Search the archive

MASTERCARD BUYS RECORDED FUTURE FOR $2.65 BILLION

Mastercard is buying Recorded Future for $2.65 billion to enhance its cybersecurity services.

approvals quick and painless.

Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.

permissions actually use them? Sonrai's Cloud Permissions Firewall

tackles this head-on, by quickly identifying and quarantining these “zombies” lurking in your AWS environment!

PAYMENT GATEWAY DATA BREACH AFFECTS 1.7 MILLION CREDIT CARD OWNERS

Payment gateway provider SlimCD has disclosed a breach affecting 1.7M individuals. SlimCD reported that in June it detected that a threat actor had breached its network nearly a year previously in August 2023 and took steps to block the access. Stolen information included full names, physical addresses, credit card numbers, and expiration dates, but not CVV numbers.

BUG LETS ANYONE BYPASS WHATSAPP'S “VIEW ONCE” PRIVACY FEATURE

WhatsApp introduced “View Once” pictures as a way to prevent other users from sharing private pictures. Security researchers have found ways to bypass these protections on WhatsApp web. WhatsApp has stated that it is aware of the issue and is rolling out a fix.

SPYAGENT ANDROID MALWARE STEALS YOUR CRYPTO RECOVERY PHRASES FROM IMAGES

McAfee detected a new Android malware campaign that uses OCR to steal crypto recovery phrases. The malware also contains the capability to spread via SMS and capture OTPs sent via SMS. McAfee was able to trace back the malware and managed to access the admin panel of the malware operators.

RED REAPER: BUILDING AN AI ESPIONAGE AGENT

Inspired by the I-Soon leaks, these authors decided to build an AI espionage agent called Red Reaper. Red Reaper consists of 3 data science layers and a basic Flask UI. The first layer seeks to identify entities that deal with LAW in the sample email dataset and assign a confidence score to each one. The next layer builds a Neo4j graph and performs some analysis on the graph to identify key communication clusters and individuals. Generative AI is introduced in the last layer to refine the analysis and identify information that could be relevant for espionage, extortion, blackmail, or other criminal activity.

SANITIZE YOUR C++ CONTAINERS: ASAN ANNOTATIONS STEP-BY-STEP

This post discusses how to use AddressSanitizer(ASan) to detect memory errors in C++ code. Adding ASan annotations to libc++ containers like std::string and std::deque aids in bug detection. The post walks through various examples and code snippets that use ASan to aid in finding memory bugs in C++ code.

DEPLOYING RUST IN EXISTING FIRMWARE CODEBASES

This blog post explains how to gradually introduce Rust into existing firmware codebases for improved security. Drop-in Rust replacements for C code can enhance security with minimal effort. By following an incremental approach and addressing specific challenges, you can seamlessly integrate Rust into your firmware development process.

KUBERNETES TESTING ENVIRONMENT: AN OPEN SOURCE RESILIENCE PLATFORM FOR EKS, GKE, AND AKS

Orca has released a new tool for testing managed Kubernetes environments. The Kubernetes Testing Environment uses Terraform to deploy a configurable staging environment and runs a configurable set of scans against it. It provides dashboards to visualize the scan results.

FRIDA 16.5.0 RELEASED

Frida 16.5.0 contains new features like hardware breakpoints and watchpoints to help locate code accessing specific memory data more easily. The release also brings support for Windows on ARM and other improvements, making Frida even more versatile for developers. This article presents a demo using these new APIs in a game like DOOM, showing how to find and monitor memory locations dynamically.

HOOKCHAIN

hookchain aims to provide a new perspective on EDR Evasion. Through a precise combination of IAT Hooking techniques, dynamic SSN resolution, and indirect system calls, hookchain redirects the execution flow of Windows subsystems in a way that remains invisible to the vigilant eyes of EDRs that only act on Ntdll.dll without requiring changes to the source code of the applications and malware involved.

MAKING SENSE OF THE APPLICATION SECURITY PRODUCT MARKET

The AppSec product market is undergoing rapid change as new tooling such as CSPMs and API security tools shift the way teams interact with traditional tools like WAFs and DASTs. ASPMs are arriving to bridge the UI/UX and contextual gaps that exist in AppSec tools across the SDLC but struggle with requiring more integration points than CSPMs. GenAI is emerging as a useful tool that aids in triaging alerts, but it is still lacking in maturity.

BUG LEFT SOME WINDOWS PCS DANGEROUSLY UNPATCHED

Microsoft has released updates to fix 79 security vulnerabilities in Windows, including an unpatched bug affecting some Windows 10 PCs. One critical bug, CVE-2024-43491, caused the rollback of fixes for certain Windows 10 systems. Two zero-day flaws affecting Microsoft Publisher and Office, CVE-2024-38226 and CVE-2024-38217, were disclosed.

