security concerns. Microsoft promises it will be opt-in and removable, addressing user skepticism about data privacy.

EX-DISNEY WORKER ACCUSED OF HACKING COMPUTER MENUS TO ADD PROFANITIES, ERRORS

A fired Disney World menu production manager allegedly hacked servers, altering prices and adding false allergy information. Though caught before implementation, the attack cost Disney $150,000.

SUNSHINE THROUGH STORMY CLOUDS: BRINGING AWS SECURITY TO MERGERS AND ACQUISITIONS

This post describes how to effectively manage AWS security during mergers and acquisitions through a detailed six-step, 90-day process. Success requires careful onboarding of AWS accounts into the parent organization's security tools and monitoring systems while prioritizing the remediation of critical security risks like permissive IAM policies and public-facing resources over lower-severity issues. It is important to build trust with the acquired team while maintaining security momentum through the transition period, ultimately working toward full integration into the parent organization's infrastructure-as-code practices and security controls.

FROM NAPTIME TO BIG SLEEP: USING LARGE LANGUAGE MODELS TO CATCH VULNERABILITIES IN REAL-WORLD CODE

Google Project Zero's LLM-based tool, Big Sleep, discovered a stack buffer underflow vulnerability in SQLite.

CHATGPT-4O CAN BE USED FOR AUTONOMOUS VOICE-BASED SCAMS

ChatGPT-4o can be misused for voice-based financial scams.

“CROSSBARKING” — EXPLOITING A 0-DAY OPERA VULNERABILITY WITH A CROSS-BROWSER EXTENSION STORE ATTACK

Guardio Labs discovered a serious vulnerability in the Opera browser that allows malicious extensions to access private APIs.

CYBER ATTACK WIPES PUT DHL DELIVERY SYSTEMS

DHL is currently suffering from a cyberattack that took its delivery tracking systems offline. The attack targeted a third-party vendor used by DHL called Microlise. Microlise stated that it is working to contain the isolate and recover impacted systems but has not provided any further details.

TENS OF THOUSANDS OF TAXPAYER ACCOUNTS HACKED AS CRA REPEATEDLY PAID OUT MILLIONS IN BOGUS REFUNDS

The Canadian Revenue Agency (CRA) discovered that hackers had obtained confidential data belonging to H&R Block Canada. The attackers used the company's credentials to gain unauthorized access to Canadians' CRA accounts, change direct deposit info, submit false returns, and obtain more than $6M in funds. H&R Block Canada denies that the breach was its fault and states that it has no evidence that its systems were breached.

ITALIAN POLITICIANS EXPRESS ALARM AT LATEST DATA BREACH ALLEGEDLY AFFECTING 800,000 CITIZENS

Italian politicians are demanding stronger data protection after the discovery of a hacking scheme that breached sensitive public databases. The probe, which resulted in four arrests, revealed that 800,000 citizens' data was accessed by private investigators targeting high-profile figures.

BYPASSING NOEXEC AND EXECUTING ARBITRARY BINARIES

2024 LOOKS SET TO BE ANOTHER RECORD-BREAKING YEAR FOR RANSOMWARE — AND IT'S LIKELY GOING TO GET WORSE

Despite major law enforcement victories against ransomware groups, 2024 is set to break records for ransomware profits. Four victims have paid eight-figure ransoms, including Change Healthcare's $22M payment. This article goes into how ransomware is evolving and the continuous threat it poses.

BREAKING THE BARRIER

Spectre vulnerabilities still live in recent Intel and AMD processors, affecting speculation barriers (IBPB). The security flaw allows attackers to bypass process isolation and leak sensitive data across processes. In this article, researchers show the first practical cross-process Spectre attack, which successfully leaked root passwords.

MIND (PRODUCT LAUNCH)

Mind uses AI powered by tailored algorithms and a proprietary AI engine to classify sensitive data, assess potential risks, and automatically take prevention and remediation actions.

ZIZMOR

A tool for finding security issues in GitHub Actions CI/CD setups.

TAMEMYCERTS

TameMyCerts is a policy module for Microsoft Active Directory Certificate Services that enables security automation for many PKI use cases.

THE ENTERPRISE IDENTITY THREAT REPORT 2024

This report covers the state of enterprise identity attacks and underscores the pressing need for organizations to rethink their identity security strategies.

CHOOSING A STATIC ANALYSIS TOOL

This post introduces a SAST tool selection framework that begins with crowdsourcing recommendations and deciding between first or second generation analysis approaches. The framework covers evaluating tool compatibility with your environment, including language support, framework integration, customization options, and deployment preferences. It ensures policy and budget alignment.

