Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Temu denied being hacked or having a data breach after a threat actor claimed to have stolen 87 million customer records. It says the stolen data does not match the company's own data. Users should take precautionary steps like enabling two-factor authentication and changing passwords.
Two critical vulnerabilities in VMware vCenter Server and Cloud Foundation products allow attackers to execute remote code and escalate privileges. VMware has advised customers to patch affected systems immediately by upgrading to specific versions or applying the async patch. These flaws impact versions 7.0 and 8.0 of vCenter Server and versions 4.x and 5.x of Cloud Foundation.
The Maids International experienced a data breach that exposed sensitive consumer information like Social Security numbers and health data. It took steps to investigate and notify affected individuals. Consider seeking help to protect yourself from potential fraud or identity theft.
Apache's HTTP server's modular design opens it up to vulnerabilities as the request_rec structure gets passed around to different modules, which may mutate it and interfere with how a module further downstream expects it to be, leading to confusion attacks. Most modules treat the filename parameter as a system path but some treat it as a URL. This leads to path truncation vulnerabilities in mod_rewrite and ACL bypass in mod_proxy. mod_rewrite will always load the path from both the DocumentRoot and root directory, which can lead to source code disclosure or LFI, XSS, and even RCE via local gadget abuse and jailbreak. A legacy code snippet that allows for the Content-Type to override the Handler causes handler confusion, which can lead to SSRF, information disclosure, and RCE.
LinkedIn developed a tool called Security Posture Platform (SPP), which provides a graph database and GraphQL API to answer questions about security posture in the organization. To enhance usability by allowing for natural language querying, LinkedIn added an AI layer to SPP. This post describes the process and data engineering used to achieve 85-90% accuracy with LinkedIn's AI.
This blog post explores deserialization attacks, focusing on how to identify and exploit vulnerabilities in applications that handle serialized data. It provides a step-by-step guide on how attackers can inject malicious code through deserialization, ultimately gaining control over the application's functionality. The author emphasizes the importance of understanding these attacks to enhance security practices during code review engagements.
Sponsored
You don't have to put your career on hold to get a high quality education. With 100% online classes, and six 8-week terms a year, SNHU offers the flexibility you need to take the next step. Find your InfoSec degree today [11] (US based students only)
This resource provides a list of configurable payloads for bypassing URL validations.
Fibratus detects, protects, and eradicates advanced adversary tradecraft by scrutinizing and asserting a wide spectrum of system events against a behavior-driven rule engine and YARA memory scanner. Events can be shipped to a wide array of output sinks or dumped to capture files for local inspection and forensics analysis. Users can use filaments to extend Fibratus with their own arsenal of tools and so leverage the power of the Python ecosystem.
OPAL is an administration layer for Policy Engines, such as Open Policy Agent (OPA) and AWS' Cedar Agent. It detects changes to both policy and policy data in real time and pushes live updates to agents. OPAL brings open-policy up to the speed needed for live applications.
This post provides a comprehensive look at the cloud security and CNAPP landscape. It begins with a history of cloud security before diving into the agent vs agentless debate. Agent based scammers can provide more granular insights and provide runtime protection but can be difficult to deploy and may have performance issues. Agentless scanners are quick to deploy but generate a lot of false positives and are not suited to containerized workloads. CNAPP stifles innovation while being too bloated to be useful due to trying to cater to cloud security engineers and developers, who are both looking for fundamentally different things. The future of CNAPP is a convergence between vulnerability management, posture scanning, runtime detection, and response.
In the wake of the disastrous CrowdStrike outage, Microsoft met with industry leaders to discuss security features that could be added to Windows to enable endpoint security vendors to move their products out of the kernel. Many vendors championed this as a productive endeavor and appreciated the collaboration from Microsoft. Others, like Cloudflare CEO Matthew Prince, cautioned the move as potentially leading to an unfair market where only Microsoft has access to the kernel. Microsoft has not mentioned locking vendors out of the kernel since 2006.
Maxwell Dulin's team won the Industrial Control Systems (ICS) Capture the Flag (CTF) competition this year with a 37% lead over the next team. In this blog post, Dulin shares the team's winning strategies, which include focusing on in-person challenges during the day and solving offline challenges at night. Dulin's favorite challenge was turning on the lights for a smart city, which involved spoofing a device to control the lights.