CRIMSON PALACE RETURNS: NEW TOOLS, TACTICS, AND TARGETS

The Crimson Palace cyber threat operation has resumed with new tools and tactics to target governments and organizations in South East Asia. This blog post presents various diagrams and timelines showing the details of Crimson Palace's operations. It also discusses the evolution of the malware, as well as efforts to evade detection.

AUSTRALIA'S PM WANTS SOCIAL MEDIA AGE RESTRICTIONS SO KIDS CAN GET OFFLINE AND HAVE 'REAL EXPERIENCES'

Australia's Prime Minister wants to introduce age restrictions for social media to protect children from harmful content.

FLIPPER ZERO RELEASES FIRMWARE 1.0 AFTER THREE YEARS OF DEVELOPMENT

Flipper Zero releases Firmware 1.0 after three years of development, introducing enhanced features like dynamic app loading and improved NFC performance.

THE SECURITY CANARY MATURITY MODEL

Canaries are now essential for mature security programs.

approvals quick and painless.

Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.

permissions actually use them? Sonrai's Cloud Permissions Firewall

tackles this head-on, by quickly identifying and quarantining these “zombies” lurking in your AWS environment!

NEW RAMBO ATTACK STEALS DATA USING RAM IN AIR-GAPPED COMPUTERS

A new attack called RAMBO can steal data from highly secure air-gapped computers by using electromagnetic radiation emitted from the computer's RAM. This attack allows data transfer rates of up to 1,000 bits per second, making it suitable for stealing small amounts of data like text, keystrokes, and small files. Mitigation strategies such as zone restrictions and RAM jamming can help defend against the RAMBO attack, but they come with additional complexities.

LOWE'S EMPLOYEES PHISHED VIA GOOGLE ADS

Malwarebytes detected a phishing campaign targeting Lowe's employees by masquerading as the Lowe's benefits portal. The attackers registered domains to common typos of MyLowesLife and bought Google Ads to have them show up in search results for MyLowesLife. The bogus domains were then used to steal login credentials from employees.

CAR RENTAL COMPANY AVIS DISCLOSES A DATA BREACH

Avis, a car rental company, experienced a data breach in August that compromised customers' personal information. The breach occurred between August 3 and August 6 but was discovered on August 14. Avis is advising impacted customers to monitor their accounts for fraudulent activities and is offering free credit monitoring services.

WHAT YOU SHOULD KNOW ABOUT PHP CODE SECURITY

This blog dives into PHP security. Due to its popularity and wide usage, PHP is often a target for hackers and malicious entities. Security vulnerabilities can creep in due to various reasons, such as poor coding practices, lack of sanitization of user inputs, and outdated versions.

LEARNING RUST FOR FUN AND BACKDOO-RS

Rust, a modern systems programming language that offers C/C++ performance without their pitfalls, is growing in popularity. This author shares their journey of learning Rust in 2024, highlighting the abundance of learning resources available and his personal recommendations.

“UNSTRIPPING” BINARIES: RESTORING DEBUGGING INFORMATION IN GDB WITH PWNDBG

Jason An from Trail Of Bits discusses how analyzing stripped binaries can be tough. He has enhanced Pwndbg to restore debugging information in GDB for stripped binaries using Binary Ninja integration. He also introduced the go-dump command for easier debugging of Go values. These improvements are available on the Pwndbg dev branch and its latest release.

REDFLAGS (PRODUCT LAUNCH)

Redflags is a platform designed to increase secure behavior through the concept of ‘nudging'. By nudging users, they practice ‘good' behavior beyond simply acknowledging poor behavior and bad intent.

GO-OVER

A tool to audit Erlang & Elixir dependencies.

GITHUB ACTIONS ATTACK DIAGRAM

GitHub Actions Attack Diagram provides guidance for identifying vulnerabilities in GitHub Actions pipelines.

YEAR-LONG CAMPAIGN OF MALICIOUS NPM PACKAGES TARGETING ROBLOX USERS

A long-running malware campaign is targeting Roblox developers through fake NPM packages mimicking "noblox.js". Attackers are using brandjacking and starjacking to appear legitimate and install malware that steals data, persists in systems, and deploys additional payloads to continue siphoning future data.

HARD TRUTHS YOUR CISO WON'T TELL YOU

Slides from Travis McPeak's off the record BlackHat campfire talk. McPeak shares some unfortunate realities of security in a business context, security organizations, and security practices. He closes with a set of good news such as the community being strong, the industry maturing, and that developers are looking to work with security.

