Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Moblig was able to access Microsoft's ServiceNow platform and view sensitive data including employee emails and support ticket attachments. The security flaw allowed unauthorized access to thousands of support ticket attachments and over 250,000 employee emails. The issue was reported to Microsoft and resolved without a bounty reward.
TrafficLLM is an LLM adaptation framework for enhancing LLMs for network traffic analysis.
Pwnlook is a post-exploitation tool that will give complete control over the Outlook desktop app and the emails that it is configured with.
P0 provides access governance and identity security to help corporate security engineers lock down access to the cloud for users and developers.
This blog post discusses a firmware encryption method on Lexmark printers called WTM, which interacts with kernel modules and uses netlink commands. The WTM firmware, likely developed by Marvell, handles secure boot, authentication, and key management. Its process involves analyzing kernel modules, reverse engineering the firmware, and understanding command structures for encryption operations.
Hives are data structures that store keys, subkeys, and values for system configuration and user settings. Different types of hives, like application hives, have specific purposes and security considerations. Loading hives in Windows can be done through standard interfaces like RegLoadKey and RegLoadAppKey.
Four members of the REvil ransomware group in Russia were sentenced for hacking and money laundering, with two also convicted of distributing malware.
The Pwn2Own Ireland 2024 hacking competition awarded over $1 million for finding 70 zero-day vulnerabilities in fully patched devices.
Google and Samsung are extending software updates for Android phones for up to seven years by utilizing Google's Longevity GFR program, which helps manufacturers provide ongoing support by freezing chipset update requirements.
Sponsored
+90% of ransomware attacks leverage unmanaged devices in the network to gain access to systems and assets, according to a Microsoft report.
Security researchers are warning of new ClickFix campaigns that use fake Google Meet pages to distribute malware. The ClickFix campaign works by sending users a fake Google Meet link that masquerades as a Google Meet loading room informing users of an issue with their headphones or microphones. The page then prompts users to copy and execute a Powershell command to fix the issue, which downloads malware to the device. The article includes IoCs.
After recovering from a data breach and DDoS attack, the Internet Archive has reported another attack. This attack involved a compromised Zendesk token with users being notified by an attacker-sent email. Compromised information includes potentially sensitive data that was sent in support cases.
This blog post discusses hunting for Remote Management and Monitoring (RMM) tools in organizations, highlighting challenges in identifying different tools. By searching for keywords in various fields like filenames and process command lines, the likelihood of detecting RMMs increases. The query language used to search through SIEM logs helps optimize the process by attributing events to specific RMM tools based on identified keywords.
This post discusses how Nix simplified fuzz testing by automating setup and execution with a single command. The process involved compiling the PDF reader from source, generating test inputs, and identifying bugs. Nix allows beginners to fuzz test efficiently and discover vulnerabilities in software.
A vulnerability in multihomed Linux devices can be exploited to spoof and inject packets into internal communication streams. This issue can be leveraged by attackers with adjacent network access to manipulate data flows on devices like NAT routers and virtual machines. Mitigations such as anti-spoofing firewall rules and socket binding can help protect against these attacks.
DLL Proxy Generator is a tool to create a proxy DLL for an arbitrary DLL that optionally loads a secondary DLL.
Vulnhuntr leverages the power of LLMs to automatically create and analyze entire code call chains starting from remote user input and ending at server output for detection of complex, multi-step, security-bypassing vulnerabilities that go far beyond what traditional static code analysis tools are capable of performing.
Free decryption tool for Mallox ransomware that targets files encrypted in 2023 or early 2024, and which have the extensions .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx, and .xollam.
The UK's NCSC has released updated MFA guidance to address new threats. Foremost in its guidance, the NCSC recommends using phishing-resistant factors. Additionally, the NCSC recommends only prompting for MFA when necessary and provides an example of utilizing MDM-managed laptops and mobile devices as a factor instead of requiring a prompt.
Traditionally, detection engineering focuses on prioritizing high confidence, high severity alerts to not overwhelm SOC analysts. Teams should also utilize low-confidence alerts. These alerts can be useful to provide more context to the full cyber kill chain that attackers utilized and can also detect activity that may be relevant but did not trigger a high confidence, high severity alert.
LinkedIn has been fined €310M ($335M) by Ireland's Data Protection Commission for GDPR violations regarding its tracking ads business. The regulator found LinkedIn lacked a valid legal basis for processing user data and failed to properly inform users about how their information was used.
This report dives into identity security, highlighting how nearly half of organizations (45%) remain "concerned" or "extremely concerned" about being able to detect and protect against identity security attacks.
Penn State University will pay $1.25M to settle Justice Department claims that it failed to implement required NIST cybersecurity standards for federal contracts with NASA and the Pentagon.
Apple has created a Virtual Research Environment for researchers to test the security of its Private Cloud Compute system.