AWS IDENTITY CENTER SIMPLIFIES CALLS TO AWS SERVICES WITH SINGLE IDENTITY CONTEXT

AWS has enabled the use of a single identity context to propagate the identity of users requesting access to AWS services. Prior to this release, developers that wanted to use trusted identity propagation had to call a service with separate IAM role sessions for services that can authorize access by user and a separate one for only logging the identity. Now, AWS will use the sts:identify_context to authorize user access.

MISCONFIGURED GIT CONFIGURATIONS TARGETED IN EMERALDWHALE ATTACK

Cybercriminals used automated tools in Operation EmeraldWhale to exploit misconfigured Git settings, compromising over 15,000 cloud credentials and 10,000 private repositories.

TYPOSQUAT CAMPAIGN TARGETING PUPPETEER USERS

An ongoing typosquat campaign is targeting developers of Puppeteer, Bignum.js, and cryptocurrency libraries with malicious packages.

STEAM NOW REQUIRES GAME DEVS TO DISCLOSE KERNEL-LEVEL ANTI-CHEATS

Valve now requires game developers on Steam to disclose if their games use kernel-level anti-cheat systems.

Download the report from Flashpoint →

ADMINS BETTER SPRING INTO ACTION OVER LATEST CRITICAL OPEN SOURCE VULN

CVE-2024-38821 is a new critical vulnerability that affects Spring WebFlux applications with specific configurations. While rated 9.1 CVSS by Spring, Red Hat considers it moderate (7.4) due to limited scope. It only impacts apps using WebFlux with static resources and non-permitAll authorization rules.

CHATGPT JAILBREAK: RESEARCHERS BYPASS AI SAFEGUARDS USING HEXADECIMAL ENCODING AND EMOJIS

ChatGPT's safety controls can be bypassed using malicious instructions encoded in hexadecimal format. The vulnerability was disclosed through Mozilla's 0Din bug bounty program. It represents another example of prompt injection bypassing AI safeguards.

FREE, FRANCE'S SECOND LARGEST ISP, CONFIRMS DATA BREACH

Free, which has 22.9M subscribers, reported that it suffered a data breach. The threat actor is auctioning the data on BreachForums, claiming that it contains IBAN numbers for almost a third of France's population. Free stated that the threat actor gained access to an administrative tool but was not able to access encrypted passwords, bank card information, or communications content.

WHAT MAKES A “GOOD” DETECTION?

The Shannon Signal Score is a way to combine qualitative and quantitative metrics to evaluate the quality of a signal based on the organization's context and the specifics of the threat. It combines qualitative and quantitative metrics to evaluate signal quality by considering threat alignment, detection integrity, operational costs, impact potential, and utility. The score uses weighted components including Threat Alignment and Coverage (measuring detection's threat alignment and attack surface coverage), Detection Integrity (quantifying effectiveness), Operational Cost (maintenance and false positive overhead), Impact and Risk Potential (threat impact assessment), and Utility (organizational value).

STRENGTHENING LOCAL ADMIN SECURITY IN WINDOWS 11 WITH LOCAL ADMIN PROTECTION

When using a local admin account in Windows, users are provided with both a limited user token and an elevated admin token which can potentially be stolen by malware on the system. Windows 11 recently introduced the Local Admin Protection or ShadowAdmin protection to solve this issue. In this system, a ShadowAdmin account is created for each local admin account, and when a process needs admin privileges, the task is run in an isolated context by the ShadowAdmin user. This post includes instructions to enable the feature and detailed technical details of how the Local Admin Protection flow works.

REFERENCE ARCHITECTURE FOR CONFIDENTIAL DATA PROCESSING IN A TRUSTED EXECUTION ENVIRONMENT

Trusted Execution Environment (TEE) architectures are designed to ensure privacy, security, and transparency for personal data processing. TEE solutions use hardware isolation, data encryption, and privacy policies to protect sensitive information. Different use cases, such as data minimization and data aggregation, can benefit from TEE-based solutions.

financial services. Watch on-demand

AUTOKAKER

Automated vulnerability discovery and refactoring using LLMs.

EASYDMARC (PRODUCT LAUNCH)

EasyDMARC protects domain and email infrastructure, ensuring emails sent from a domain are legitimate. This helps prevent phishing attacks while improving overall email deliverability.

SIMURAI

SIMurai provides a software SIM implementation for security researchers to explore and experiment with SIM cards.