Apple has announced that it will extend Activation Lock to iPhone parts in iOS 18 to deter theft.
A former Ticketmaster boss has been sentenced after pleading guilty to illegally accessing computer servers of a rival company and stealing sensitive business information.
A Chinese man, Song Wu, used fake emails to steal sensitive information from NASA and other U.S. government agencies.
Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.
tackles this head-on, by quickly identifying and quarantining these “zombies” lurking in your AWS environment!
Sponsored
Did you know less than 10% of cloud identities with sensitive cloud
Last week, a threat actor posted credentials to an S3 bucket containing 440GB of files allegedly stolen from a Microsoft Sharepoint server belonging to Fortinet. Fortinet has confirmed that it experienced a breach due to an exposed third-party cloud-based file drive. It has stated that the breach only affects 0.3% of customers.
The North Korean Lazarus hacking group launched a campaign where it approached Python developers with a coding interview challenge. The candidates were tasked with finding and fixing bugs in a password manager application that pulled in two malicious PyPi packages that executed an obfuscated C2 payload in their __init__.py. Candidates were rushed to complete the assignment due to tight deadlines listed in the README file that may have led to them skipping some security checks.
Researchers have developed a new exploit, dubbed GAZEploit, that uses a neural network to detect Vision Pro users' passwords based on the eye movements reflected in their avatars' faces when the on-screen keyboard is pulled up. The researchers managed to achieve an 85.9% precision rate and 96.8% recall rate in their test of 30 users. Apple has fixed this vulnerability by disabling avatars while the virtual keyboard is pulled up.
This post provides a primer on finding vulnerabilities in MSI files. It begins with an overview of the MSI file format and details the tables that may be relevant. It then covers ways to enumerate MSI files and common attack vectors such as abandoned credentials, custom actions, and GUI escapes. The post also provides examples of utilizing tools to automate the procedure as well as a tool that they wrote.
Jeff Sims, a frontier AI/ML cyber researcher, shares a timeline of his research on offensive AI agents, including BlackMamba, EyeSpy, and Red Reaper. These AI systems demonstrate the potential for adversarial use of AI technology and the need for awareness in the field. Sims' research focuses on developing advanced offensive AI agents capable of self-training and targeting other AI systems.
OpenSSH 9.5 added keystroke timing obfuscation to prevent traffic analysis attacks. The feature hides keystroke timings and floods chaff packets to obscure real keystrokes. This blog post walks through how analyzing packet sizes can reveal keystrokes and their types, aiding in traffic analysis.
RunReveal has released Sigmalite, an open-source sigma rule evaluator for detection, under the Apache 2.0 license for stream processing. Sigmalite allows security teams to use sigma rules for detections outside of their SIEM, providing flexibility in log processing and detection. By integrating Sigmalite into its pipeline, RunReveal aims to offer customers the ability to easily create, validate, and run sigma detections for better log management and correlation.
Bomctl is a new tool within OpenSSF that helps manage Software Bill of Materials (SBOMs) for developers. It aims to simplify handling SBOM documents by providing a command-line interface for retrieving, storing, and manipulating component information. Bomctl supports complex SBOM operations and aims to facilitate integration with existing SBOM tooling ecosystems.
The Bounty Hunter plugin for Caldera enhances emulation by simulating realistic cyberattack chains. Existing tools that automate assessments can be limited and predictable. bountyhunter uses real-world attacker tactics to emulate realistic scenarios.
The Port of Seattle was attacked by Rhysida ransomware, causing disruptions to critical systems like reservation check-in and flight delays. The ransomware gang demanded payment, but the Port refused, choosing to restore affected systems instead. Rhysida is known for targeting various industries and has been linked to attacks on healthcare organizations and other high-profile targets.
Google is making changes to Chrome to switch from supporting the Kyber algorithm to the new ML-KEM algorithm for post-quantum key exchange. The switch is necessary due to the standardization of ML-KEM and incompatibility with the previous version of Kyber. Server operators can temporarily support both algorithms to maintain post-quantum security while clients update their implementations.
The blog post explains how to acquire and decrypt samples of a malicious browser extension using free resources and simple cryptanalysis techniques. By leveraging services like urlscan, the author was able to identify potentially malicious domains and scripts used by the malware. The analysis revealed active and potentially harmful domains, highlighting the importance of monitoring and detecting malicious activities online.
