Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
WhoYouCalling monitors network activity of processes and creates .pcap files automatically. It simplifies process network monitoring by recording TCP/IP activities and DNS requests. The tool can be used to start and monitor executables, generating detailed reports for analysis.
Dragos has acquired Network Perception, a company specializing in network visibility solutions for OT networks. The acquisition will enhance Dragos' platform by improving network visibility, segmentation, and compliance capabilities. Network Perception's NP-View product helps security teams identify and address risks in OT environments through network topology mapping and firewall rule evaluations.
Microsoft delayed its Recall feature to address privacy and security concerns following an unpopular launch. Recall is now an opt-in feature and can be uninstalled by users. It will also encrypt data and screenshots with keys stored in the TPM and will require Windows Hello to access the keys.
WhatsApp and Cloudflare began their partnership in 2022 by designing the Code Verify tool to verify the integrity of WhatsApp Web clients. In continuation of this partnership, they've released Plexi for key transparency audits. Key transparency audits will now allow WhatsApp users to verify the integrity of the public keys used for end-to-end encryption as a further level of security.
MIT researchers have developed a security protocol that uses quantum light to protect data during cloud-based deep-learning computations. The protocol ensures data security while maintaining 96% accuracy in deep-learning models. By encoding data into laser light, the protocol prevents attackers from intercepting information without detection.
The Browser Company launched an Arc Bug Bounty Program to encourage finding and reporting security flaws.
Europol made four LockBit gang arrests and seized critical servers used by the ransomware group in a joint international operation with the FBI.
Cloudflare has published an analysis of Verizon's outage on September 30 that shows a decline in HTTP request traffic during the outage, with some cities experiencing significant drops in traffic while others saw increases.
Sponsored
Rising tensions between the U.S. and China have the potential to trigger a devastating conflict between nuclear-armed nations. Can it be prevented?
HPE Aruba Networking has fixed critical vulnerabilities in its Access Points that allowed attackers to execute code remotely. Attackers could exploit the flaws by sending specially crafted packets to the PAPI UDP port. Admins are urged to install security updates to prevent potential attacks, with workarounds available for temporary protection.
Cybernews and another security researcher discovered an exposed Elasticsearch instance containing 90M records on French citizens (France has a population of 67.79M). The data seems to have been collected by a data hoarder and comprises data from at least 17 breaches. The data contains full names, phone numbers, physical addresses, email addresses, partial payment information, and other data.
This post describes in detail a vulnerability in Kia's remote activation system that allowed an attacker to remotely control Kia vehicles using just a license plate number. The attack flow involved generating dealer tokens, retrieving victim information, and modifying access to take control of the vehicle. While this vulnerability has been fixed and the the hacking tool was never released or used maliciously, similar vulnerabilities may be present in other manufacturer's systems.
Doyensec conducted a security review for a client's communication platform to prevent phishing and social engineering attacks. Vulnerabilities such as file extension bypass and subdomain crafting were identified and addressed. Recommendations included removing trailing dots in filenames and implementing stricter URL filtering to enhance security.
An automated process hunting for CVEs at scale across all WordPress plugins resulted in 14 new CVEs over three afternoons of work. The process involved downloading and cataloging all WordPress plugins, then running Semgrep on any plugins with recent releases and at least one install. Any findings were then manually reviewed and exploits were attempted. A worked example of the process is included at the end of the blog post.
Sponsored
Does it ever feel like you're just checking pointless boxes, not _actually_ building real-world security?
An experimental proxy that serves static websites as an image to defeat crawlers and scrapers.
Unicorn emulator framework's 2.1.0 release introduces significant performance improvements, including up to 40x faster write speeds and optimized memory allocation. The release brings enhanced cross-platform support, full M1 compatibility, restored Python 2 compatibility, and new or improved bindings for Python, Java, and .NET. Other new features include QEMU logging revival, snapshot memory support, MMU bypass option, and various improvements across different architectures like RISCV and PPC32.
Dna is a static binary analysis framework built on top of LLVM, mostly written in C#. It includes features like control flow graph reconstruction and jump table solving. Dna supports x86_64 architecture but recompiled code is not CET compliant and requires custom patches to build on Windows.
67% of respondents on ISC surveys feel like there is a shortage of staffing and 90% of organizations have a security skills gap, highlighting the fact that cybersecurity professionals at all levels are experiencing burnout. Organizations should take these statistics into account and aid their security teams. CISOs should push boundaries, advocate for their teams, and be cognizant of burnout potential in their organizations.
NIST has released a new draft of SP 800-63-4 that contains Digital Identity Guidelines. Notably, this version bars requirements for security questions, periodic password resets, and forced usage of specific character classes. Other notable inclusions are recommendations to use a 15-character minimum and requirements to accept all printing ASCII characters, accept Unicode characters, and implement a password maximum of at least 64 characters.
Bellingcat has published a new version of its Online Investigations Toolkit based on interviews with practitioners. The new toolkit is divided into categories to make locating tools easier and features in-depth descriptions of the tools, whether they are free or paid, and sample usage. Bellingcat is treating this version as collaborative and will be updating it based on community feedback.
The Irish Data Protection Commission fined Meta €91 million for storing user passwords in a readable format, violating data protection regulations.
Three Iranian hackers associated with Iran's IRGC have been charged by the DOJ for a "hack-and-leak" scheme targeting the 2024 U.S. presidential election.
Kaspersky ICS CERT has published the threat landscape for Industrial Control Systems Computers for Q2 2024.
Sponsored
High-profile data leaks and cyberattacks are a constant reminder that processing, storing, sending, or receiving sensitive content is always a risk.
Cybernews has uncovered an Internet-accessible, passwordless database belonging to MC2 Data, a background check firm. The 2.2TB database contains information on over 100M US citizens as well as the data of the 2.3M users who subscribed to MC2 Data. The exposed data includes extensive personal information.
