Search the archive

Get your first vendor risk review for free, in 2 minutes.

P.S.: Use the links above to book a qualified demo and get a 20% DISCOUNT on Auditive before EoY 2024.

POKÉMON DEVELOPER GAME FREAK REPORTEDLY HACKED, STOLEN DATA ON UNANNOUNCED GAMES AS WELL AS NINTENDO SWITCH 2 CODENAME LEAKED ONLINE

Game Freak has confirmed that a data breach affecting 2,606 employees' information occurred in August. Earlier reports suggested the leaked data included codenames for future Pokémon games, Nintendo Switch 2, and other confidential information.

HACKERS TOOK OVER ROBOVACS TO CHASE PETS AND YELL SLURS

Ecovacs' Deebot X2 Omni robotic vacuums were hacked across US cities, with attackers using them to harass pets and owners with racist slurs. Ecovacs identified a credential stuffing event and blocked the IP address, but found no evidence of stolen user credentials.

FIDELITY SAYS DATA BREACH EXPOSED PERSONAL DATA OF 77K CUSTOMERS

Fidelity Investments has disclosed a data breach that resulted from a third party accessing information from its systems between August 17 and August 19 using two customer accounts that they created. According to data breach filings, the attacker was able to access customer data by making fraudulent requests against an internal database and retrieving images of documents pertaining to Fidelity customers. Fidelity disclosed that the breached data includes customers' social security numbers and driver's licenses.

INNOVATIVE SECURITY SOLUTIONS: KEY INSIGHTS FROM PASSWORD MANAGEMENT RESEARCH

This blog covers the latest research on password security, with new compelling ideas, unexpected discoveries, and questions for future exploration.

1 BUG, $50,000+ IN BOUNTIES, HOW ZENDESK INTENTIONALLY LEFT A BACKDOOR IN HUNDREDS OF FORTUNE 500 COMPANIES

This 15-year-old bug hunter discovered a critical Zendesk vulnerability that affected Fortune 500 companies. The bug exploited weak email validation in Zendesk's ticket system, allowing attackers to spoof emails and access sensitive support conversations. This security gap exposed companies using Zendesk for customer support to potential breaches of confidential information.

MITIGATING ATTACK VECTORS IN GITHUB WORKFLOWS

A comprehensive guide from OpenSSF on various GitHub Workflows vulnerabilities and their mitigations. The guide covers running untrusted code in privileged workflows, code injections, vulnerable actions, malicious releases, tag-renaming attacks, imposter commits, and unsafe use of caches. It concludes by introducing the OpenSSF scorecard CLI tool and GitHub Action, which can be used to check for these vulnerabilities in a GitHub Workflow.

👉 Reserve your seat.

BREACHRX (PRODUCT LAUNCH)

BreachRx automatically generates tailored incident response plans and provides targeted guidance to relevant stakeholders through every step of the process.

PYWALL

A small app that makes it easy to administrate simple firewall configurations.

POLYDROP

Polydrop is a Bring-Your-Own-Script-Interpreter toolkit that leverages 13 different scripting languages to deploy via trusted applications and evade detection by most AV and EDR solutions, including MS-Defender.

LOLRMM: A UNIFIED APPROACH TO RMM SOFTWARE MANAGEMENT

Living Off the Land: Remote Monitoring and Management is a project that aims to systematically catalog remote monitoring and management software. It aims to provide defenders with IoCs of software to watch out for in their environment. The project is looking for community contributors.

CAN YOU RUN AN AWS COMMAND FROM SLACK WITHOUT ANY AWS CREDENTIALS?

AWS ChatBot is an AWS service that's designed to be used with messaging services (Teams, Slack, etc) to monitor and respond to AWS events. The service can be configured using a Channel Role which will give all members of the channel the same permissions without requiring AWS credentials. If this is combined with a permissive Channel Guardrail policy, any user will be able to execute AWS CLI commands in the configured account without any permissions.

FBI CREATED A CRYPTOCURRENCY SO IT COULD WATCH IT BEING ABUSED

The FBI created its own cryptocurrency to catch fraudsters in a global scheme that involved manipulation and wash trades. The fraud involved creating a false market signal to inflate prices and profit from selling assets. Several individuals have been charged in the crypto fraud case across multiple countries.