23andMe will pay $30 million in cash to settle a lawsuit over a data breach that affected 6.4 million customers in 2023.
This article dives into the shadowy world of how the overlap between harm communities and cybercriminals is causing real-world violence and extortion schemes.
The FBI and CISA warn against false claims of hacked voter data to manipulate public opinion and undermine confidence in U.S. democratic institutions.
Sponsored
VPENTEST automates network penetration testing [4], helping IT teams exploit vulnerabilities before the bad guys do and can validate your current security controls. It cuts costs by 50% compared to manual testing, increases testing frequency from yearly to monthly, and helps you meet compliance and cyber insurance requirements with detailed, actionable reports.
KemperSports has reported a data breach that was detected on April 1 to Maine's Attorney General. Unauthorized access to its network exposed consumers' names and Social Security numbers. KemperSports is now notifying affected individuals.
CMS has reported a data breach affecting over 946,000 Medicare beneficiaries. The breach occurred in May 2023. Hackers exploited a vulnerability in MOVEit software used by WPS, a CMS contractor. Although patched promptly, the vulnerability led to widespread data breaches across multiple sectors before being resolved.
A new malware called Vo1d has infected over 1.3 million Android TV streaming boxes, giving attackers full control. Researchers found the malware in devices across 200 countries, with the highest numbers in Brazil, Morocco, and Pakistan. To protect against this threat, users should update firmware regularly and avoid installing apps from unofficial sources.
This blog explains how its authors acquired the expired domain dotmobiregistry.net, formerly used for .MOBI WHOIS queries. They set up a WHOIS server, which received 2.5 million queries from various sources, and discovered that Certificate Authorities were using the server to validate domain ownership for TLS/SSL certificates, potentially compromising the security of the entire .MOBI TLD.
This article walks through the process of deobfuscating a .vbs loader for Nanocore malware. The deobfuscation begins by using a regex to filter out comments in the obfuscated loader. It involves alternatively adding or dividing long decimal numbers with hexadecimal numbers to obtain char codes that are concatenated to form the code. The CyberChef script utilizes reflexes and capture groups to isolate the various components of the obfuscated code followed by Subsections to handle the alternating mathematical operations.
This blog post is a deep dive into mechanisms for stealing application access tokens and detection and mitigation strategies. It begins by exploring how access tokens are used and provides examples of how to use tools like AADInternals and Peirates along with some examples of how APTs steal tokens. The post then suggests methods for detecting access token compromise in Azure and provides a sample query to run to search for compromise. It provides mitigation techniques such as auditing logs and specific recommendations for ways to restrict web-based content on AWS, GCP, and Azure.
Spix automates advanced attack scenarios, including hallucinations, prompt injections, and off-topic conversations, to help AI security teams identify threats and vulnerabilities before they can be exploited.
OpenShield is a transparent proxy that sits between your AI model and the client. It provides rate limiting, content filtering, and keyword filtering for AI models.
EDR Artifacts is a catalog of network and host artifacts that are used by various EDR products' response capabilities.
The FBI's annual report reveals that crypto-related cybercrime in the US led to over $5.6 billion in losses last year, with older individuals being targeted the most. Investment scams, promising high returns but stealing money instead, are the main cause of the sharp rise in losses, highlighting the need for reporting such crimes to help combat them. Scammers use trust-building tactics, like fake profits and fake recovery specialists, to deceive victims, emphasizing the need for caution when engaging in cryptocurrency investments.
The NSA has announced the launch of its new podcast. Called 'No Such Podcast', the first two episodes will feature declassified stories related to the signals intelligence operations involved in the operation to take down Osama bin Laden. The podcast will run through mid-October, with weekly episodes.
Amazon has expanded ABAC support to DynamoDB. This expanded functionality will allow users to configure IAM policies to allow or deny specific conditions when an IAM principal's tags match a DynamoDB table's tags. The feature is in limited preview and access can be requested for accounts in the U.S. East (Virginia and Ohio) and U.S. West (North California) regions.
A new Android malware called Ajina.Banker targets bank customers in Central Asia to steal financial data and bypass 2FA through Telegram channels.
A 17-year-old teenager was arrested in the UK for a cyberattack on Transport for London.