Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The Chrome Security team describes how they evaluate and prioritize security improvements based on how they reduce potential harm to users and increase costs for attackers, considering factors like bug reliability, ease of exploitation, and impact across Chrome's large user base.
Microsoft, Adobe, and Apple have released security updates to fix numerous vulnerabilities, including active attacks on Windows and other software.
Lua malware has been discovered in fake game cheats and is spread globally through techniques like SEO poisoning.
Sponsored
Remote work introduces security risks that jeopardize your company's data and operations - from unvetted software and shadow IT to vulnerable home networks and public Wi-Fi.
A serious flaw in the WordPress LiteSpeed Cache plugin affecting versions up to 6.5.0.2 could allow attackers to run harmful code. The vulnerability allows for arbitrary script injection when certain settings are enabled, potentially leading to account hijacking and site takeover. The issue was fixed in version 6.5.1, but site admins should act quickly to secure their websites.
Researchers discovered 14 security vulnerabilities, dubbed DRAY:BREAK, in DrayTek routers used in homes and businesses. These flaws could allow attackers to take control of affected devices, potentially gaining access to enterprise networks. The vulnerabilities range in severity, with two rated critical, including one with the highest possible CVSS score of 10.0.
Comcast revealed that data on over 200K customers was stolen in February in a ransomware attack on its former debt collector, FBCS. The company learned in July that customer information was compromised, including names, addresses, SSNs, and account details from around 2021.
This blog post describes an investigation using OSINT tools that uncovered a disturbing online CSAM marketplace run by 'JoeHaze'. Despite challenges with law enforcement response, efforts were made to gather evidence and report the predator to authorities for further action. The importance of protecting children from online predators was emphasized throughout the investigation.
Dangerzone is a software that sanitizes potentially risky documents by detonating them in a container, creating a pixel map of the document, then converting that image back to a document. Prior to version 0.7.0, Dangerzone relied on Linux containers that are hardened via removing process and network capabilities, minimal user ID mapping, and syscall filtering via seccomp. To address gaps in its security posture, Dangerzone integrated with gVisor, which is an application kernel that has minimal privileges. To enable multiplatform support, Dangerzone implemented a nested container strategy where the outer container runs as a compatibility layer and the inner layer runs the gVisor and Dangerzone logic.
Detection Engineering is a concept that emphasizes the importance of managing the workload and complexity of a detection stack. Prioritizing detection projects involves focusing on foundational steps, collaborating on high-quality detections, and managing the work involved in detection engineering. By intentionally addressing operational management challenges and avoiding premature staffing, a successful detection program can be developed with thoughtful planning and strategic implementation.
Sponsored
Don't miss out on your chance to register for DevSecCon 2024! From the exciting lineup of 20+ sessions, here's one that you can't skip:
A domain name permutation and enumeration library powered by Rust.
Apono provides organizations with an understanding of privileged access within their cloud environments, enforces robust security guardrails, and leverages AI-driven least privilege and anomaly detection capabilities to enhance security measures.
Venator is an open-source threat detection platform that simplifies rule management and deployment using K8S CronJobs or Helm. It can also be run standalone or with other job schedulers like Nomad.
Ireland's Data Protection Commission launched an inquiry into Ryanair's customer verification process, focusing on its use of facial recognition technology and biometric data. The investigation stems from complaints about additional ID checks for third-party bookings.
The manufacturing industry has become the top target for ransomware attacks, accounting for 21% of incidents. A study by Black Kite reveals that 80% of manufacturing companies have critical vulnerabilities, with 67% listed in CISA's Known Exploited Vulnerabilities catalog.
This post contextualizes Wiz's new AppSec offerings via Wiz Code within Wiz's product line and the CNAPP and ASPM industries. Wiz Code offers SCA, secrets scanning, and IaC scanning, which largely already existed via the WizCLI, but with Code the UX is tied together more succinctly and scanning can be done via a GitHub integration (pipelineless). Wiz Code is a nice add on for Wiz customers and shows promise for the CNAPP space but lags behind full ASPM providers or industry leading AppSec products.
Sellafield, a UK nuclear site, was fined $440,000 for cybersecurity failures that exposed sensitive information.
Google removed Kaspersky's security apps from the Play Store and suspended its developer accounts due to restrictions imposed by the U.S. Department of Commerce.
A group linked to China, called Salt Typhoon, hacked U.S. broadband providers like Verizon and AT&T, potentially accessing systems for lawful wiretapping.
Sponsored
The information security landscape is constantly changing, which is why it's important to have a scalable and secure strategy that evolves alongside it. Vanta's GRC implementation guide [4] can provide your organization with a structured, proactive approach to managing its IT security that helps your business meet its goals.
Zimbra has disclosed a new RCE vulnerability in its SMTP server. The vulnerability arises from improper sanitation, which can lead to a maliciously crafted CC line being executed as shell commands by the server. Researchers at Proofpoint report that there have been attacks since September 28 attempting to exploit this vulnerability and urge immediate patching.
A new Linux malware called Perfctl is targeting millions worldwide by mimicking system files to avoid detection. This sophisticated malware compromises Linux servers for cryptomining and resource hijacking, using rootkit and evasion techniques to hide its presence. To protect your Linux systems, update regularly, conduct vulnerability assessments, and use security tools like firewalls.
Over 4,000 Adobe Commerce and Magento e-stores were hacked due to a critical vulnerability, CosmicSting (CVE-2024-34102), which allows attackers to execute arbitrary code. The attacks have impacted major organizations and resulted in the installation of payment skimmers on victim stores. Merchants are urged to update their systems immediately to protect against these exploits.
