Bill Demirkapi's long term project discovered over 66,000 unique TLDs with dangling records and more than 15,000 verified secrets. He used innovative methods including enumerating cloud IP pools, utilizing passive DNS sources, and employing VirusTotal's Retrohunt tool with custom YARA rules. In this post Demirkapi outlines the key principles for large-scale vulnerability discovery, emphasizing starting with the vulnerability itself and using creative data sources with relevant relationships.
This post describes a Patchflow to create an AI code autofixer. The Patchflow first scans the code using Semgrep. It then enriches the Sarif output with the source code file and uses an LLM to triage the report. The LLM is then prompted to create and test a patch. If successful, the LLM then opens a PR with the fix. Prompts for each of the LLM steps are included.
Call stack spoofing is a technique to hide suspicious activity from security software like EDR by mimicking a legitimate call stack. A malware called DodgeBox used by APT41 implemented this technique to trick antivirus software. By creating a fake call stack, the malware obscures the true origin of function calls, making detection more challenging.
Realm.Security is a platform that integrates and manages cybersecurity data from various sources in various formats by leveraging artificial intelligence and data processing technology.
Node Version Audit is a tool for easily checking a given Node.js version against a regularly updated list of CVE exploits, new releases, and end of life dates.
s3cme is a template Go app repository with test and release pipelines that are optimized for software supply chain security.
This researcher attempted to discover security vulnerabilities by scraping and querying the AWS documentation. Their post begins by briefly touching on the steps taken to scrape the AWS documentation and some brief exploration locally using ripgrep. The researcher uploaded the scraped and enriched docs to s3 and set up Amazon Bedrock to query the docs using Claude 3.5. They discovered over a hundred publicly accessible buckets with sensitive information, was able to takeover a bucket, and discovered that the amzn-s3-demo-* prefix is reserved.
This post provides cybersecurity professionals with insights into how to leverage FCC's $200 million program to help K-12 schools improve cybersecurity defenses. Schools can apply for funding by demonstrating cybersecurity needs and developing improvement plans. Partnering with cybersecurity experts can enhance schools' chances of securing funding and maintaining long-term security.
OWASP updated its Top 10 Risks for Mobile Applications, highlighting "Improper Credential Usage" as a significant security concern due to hardcoded secrets in mobile apps. To enhance secrets security, developers should avoid hardcoding secrets, use secure storage APIs, move secrets to the backend, rotate keys regularly, and implement secrets detection tools like GitGuardian. Leaked secrets can lead to severe consequences, such as unauthorized access, financial losses, and legal repercussions, showing the importance of prioritizing secrets management in mobile app development.
This report provides a comprehensive overview of the hacking community and its perspective on topics at the forefront of cybersecurity.
DEFCON has uploaded all of the main stage talks from DEFCON 32 to its YouTube channel.
The European Union has updated its product liability rules to cover software and associated risks.
Sponsored
Network penetration testing is the BEST way to evaluate security risks and effectively close security gaps before the bad guys have the opportunity to exploit them. But not all solutions will work for all businesses.
to learn about the penetration testing process, types of pentesting,
2️⃣ Schedule a free demo of vPenTest [4], a SaaS platform that fully replicates manual network penetration testing.
The Jetpack WordPress plugin has released a fix for a critical vulnerability that was discovered during an internal audit. The vulnerability allowed logged-in users to view forms that were submitted by other users. Automattic has released updates for 101 impacted versions of Jetpack and recommends updating immediately.
Gryphon Healthcare is notifying nearly 400K individuals that their data was breached due to an unnamed third party. Potentially compromised information includes names, dates of birth, addresses, Social Security numbers, dates of service, diagnoses, health insurance information, medical treatment and record numbers, providers, and prescriptions. Gryphon is not aware of any misuse of this information.
Globe Life has reported a data breach affecting its AIL subsidiary. A hacker stole sensitive customer information, including names, addresses, and sometimes Social Security numbers and health data. While 5,000 individuals are confirmed affected, the total impact could be much larger.
Many security teams jump to security monitoring before implementing basic security hygiene. This post introduces a collection of security monitoring antipatterns. These antipatterns include focusing on data collection without implementing effective detection and response strategies, relying on custom-built solutions instead of off-the-shelf tooling, prioritizing shiny new tools over established practices, and expecting one tool to be sufficient for all needs.
Ransomware attacks on AWS using cross-account KMS keys can be blocked by AWS if the key is owned by them. The new AWS KMS External Key Store feature allows for secure communication with on-premises HSMs for encryption. Simulating ransomware attacks on AWS can help to develop understanding of vulnerabilities and improve security measures.
macOS may not properly enforce the quarantine attribute, potentially allowing a bypass of the Gatekeeper security mechanism. Gatekeeper is designed to ensure only trusted software runs on systems by validating applications before execution. To reduce the risk of malicious Gatekeeper bypasses, developers should enforce the attribute on all files their applications handle.