Many Kaspersky users were shocked to discover that the antivirus software was abruptly removed from their systems and replaced with UltraAV and/or UltraVPN based on their plan. Kaspersky announced that it would be shuttering its business in the U.S. due to a sales and distribution ban. It informed customers via email on September 5 that Pango Group, which owns UltraAV, would provide customers with continued protection, but did not mention the forced installations.
A fake app called WallConnect mimicked the legitimate WalletConnect project on Google Play, tricking over 10,000 users into downloading it. Once installed, the app led users to a malicious website where they were tricked into authorizing transactions, resulting in the theft of sensitive wallet information and digital assets totaling over $70,000 from 150 victims.
Tenable discovered a vulnerability affecting GCP Cloud Composer that could allow for RCE via a dependency confusion attack. GCP suggests in its documentation that customers utilize the --extra-index-url argument when using PyPI packages from a private repository and follows this guidance internally as well. Tenable researchers discovered that when a package with the same name exists in a public and private repository, pip will prioritize the higher versioned package, whether private or public, and will prioritize the public repository if the package is pinned. This allowed Tenable to identify a package used by Cloud Composer that did not exist in the public PyPI repository and create it themselves, which could have led to RCE if used maliciously. Google has remediated the issue by switching to using the --index-url argument.
Amazon has expanded GuardDuty's capabilities by adding a security agent that can collect runtime metrics for EC2 instances. GuardDuty uses the agent to monitor system commands and arguments and uses event correlation to surface findings in 5 new finding types. AWS recommends using these findings in an event-driven architecture to be able to rapidly respond to findings and potential compromise. This blog post walks through sample scenarios and details deployment strategies.
HKDF is a key-derivation function used for cryptographic purposes specified in RFC 5869. It can be FIPS-compliant for key-agreement and general purposes with specific guidelines outlined in various NIST standards. HKDF-Extract combines keys and data, while HKDF-Expand serves as a general-purpose key-derivation function.
Sponsored
Trustero's patented AI suite unlocks superpowers for GRC teams. To see it in action, watch the GRC leaders on-demand session: _Unlocking the Real Value of AI in Compliance_ [12]. Prefer to work hands-on? Try Trustero's AI questionnaire automation, AI audits, and the AI report scanner — start free with 2x the AI credits [11].
CloudShovel is a tool that scans public or private AMI for sensitive files and secrets.
Jenganizer is a tool that maps hidden services in AWS. It does this by following the triggered events of users' actions. When a user performs an action in AWS, it can trigger other events in other services. By following these events, users can identify services that are indirectly deployed by their actions.
Monocle is a tool that uses a large language model to search compiled binaries for specific code like encryption or vulnerabilities. It provides live tracking of analyzed functions and their scores based on search criteria.
AWS' WAF team announced a set of enhancements to the bot control managed rule group. AWS added token reuse detection across ASNs and geographic locations with customizable sensitivity levels. It also added new bot categories, labels for cloud service providers, and labels for automated browser extensions such as Selenium IDE. WAF labels will be emitted in CloudWatch logs for each rule to enhance visibility.
In the wake of years of lackluster security performance, Microsoft CEO Satya Nadella announced that security would be the company's number one priority. To this end, Microsoft announced the Secure Future Initiative at the end of 2023 and has now provided an update on actions that they have taken. Microsoft took sweeping actions to improve security such as including security in employees' performance evaluations, making updates to its Entra ID and MSA systems, making updates to its CVE processes, tracking over 99% of its physical network, and reducing internal access privileges.
The Russian APT Tool Matrix project focuses on tools commonly used by Russian APT groups for intrusions. Defenders can enhance their proactive defense strategies against Russian threat actors by identifying key tools and patterns. This repository highlights the use of specific tools like Mimikatz and Impacket by multiple Russian threat groups.
AWS has launched a new Vulnerability Disclosure Program on HackerOne.
A House committee approved a bill to include AI systems in the National Vulnerability Database for tracking cybersecurity vulnerabilities.
Tails OS and the Tor Project are joining forces to enhance internet privacy and security by protecting users from surveillance and censorship.
Sponsored
Orca Security has published its new State of AI Security Report. This research report is based on findings from billions of cloud assets scanned by Orca's agentless cloud security platform [5] on AWS, Azure, Google Cloud, Oracle Cloud, and Alibaba Cloud.
Dell has announced that it is investigating a data breach after a hacker posted an alleged data dump to BreachForums. The data breach contains data of 10k employees' full names, unique identifiers, employee status, and internal identification strings. Neither Dell nor the hacker have disclosed how the data was stolen.
A security researcher has discovered a vulnerability in the Arc browser that could lead to RCE on other users. The Arc browser has a feature called Boosts that allows arbitrary CSS and JavaScript to run and modify websites in users' browsers. The vulnerability arises from improper ACLs on The Browser Company's Firebase data store, which allows attackers to apply Boosts to different users' browsers by changing the user ID that they are attached to. An update has been pushed and The Browser Company has committed to improving its security posture.
A new version of the Necro Trojan has infected popular apps on Google Play and unofficial sources, impacting over 100 million devices worldwide. The malware used obfuscation to evade detection and had the ability to display ads, download files, and execute JavaScript code. Google Play removed the malicious loader from affected apps following reports of the issue.
PowerShell Script Block Logging is one of the types of PowerShell logs that records the content of all script blocks executed within PowerShell. ScriptBlock Smuggling is a technique whereby an attacker can hide a malicious script block within a benign script block. This post tests detections for this attack in a lab environment using a test script from AtomicRedTeam. The author notes that the full script, which contains the malicious command, can still be seen in the details pane and questions the usefulness of this attack.