EU ADOPTS CYBER RESILIENCE ACT

The EU has officially adopted the Cyber Resilience Act, which introduces cybersecurity requirements for products with digital elements.

AI GIRLFRIEND SITE BREACHED, USER FANTASIES STOLEN

A hacker stole a database of users' interactions with AI chatbots from the Muah.ai site.

OPENAI CONFIRMS THREAT ACTORS USE CHATGPT TO WRITE MALWARE

OpenAI confirms cyber threat actors are using ChatGPT to develop malware and enhance offensive operations.

👉Get NordPass for your business with 35% off

MARRIOTT AGREES TO PAY $52 MILLION SETTLEMENT AFTER MULTIPLE DATA BREACHES

Marriott agreed to a $52 million settlement with 49 states over data breaches affecting 334 million customers between 2014-2020. The breaches were attributed to poor security practices, including inadequate password controls and outdated systems. One incident in 2020 resulted in 20GB of stolen data.

THE INTERNET ARCHIVE SLAMMED BY DDOS ATTACK AND DATA BREACH

The Internet Archive suffered a security breach that exposed 31 million email addresses and usernames. It also suffered a separate DDoS attack. The organization has addressed these issues and plans to share more information as it becomes available.

INDIA'S STAR HEALTH CONFIRMS DATA BREACH AFTER CYBERCRIMINALS POST CUSTOMERS' HEALTH DATA ONLINE

Star Health, one of India's largest insurance companies, has confirmed a data breach after hackers created Telegram chatbots that leaked personal data belonging to 31M customers. The leaked data included full names, phone numbers, addresses, tax details, claims information, and customer ID cards. Star Health has not confirmed whether customer data was leaked and is suing Telegram and Cloudflare due to the hackers making use of their products.

A FEW NOTES ON AWS NITRO ENCLAVES: ATTACK SURFACE

AWS LETSENCRYPT LAMBDA OR WHY I WROTE A CUSTOM TLS PROVIDER FOR AWS USING OPENTOFU AND GO

This developer wrote a Lambda function that utilizes LetsEncrypt to create and renew TLS certificates that are more portable without relying on AWS Certificate Manager. The function takes in an event from a manual run or Event Bridge, requests a certificate from LetsEncrypt, creates a new TXT record in Route53 if needed for verification, and then optionally stores it in AWS Secrets Manager. The source code for the Lambda function and OpenTofu/Terraform module is provided.

USING CHROME'S ACCESSIBILITY APIS TO FIND SECURITY BUGS

Chrome is using accessibility APIs to find security bugs in its user interface code. By fuzzing the accessibility tree of UI controls, the Chrome team hopes to automatically discover and fix potential vulnerabilities. This approach aims to improve Chrome's overall security and stability for all users.

SBOMQS

sbomqs is a tool for assessing an SBOM's quality and compliance. The higher the score, the more consumable and compliant your SBOMs are.

SLACK WATCHMAN

Slack Watchman is a tool for monitoring and enumerating Slack Workspaces for secrets.

NAMELESS C2

Nameless C2 is a Rust-based Windows C2 implant that is only 256kb in size.

SMART TVS ARE SPYING ON EVERYONE

Smart TVs and streaming services are collecting extensive viewer data using advanced surveillance techniques. This includes personalized ads, content recognition, and AI-based targeting. A report by the Center for Digital Democracy criticizes these practices as undermining privacy and forcing unfair terms on consumers to access video content.

AUSTRALIA INTROS ITS FIRST NATIONAL CYBER LEGISLATION

Australia has introduced the Cyber Security Bill 2024, aiming to establish security standards for smart devices, ransomware reporting, and cybersecurity incident coordination. It proposes a Cyber Incident Review Board, reforms to the SOCI Act, and information-sharing protocols.

TOP 5 SOC ANALYST CERTIFICATIONS FOR 2024

The post compares the CompTIA CySA+, TCM Security PJSA, Security Blue Team BTL1, HackTheBox CDSA, and the OffSec OSDA. Summaries are provided for each section, with an infographic presented at the end.

THE STATE OF ATTACKS ON GENAI

This report, based on real-world analysis of more than 2,000 AI applications, found that 90% of successful attacks resulted in the leakage of sensitive data.