Opaque predicates are a conditional expression that the programmer knows the answer to but chooses to check anyway. They can be utilized to obscure the control flow for anti-reversing. This post utilizes the MIASM Python library to create an IDA Pro plugin to detect and patch unreachable blocks. The plugin utilizes the Symbolic Execution engine to detect opaque predicates and then patches them with NOPs.
This blog post discusses how to hack Cloudflare R2 buckets to discover sensitive files. Begin by utilizing Google dorking and examining HTTP requests to discover R2 buckets. Exploitation can then be done via abusing missing or improper authorization checks or finding exposed R2.dev buckets.
This blog post explains how to gather information on threat actors, using Telegram API to identify them and attribute malware samples. It demonstrates steps to intercept data exfiltrated by malware through Telegram and Discord, including obtaining bot tokens, chat IDs, and forwarding messages for analysis. The post provides scripts and examples for interacting with Telegram bots and Discord webhooks to monitor and analyze malware activities in real time.
Sponsored
You don't have to put your career on hold to get a high quality education. With 100% online classes, and six 8-week terms a year, SNHU offers the flexibility you need to take the next step. Find your InfoSec degree today [11] (US based students only)
Supernova is a tool for advanced encryption and obfuscation of raw shell code.
Ax is a framework that utilizes packer files to prepare base images to deploy across multiple cloud providers for penetration testing or bug bounty hunting.
Lambda Watchdog continuously scans Lambda images for vulnerabilities.
Google has added new security features to its latest Pixel devices to protect against baseband security attacks. These attacks exploit vulnerabilities in cellular baseband software to compromise device security. The new Android 14 update also includes measures to prevent unauthorized network connections and alert users to potential surveillance threats.
Bank of America customers nationwide faced an outage with $0 balances in their accounts, causing widespread concern. Over 19,000 people reported the issue, which mainly affected online and mobile banking services. Despite technical problems, Bank of America assures that the issues have been largely resolved.
Differential fuzzing uses multiple implementations to compare outputs for finding bugs like logic errors and incorrect computations, beyond just memory bugs and crashes. LibAFL is a tool that helps with custom input generation for differential fuzzing, allowing for more efficient bug discovery in cryptographic implementations. The quality of input generation and harness design is crucial for a successful fuzzing campaign, highlighting the importance of testing edge cases while restricting the test range to what the target can handle.
Cloudflare successfully blocked the largest recorded DDoS attack, which reached 3.8 terabits per second.
INTERPOL arrested eight people in West Africa for phishing and romance fraud involving Swiss citizens that led to $1.4 million in losses.
Fake trading apps targeting crypto investors on Apple and Google Play Stores have been discovered.
Sponsored
If you had a sneaking suspicion that dev teams are rushing ahead with AI and that it's often at the expense of security… you were correct. Orca Security's new research report reveals that:
The FCC has announced a settlement with T-Mobile over a string of data breaches that impacted customers from 2021 to 2023. Half of the settlement will be used for cybersecurity enhancements and the other half will be paid to the U.S. Treasury as a penalty. T-Mobile has committed to introducing modern security practices such as zero trust and MFA as part of the settlement.
Rackspace suffered a breach on its internal monitoring dashboard that resulted in the company needing to take it offline briefly. Rackspace has stated that only the monitoring dashboards were affected, not monitoring and alerting systems generally, and that only a limited amount of data was accessed. The attackers monitoring information that was available to the attackers included customer account name and numbers, customer usernames, internally generated device names IDs, name and device info, and encrypted internal device credentials. Rackspace says that the breach was caused by an RCE 0-day in a third party system.
AFP News Agency's content delivery systems were hit by a cyberattack, disrupting its ability to distribute news to clients. Despite the attack, AFP's news reporting remains uninterrupted, with technical teams working to restore full services and secure compromised credentials. The incident highlights ongoing concerns about cybersecurity in France. Experts are investigating the attack and urging partners to enhance security measures.
BPOs are often utilized to provide a large group of contractors for outsourcing certain tasks like customer service. Onboarding BPOs can be complicated in a zero-trust environment as zero-trust tools often rely on managed devices, but providing managed hardware to a BPO can prove prohibitively expensive. This post provides a number of options that can be considered. Cloud jump boxes, isolated browsers, managed devices, and managed VMs all provide methods of accessing resources in a way that can still tie into an organization's standard zero-trust procedures. If these solutions are impractical, an organization could consider using posture-based exclusions or implementing exclusions to still allow BPOs to access a limited set of data.
Traditionally, XSS vulnerabilities are difficult to detect with tools like Nuclei as the tester needs to write a complex set of matchers to check if the payload is reflected in the response. Nuclei headless mode allows testers to configure templates to mimic real user actions on a webpage. When combined with the waitdialog action, a template can be instructed to wait for a dialog box and a matcher can be configured to check if the expected message appears in the dialog. This also enhances accuracy as in the traditional method there's no way to ensure that the script was triggered.
This post discusses how the SLSA framework can enhance software supply chain security by providing a standard for verifying the creation process of open-source software artifacts. The standard offers different compliance levels, with Level 3 providing the highest security through rigorous build platform hardening. Adoption of SLSA can help prevent attacks on build and distribution processes, but integrating the framework into package distribution tools is crucial for maximizing its benefits.
Sponsored
October is cybersecurity awareness month — and Security Journey is offering free training programs for developers who work with APIs [13], covering the OWASP Top 10 API Security Risks. This expertly-crafted, 12-lesson learning path is perfect for individual
Segugio is a DFIR tool that extracts IoCs from malware by tracking the critical steps in the malware detonation process.