AWS has announced support in KMS for asymmetric keys using ECDH. Each party generates a key using the same key spec and selects KEY_AGGREEMENT for the usage. The parties then retrieve and exchange their public key from KMS. Each party can then utilize the other party's public key and their KEY_AGREEMENT key to call the new DeriveSharedSecret API to derive an asymmetric key that can be utilized for secure communication. This post provides a walkthrough for a sample use case of end-to-end encryption using the new DeriveSharedSecret API.
AWS Network Firewall has introduced GeoIP-based filtering for ingress to and egress from a VPC. GeoIP filtering allows for the creation of firewall rules that target a country as opposed to previously where users needed to maintain an IP list for each country.
X is hiring for safety and cybersecurity roles. The company has posted two dozen job openings, including positions for content moderation and platform security.
The Dutch Data Protection Authority fined Clearview AI €30.5 million for GDPR violations, citing its database of billions of facial images collected without consent.
Scammers are using bitcoin ATMs to steal money, with Americans losing $65 million in just six months.
A computer glitch caused a near-flooding disaster in Amsterdam when sluice gates were left open.
Transport for London (TfL) is addressing a cybersecurity incident affecting its internal systems. While no customer data breach or service disruption has been reported, TfL is working with government agencies to respond.
Fota Wildlife Park is notifying customers who bought tickets on the park's website since May 12 of a breach. Users are being advised to change any passwords associated with the site, be aware of phishing attempts to their email, and notably to cancel any debit or credit cards used. The park has not revealed exact details on what data was stolen, how the data was stolen, or the number of customers impacted
2024.09.04·infosecurity-magazine.com·4 min read·TLDR InfoSec The YubiKey 5 hardware token for two-factor authentication has a cryptographic flaw that makes it vulnerable to cloning attacks when physically accessed by an attacker. Yubico has confirmed that all YubiKey 5 models are susceptible to cloning due to a side channel vulnerability in the Infineon microcontroller used in various authentication devices. Updating firmware on affected YubiKeys is not possible, leaving them permanently vulnerable to potential attacks.
This article provides a comprehensive overview of the various tools that are available to fine tune AWS IAM access. It suggests some important SCPs such as limiting access to specific regions and blocking root user access, establishing zones of trust, utilizing permissions boundaries, using IAM Access Analyzer, and separating humans and non-human identities. The article suggests starting with a more permissive set of permissions to understand how your team utilizes AWS and then limit permissions from there.
The first part in a series on Linux detection engineering from Elastic Labs, which focuses on installing and configuring auditd. The first part of the article lists installation methods for auditd and explains the types of rules that auditd supports. Control type rules configure the auditd process, file system rules watch files for read, write, and execute actions, and system call rules are the powerhouse of auditd and specify which syscalls to monitor and log. The second part focuses on how to use the Auditd Manager Elastic integration to install and configure auditd at scale and presents Elastic alerts for various scenarios.
This post explains how to use AWS Vault to securely store AWS credentials leveraging the AWS Session Token Service to provide temporary, limited-privilege access to AWS resources in typical AWS account patterns, reducing credential exposure risk.
Sponsored
The rapid adoption of M365 Copilot and other enterprise LLMs requires new security approaches. Prompt Security inspects each prompt and model response to prevent sensitive data leaks, block harmful content, and secure against GenAI-specific attacks. Today the company has announced comprehensive protection for M365 Copilot. Read more [11] or join the webinar [12].
A comprehensive reference of Windows API functions divided by use case.
SentryPeer is a fraud detection tool. It lets bad actors try to make phone calls and saves the IP address they came from and the number they tried to call.
Traceeshark allows users to do Linux runtime security monitoring and advanced system tracing using Wireshark. It also has the ability to capture events using Tracee directly from Wireshark and have them stream in like a network capture. This can be done either locally on a Linux machine running Wireshark, semi-locally using Docker Desktop's VM on Windows and Mac, or even remotely over SSH.
Offsec has announced changes to the exam format of the OSCP exam including the elimination of bonus points and an assumed breach model for the Active Directory portion. It has also introduced the OSCP+ designation, which will require recipients to renew their certification via CPEs, retake the exam, or earn a higher level cert every 3 years to maintain the + distinction. The community is split on reactions to the announcement, with some feeling that the OSCP+ is a cash grab and that the AD changes are too easy, while others are celebrating that the certification will now fulfill DoD requirements.
A 57-year-old former core infrastructure engineer from Missouri was arrested for attempting to extort his ex-employer. He allegedly sent emails threatening network lockouts, data deletion, and server shutdowns unless paid 20 bitcoin ($750,000). He faces charges of extortion, computer damage, and wire fraud.
This blog post discusses a vulnerability in Microsoft 365 Copilot that allowed personal information theft through prompt injection. The exploit chain involves techniques like prompt injection, automatic tool invocation, and ASCII smuggling to exfiltrate data without user consent. The author responsibly disclosed the exploit to Microsoft, leading to fixes implemented to prevent further exploitation.
Forrester advises CISOs to prioritize 2025 budgets on key areas including software supply chain, API security, and IoT/OT threat detection.
The FBI warns that North Korean hackers are targeting cryptocurrency companies using sophisticated social engineering tactics to steal crypto assets.