THE STRAVA PROBLEM: HOW THE FITNESS APP WAS USED TO LOCATE THE WORLD'S MOST POWERFUL PEOPLE

Strava exposed world leaders' locations through its bodyguards' activity data. An investigation tracked the movements of US Secret Service agents protecting Biden and Trump, among others.

CROWDSTRIKE, DELTA SUE EACH OTHER OVER FLIGHT DISRUPTIONS

CrowdStrike and Delta Air Lines are suing each other over the July software update that caused global computer crashes. Delta claims the untested update cost $500 million, disrupted 1.3 million travelers, and canceled 7,000 flights. CrowdStrike denies responsibility, claiming Delta's response worsened the situation.

FIDO ALLIANCE PUBLISHES NEW SPECIFICATIONS TO PROMOTE USER CHOICE AND UX FOR PASSKEYS

The FIDO Alliance has published a draft of a new standard for the transfer of credentials (passwords, passkeys, etc) between credential managers securely. Currently, when a user wants to transfer credentials from one credential manager, the transfer generally takes place insecurely in the clear. The draft is not ready for implementation yet and is open for comments on the FIDO Alliance's GitHub page.

INTERNATIONAL LAW ENFORCEMENT OPERATION DISMANTLED REDLINE AND META INFOSTEALERS

A global law enforcement operation dismantled RedLine and Meta infostealers, seizing their infrastructure and making arrests.

NEW RESEARCH REVEALS SPECTRE VULNERABILITY PERSISTS IN LATEST AMD AND INTEL PROCESSORS

Both AMD and Intel processors are still vulnerable to Spectre attacks - users are advised to update their intel-microcode or install kernel updates to mitigate the risk.

FIVE EYES LAUNCH SHARED SECURITY ADVICE CAMPAIGN FOR TECH STARTUPS

Five Eyes intelligence partnership launched shared security guidance called Secure Innovation to protect tech startups from nation-state threats.

Don't miss out — register now!

FORTINET WARNS OF NEW CRITICAL FORTIMANAGER FLAW USED IN 0-DAY ATTACKS

Fortinet has announced a new critical 9.8 severity CVE in the FortiManager API that allows for stealing credentials, sensitive files, and IP addresses. The vulnerability lies in an authentication bypass in the FortiManager FGFM API. Fortinet has confirmed that the vulnerability is being actively exploited and has provided updated versions, mitigations, and IoCs.

INSURANCE ADMIN LANDMARK SAYS DATA BREACH IMPACTS 800K PEOPLE

Landmark Admin, which provides back-office services to insurance companies, disclosed a breach of over 800K people's data. Landmark reported that it detected a suspicious attack on May 13 and immediately took action to cut off access. The breached data includes first and last names, Social Security numbers, tax identification numbers, driver's license numbers, part numbers, financial account numbers, medical information, date of birth, and insurance policy numbers.

NEW WINDOWS DRIVER SIGNATURE BYPASS ALLOWS KERNEL ROOTKIT INSTALLS

Attackers can bypass Windows security features and install rootkits by downgrading kernel components. Outdated software components can be introduced on fully patched systems by exploiting the Windows Update process, making them susceptible to past vulnerabilities. Microsoft has dismissed the issue and the vulnerability remains unfixed, allowing for downgrade attacks and potential rootkit deployment.

HOW AWS USES ACTIVE DEFENSE TO HELP PROTECT CUSTOMERS FROM SECURITY THREATS

AWS' active defense tool, Sonaris, works in conjunction with MadPot honeypot sensors to uncover new techniques that attackers are using to attack customer accounts (such as enumerating S3 buckets or vulnerable EC2 services) and attempts to proactively respond to them using other AWS services such as WAF, VPC, and AWS Shield. Its use led to an 83% reduction in abuse in MadPot tests. It was able to prevent more than 16k scanning attempts per hour during a Dota3 campaign in Q3 2024.

PASSWORD MANAGERS FOR SMALL & MIDSIZE BUSINESSES: ZATIK'S SAFETY BAR RATING

Zatik created a Safety Bar Rating to evaluate 5 password managers on features such as MFA, SSO, RBAC, audit logs, force logout, password complexity policies, encryption in transit, and support for data destruction requests. Zatik found that BitWarden had all of the features that it was testing for other than force logout and that LastPass and 1Password supported all 9 features. Zatik recommends distinct password managers over those in browsers or mobile devices and they can be centrally managed. Zatik concludes by addressing the LastPass hack by showcasing some of the efforts that LastPass has taken to improve security since then.