Sponsored
Employees use weak passwords when you don't give them better options — and they'll store passwords in shared Drive files and other insecure methods.
Russian cybersecurity company Positive Technologies has detected an ongoing campaign that exploits a medium-severity stored XSS flaw in Roundcube webmail. The flaw lies in the improper processing of SVG elements in emails which bypass syntax checks. The threat actor sends an email with no visible text and a .doc attachment which contains a hidden payload disguised as a href that injects an unauthorized login form into the HTML message.
Nidec suffered a ransomware attack in August where hackers stole 50,694 files after obtaining domain credentials. It refused ransom demands, so attackers have leaked its documents on the dark web.
Cisco has disabled public access to DevHub as it investigates a breach from earlier this month. The attackers have sold customer data, which includes source code, credentials, and certificates from major companies.
Client Side Path Traversal (CSPT) is a vulnerability that occurs when a client can provide path traversal characters (../) in a request to modify a different request. This can be chained with Open Redirect vulnerabilities to control the response returned to the client. This post describes the process of creating a Chrome extension to automate the discovery of CSPT vulnerabilities using dynamic analysis.
This post shares various resources and tactics for applying LLMs and Generative AI to CyberSecurity. It highlights how LLMs are being used for security tasks, sparking interest in the field. Various studies and projects are exploring LLM capabilities in code analysis and bug hunting. The potential of augmenting language models with tools and agentic approaches can be instrumental for various cybersecurity jobs.
BlackWing security found vulnerabilities in a JPEG processing program called jpeg-recompress by analyzing its source code. The company identified two vulnerabilities in the program related to buffer overflow and integer overflow. It discovered over 40 projects with similar vulnerabilities by using automated and manual searches.
Sponsored
AI is helping developers build APIs 200% faster, making it impossible for security teams to see the full picture. Join StackHawk's Joni Klippert and CISO Scott Gerlach to for an open and honest discussion [11] about this growing security challenge, and why source-code level API discovery might be the solution. Join the chat [11] 👋
Hydden creates a single data layer across IAM, identity governance and administration (IGA), privileged access management (PAM), and identity threat detection and response (ITDR) solutions.
Codependence is a JavaScript utility for checking dependencies to ensure they're up-to-date or match a specified version.
Vulncov is a tool that correlates Semgrep SAST scans with Python test code coverage to determine which unit tests run vulnerable code to help prioritize findings. It includes a self-hosted LLM that suggests bug fixes.
IP spoofing is an attack technique where attackers report an incorrect IP address in the X-Forwarded-For header to bypass rate limiting or IP based restrictions. Nearly a third of organizations that use Datadog's product receive X-Forwarded-For headers but 25% of those also receive suspicious X-Forwarded-For headers. To defend against this attack, use trusted vendor headers, add a custom header at the edge, or instruct frameworks to parse the header to the depth appropriate for your environment.
Analysts from Google's Mandiant warn that threat actors are getting more sophisticated. Specifically, 70% of the vulnerabilities that were reported as being actively exploited in 2023 were zero days. Mandiant also reported that the time to exploit a newly disclosed vulnerability has dropped to 5 days from 32 days in 2021-2022.
AWS has added the ability to sign in via SSO to the AWS Console mobile app. Once a user provides their sign-in URL in the application, it will redirect to the sign-in URL and provide a similar experience as the web login flow. This post includes a walkthrough of the new sign-in flow.
Google Cloud has launched a Vulnerability Reward Program that offers up to $101,010 for security researchers who discover vulnerabilities.
Overall, security practices have improved, but risky credentials and misconfigurations across infrastructure remain as the major vulnerabilities for AWS, Azure, and Google Cloud.
This post discusses a scenario where Mallox ransomware was deployed on a server due to a misconfiguration allowing unauthorized access.
Sponsored
After speaking with GRC leaders worldwide, Field CISO Kayne McGladrey realized something was missing: the ability to truly understand an organization's GRC maturity and the steps it would take to build the business case for change.
Omni Family Health has reported a cyberattack that affected 468,344 individuals. The breach, discovered on August 7, exposed personal data of patients and employees, including names, addresses, Social Security numbers, and medical information. Omni is offering affected individuals 12 months of free credit monitoring and identity protection services.
Redbox's bankruptcy raises concerns about data stored in its kiosks. A programmer accessed a Redbox hard drive image, retrieving 2,471 transaction records dating back to 2015. These included customer email addresses, zip codes, partial credit card numbers, and rental details. While only a small portion of transactions were likely stored locally, this highlights potential data privacy risks.
Microsoft researchers discovered a new vulnerability that could allow attackers to bypass Transparency, Consent, and Control (TCC) protections for Safari. The vulnerability can be exploited by an attacker modifying specific configuration files in Safari and then forcing a user to browse to a malicious page. A patch is available and users are encouraged to update as Microsoft has determined that threat actors may be actively exploiting the vulnerability.