2024.10.18·unit42.paloaltonetworks.com·7 min read·TLDR InfoSec Sponsored
AI is constantly changing the cybersecurity landscape, so you'll want to keep your teams ready. Our security skills guide [12] reveals the key components of successful security upskilling, the root causes of this skills shortage, and how you can close cybersecurity skills gaps across teams [13].
Passbook is a paid app that allows users to create an Apple Wallet pass from any QR code.
CloudWatch Log Redirector is a CLI tool that allows for redirecting log output to AWS CloudWatch.
prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles. It includes an approval process.
A group of researchers have published a paper detailing a new attack using commercial D-wave quantum annealing systems. The attack targets Substitution-Permutation Network structured algorithms, which are at the heart of the AES encryption standards. The report was limited to targeting a 22-bit key though, which is much smaller than those commonly used.
Hybrid work has increased printer, unmanaged devices, and network security risks. A study showed that 67% of organizations experienced printer-related incidents in 2024. This article discusses recently disclosed print-related vulnerabilities.
Hong Kong police arrested 27 people involved in a $46 million AI-powered romance scam. The operation used face-swapping technology to create fake attractive personas for online dating, tricking victims into fraudulent cryptocurrency investments.
The CISA and FBI have released a guidance on software security bad practices and are seeking public feedback.
The US charged two Sudanese brothers with running the Anonymous Sudan cybercrime group, which is known for launching DDoS attacks worldwide.
An Alabama man was arrested for hacking the SEC's account to fake approval of Bitcoin ETFs.
Sponsored
Give your team the tools they need to manage and share passwords and other sensitive data safely [4] — and save yourself the time and hassle of doing it for them.
Casio confirmed that a ransomware attack resulted in data theft of the personal information of employees, contractors, partners, and some customers. Sensitive company data was also accessed, though credit card information remained secure.
Gryphon Healthcare has reported a supply-chain cyberattack that affected hundreds of thousands of patients. The breach, which potentially exposed sensitive personal and health information, occurred through an unnamed partner company before August 13. No evidence of data misuse has been found. The compromised data includes names, birthdates, addresses, Social Security numbers, and medical details.
Mozilla has released a patch for a new Firefox vulnerability with a CVSS of 9.8. The vulnerability arises from a use-after-free bug in the Animation timeline feature in the Page Inspector tool in Firefox. The vulnerability is actively being exploited. Mozilla encourages immediate updating.
Open source ecosystems are vulnerable to supply chain attacks, with entry points being an often overlooked risk. Attackers can exploit this feature across multiple programming ecosystems to execute malicious code when specific commands are run using methods like command-jacking.
This article profiles two CISOs by discussing their career paths, leadership development, and views on modern CISO roles. It covers team building, mentoring, and advice they've received and they would give. It also explores their perspectives on emerging threats in cybersecurity, including evolving attack methods and data protection challenges.
Securing offensive security/bug bounty infrastructure is pivotal to protecting the target's sensitive data. This post showcases how Tailscale can be utilized with a VPS and ufw to create a secure, private network. It shows how to use advanced Tailscale features to enable file sharing and keyless SSH.
VulnAPI is an Open-Source DAST designed to help users scan APIs for common security vulnerabilities and weaknesses.
Halberd is a tool that executes a comprehensive set of attack techniques across a variety of different clouds via a web interface. It supports Entra ID, Microsoft 365, Azure, and AWS.
Gato is a tool for finding and exploiting vulnerabilities in GitHub pipelines of public and private repositories. It helps security engineers, blue teams, red teamers, and bug bounty hunters detect and prevent attacks using self-hosted runners. The tool requires a GitHub classic PAT for operation. It offers features like code search, enumeration, and automated workflow analysis.
Microsoft reported a 2.75x increase in ransomware attacks year-over-year, but noted improved defenses. Successful encryptions have decreased threefold in two years due to better automatic detection, while unmanaged devices remain a vulnerability in 90% of cases. Akira is the top ransomware variant, followed by LockBit, Play, ALPHV/BlackCat, and Black Basta.
This blog post contains tips for collecting cloud logs. It introduces Wiz's Cloud Logging Framework, which categorizes logs by security use case, mapping logs to either identity, data, network, compute, or control plane. The post highlights the control plane logs by providing tailored tips for AWS, Azure, GCP, and Google Workspace.
This blog post explores how focusing on writing new code in memory safe languages led to a decrease in vulnerabilities in an Android project. It posits that the next stage in security is to focus on safe coding and secure code practices. This is because vulnerabilities decay exponentially so older code will become safer over time, therefore teams should focus on writing new code in memory safe languages and only work on the legacy code when bug fixing.
Leeds Equity has acquired the OffSec certification company.
Amazon says that over 175 million customers are using passkeys for faster and more secure logins.
Finnish and Swedish authorities, with Bitdefender's help, closed down dark web marketplaces Sipulitie and Tsätti, stopping illegal drug sales in the millions.
🧠 AI instantly parses vendor documents and public data against your specific requirements.