WHAT'S THE WORST PLACE TO LEAVE YOUR SECRETS?

A researcher deployed canary tokens to a variety of different locations to measure how quickly attackers would find them and attempt to use them on AWS. Tokens deployed to package managers (npm and PyPi) and GitHub were accessed within minutes whereas Pastebin, a web server, and a Docker container took longer. Tokens deployed to GitLab, BitBucket, S3, GCP Cloud Storage, and a (weak) password-protected Pastebin were never accessed, suggesting that attackers are not actively monitoring these resources.

THE STATE OF THE VIRTUAL CISO 2024

The State of the Virtual CISO Survey Report examines vCISO adoption, opportunities, and challenges for MSPs/MSSPs, based on insights from 200 security leaders.

GITHUB ACTIONS VULNERABLE TO TYPOSQUATTING, EXPOSING DEVELOPERS TO HIDDEN MALICIOUS CODE

Threat actors are exploiting typos in GitHub Actions to run malicious code by creating similar-sounding actions, compromising projects, and stealing sensitive information.

A GLOBAL ASSESSMENT OF THIRD-PARTY CONNECTION TAMPERING

CloudFlare discussed at SIGCOMM how it was able to analyze anomalous internet connections so that various signature patterns of tampering can be identified.

Get the report for free

PLANNED PARENTHOOD CONFIRMS CYBER-ATTACK AS RANSOMHUB THREATENS TO LEAK DATA

Planned Parenthood in Montana experienced a cyber-attack on August 28. It is working with federal law enforcement and cybersecurity experts to investigate and restore systems. Ransomware group RansomHub claims to have stolen 93GB of data and has threatened to leak it unless paid.

REVIVAL HIJACK SUPPLY-CHAIN ATTACK THREATENS 22K PYPI PACKAGES

JFrog has detected a new attack, dubbed Revival Hijack, where attackers register a package under the name of a previously deleted package. 22k packages are vulnerable to this attack because PyPi makes package names available immediately upon deletion. JFrog took action to mitigate this vulnerability by registering packages under the name of more popular vulnerable projects.

GOOGLE CONFIRMS CVE-2024-32896 EXPLOITED IN THE WILD, RELEASES ANDROID SECURITY PATCH

Google has released its monthly security updates for the Android operating system, addressing a known security flaw that it said has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), allows privilege escalation in the Android Framework component.

A SECURITY ANALYSIS OF AZURE DEVOPS JOB EXECUTION

Azure DevOps is a key tool in CI/CD practices - particularly its Azure Pipelines feature for automating code building and testing. This post explores the server-side processes when pipelines are triggered, focusing on potential security risks and the importance of protecting against unauthorized access and data breaches in modern development workflows.

THREAT MODELING AUTOMATION: OPPORTUNITIES, CHALLENGES, AND THE ROLE OF AI

Traditional threat modeling struggles with scalability due to needing dedicated security resources as well as engineering resources to understand both the security aspects and application components. Recent innovations in the threat modeling process are meant to integrate threat modeling throughout the SDLC as well as offering tools for diagramming or threat models as code. With the advent of LLMs, it could be possible to generate threat models directly from source code. Current efforts such as STRIDE GPT can generate threat models from a natural language description.

AVOIDING SECURITY INCIDENTS DUE TO REQUEST COALESCING

Web caching is often utilized to speed up costly calculations or decrease response times by maintaining a copy of data closer to users. Request coalescing is when Amazon CloudFront is used as a CDN and sees requests for the same cache key come in simultaneously and the CDN waits for the first response to be cached and then uses the cached copy for the following responses. Wiz found an unexpected behavior where Amazon CloudFront was ignoring the Cache-Control: no-cache header and sending sensitive cached content to users via request coalescing. To prevent this behavior, users must configure the managed cache policy CachingDisabled for those cache keys or set the minimum TTL for the cache behavior to 0 AND configure the origin to send the Cache-Control: no-cache header.

WUSH

Wush is a command line tool that allows for transferring files and opening shells over peer-to-peer WireGuard connections. It is built on top of Tailscale's tsnet package and utilizes Tailscale's public DERP relays, but does not require a Tailscale account.

ACUVITY (PRODUCT LAUNCH)

Acuvity helps adopt AI platforms through a governance platform to detect and monitor employee interactions and helps companies develop secure in-house AI Applications.

SUASS

The Secure ur Ass By Learning Cybersecurity repository is a comprehensive resource for cybersecurity professionals, students, beginners, and anyone interested in the field of cybersecurity. It contains a wide range of cybersecurity study materials to help students enhance their knowledge and skills.