CISA OFFICIAL: AI TOOLS ‘NEED TO HAVE A HUMAN IN THE LOOP'

CISA's Chief AI Officer emphasizes the importance of having humans involved in AI tools for cybersecurity.

LAMBORGHINI CARJACKERS LURED BY $243M CYBERHEIST

↗️ Get your free genAI inventory

AMERICAN WATER, THE LARGEST WATER UTILITY IN US, IS TARGETED BY A CYBERATTACK

American Water, the largest U.S. water utility, reported a cyberattack on Thursday. The company paused billing and shut down certain systems but believes facilities and operations weren't affected. It is working with law enforcement to investigate the incident's scope.

GORILLABOT GOES APE WITH 300K CYBERATTACKS WORLDWIDE

A new Mirai variant called GorillaBot launched 300,000 DDoS attacks last month, affecting 20,000 organizations worldwide. It employs 19 attack methods, primarily UDP and TCP ACK Bypass floods. The botnet, which supports multiple architectures, targeted organizations in 113 countries, with China and the US most affected.

5.11 TACTICAL SUFFERED A DATA BREACH

5.11 Tactical, which mashes tactical equipment that is favored by local and national law enforcement agencies, suffered a data breach. In a filing with the Maine Attorney General, 5.11 Tactical disclosed that 27,742 individuals who purchased products online between July 12 to August 22 may have had their information exposed. Exposed information includes full names, email addresses, payment card numbers, payment card expiration dates, and payment card security codes.

INVESTIGATING INFRASTRUCTURE AND TACTICS OF PHISHING-AS-A-SERVICE PLATFORM SNIPER DZ

The Phishing-as-a-Service platform Sniper Dz has been detected using over 140,000 unique phishing websites. It uses various techniques to hide its malicious activity such as utilizing proxymesh[.]com to hide backend servers, obfuscating template code, abusing legitimate SaaS platforms, and employing malicious redirects. Sniper Dz offers these services free of charge on its platform and also provides a centralized infrastructure for exfiltrating credentials and tracking victims.

EXPLOITING TRUST: WEAPONIZING PERMISSIVE CORS CONFIGURATIONS

Websites can employ CORS to allow for sharing of data to a different website, bypassing same-origin restrictions. This blog post presents a collection of case studies that showcase CORS misconfigurations that can be exploited such as arbitrary reflected origin, only checking the beginning of the Origin header, trusting related subdomains or localhost, and other more complicated techniques. Advice to pentesters hunting for CORS vulnerabilities includes making sure to scan all endpoints, considering related domains, applying context to findings, and testing for subdomain reflection.

DOCKER CONTAINERS SECURITY

This is a series of articles that describe how Docker Container Security works, how to exploit vulnerabilities as well as how to fix and secure your Docker deployment. Another series on Linux Privilege Escalation as well as some fundamental understanding of Docker are prerequisites for this course.

LYNIS

Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening.

TAMNOON (PRODUCT LAUNCH)

Tamnoon combines purpose-built AI technology for cloud remediation, guided by cloud security experts, to safely reduce critical threat exposures.

GHOSTPORT

Ghostport is a tool that misleads port scanners by responding with convincing signatures.

HUGE HACK SHUTS DOWN RUSSIAN ONLINE STATE MEDIA ON PUTIN'S BIRTHDAY

Ukrainian-linked hackers reportedly conducted an "unprecedented" cyberattack on Russian state broadcaster VGTRK, disabling online broadcasting and internal services, on Putin's birthday. The Kremlin expressed support and is investigating the incident.

APPLE FIXES BUGS IN MACOS SEQUOIA THAT BROKE SOME CYBERSECURITY TOOLS

Apple has released macOS 15.0.1, addressing compatibility issues with third-party security software that arose in the initial Sequoia release. The update reportedly fixes networking problems that affected products from CrowdStrike and Microsoft.

VULNERABILITY MANAGEMENT ISN'T ABOUT FINDING ISSUES - IT'S ABOUT FIXING THEM

Most vulnerability management tools only handle the simplest portion of vulnerability management - finding vulnerabilities. Most tools don't have enough context to provide helpful remediation advice for practitioners to take action on their findings. The future of vulnerability management tools will include a set of AI agents that constantly build up context and state of the environment to not only find vulnerabilities, but pinpoint everywhere that they're in use and how they could be fixed.