A threat actor operating in Czechia evolved from utilizing PWAs and WebAPKs to utilizing the NGate malware to attack Android users of major Czech banks. The NGate malware is delivered via smishing, where attackers alert users to either an issue in their banking app or a way to get tax returns faster. The malware then utilizes NFCGate to relay any NFC payments from the device, which allows the attackers to duplicate the cards and withdraw money from an ATM. This attack does not require the victim's device to be rooted.
US agencies have issued a warning about RansomHub, a rapidly growing ransomware group formed in February with at least 210 victims across various sectors, including critical infrastructure. RansomHub exploits vulnerabilities with common hacking tools.
Critical vulnerabilities in Progress Software's WhatsUp Gold, an enterprise network monitoring solution, could allow full system compromise. Over 1,200 internet-accessible instances may be affected by CVE-2024-4885, a critical flaw allowing remote code execution. A proof-of-concept is available.
SecurityRunners' Jonathan Walker provides an analysis of the coverage of IAM Access Analyzer for detecting public or cross-account access to resources. Walker puts coverage at about 65% and lists a few notable gaps. AWS Glue and SES are fundamental services that Walker believes should have coverage. Secrets Manager currently only alerts if a KMS key and secret are public but Walker believes that it should alert on just a public secret in case a method of accessing it becomes apparent. Walker also notes that Elemental MediaStore certainly should have coverage but is fairly obscure so may be a backlog item. He also highly encourages deploying IAM Access Analyzer as it is simple to manage and cost-effective.
Unprotected container registries are easily detectable on the web through tools like Shodan or scanning for common endpoints. This post demonstrates the ease with which an attacker can locate an unprotected container registry and upload or replace an existing image. The author located over 10k unprotected registries across the full IP space and was able to push a benign, PoC image to over 4,500 of them. They only uploaded a dummy image under an easily detectable name due to ethical considerations, but a motivated attacker could upload a malicious image just as easily.
This blog series examines the security of six set-top boxes to determine if they're compromised or part of botnets. The research involves hardware triage, filesystem extraction, and malware analysis. It also explores how easily these devices could be exploited.
Dalec provides a declarative format for building system packages and containers from those packages. It is designed for building containers for Azure and supports Azure Linux 2 and 3 and Windows containers.
Uniqkey's password and access management solution allows employees to use mobile applications when logging into enterprise systems while keeping passwords encrypted.
OWASP Nettacker project was created to automate information gathering, vulnerability scanning, and eventually generating a report for networks. It includes information on services, bugs, vulnerabilities, misconfigurations, and other topics.
JA3 Fingerprints were first introduced in 2017 as a method to fingerprint browsers by taking a hash of the TLS ClientHello message, but they have lost efficacy due to differences in how tools handle various extensions and modern browsers scrambling TLS extensions. To combat this, FoxIO introduced JA4, which introduces other protocol elements into the fingerprint and is resilient to randomization of TLS extensions by first sorting them before hashing. To make JA4 fingerprints more useful to customers, Cloudflare aggregates data across its network on JA4 fingerprints into signals that can be used in Workers and rules. This post includes a breakdown of the different fields in a JA4 fingerprint, the statistics available via JA4 signals for a fingerprint, and a script demonstrating how to utilize signals in a Worker.
Sam Curry, a hacker and bug bounty hunter, reflects on a common mentality of setting up extensive goals and plans for getting into bug bounty hunting. Curry compares this with his experience and failure doing the same with his studies in high school. Ultimately, Curry suggests that the fundamental issue in many hackers that set out these goals and fail is that they aren't actually interested in bug bounty hunting and should instead not force themselves to do it.
An Ohio judge has issued a restraining order against a security researcher who contradicted Columbus officials' claims about a recent ransomware attack. The researcher presented evidence that sensitive data stolen in the attack was intact and accessible, contrary to the mayor's statement. The city sued the researcher, claiming his actions made dark web data publicly available.
A security flaw in air transport systems allowed unauthorized people to bypass airport security screenings.
Gartner predicts that by 2027, 17% of total cyberattacks/data leaks will involve generative AI.
North Korean hackers known as Citrine Sleet used a zero-day exploit in Google Chrome to deliver the FudModule rootkit.
instead of weeks. Trustero continually evaluates your controls for operating effectiveness, spotting gaps, giving tailored remediation guidance, and ultimately unlocking Agile GRC.
Sponsored
GRC data goes in, actionable insights come out. Trustero's patented AI suite turns GRC teams into super teams with 3 powerful capabilities:
Park'N Fly, which provides off-airport parking for several Canadian Airports, is notifying 1 million customers about a data breach that exposed their information. The exposed information includes full names, email addresses, physical addresses, airplane numbers, and CAA numbers. Park'N Fly reports that the attackers breached its systems via compromised VPN credentials.
Dick's Sporting Goods reported a cyberattack on August 21 that potentially exposed confidential information. The company activated its cyber response plan, engaged security experts, and notified law enforcement, but it believes the incident hasn't disrupted operations or had a material impact.
This post dives into how a research team saw a massive surge in Microsoft Sway-based phishing, primarily using QR codes ("Quishing"). These campaigns targeted MS Office credentials, focusing on Asia and North America across various industries through mobile devices' weaker security.
An AIBOM is a comprehensive inventory of AI system components that enhances transparency and governance. AIBOMs are crucial for responsible AI adoption. They provide a "map" of system elements including architecture, inputs/outputs, intended uses, risks, and ethical implications.
Broken Object Level Authorization (BOLA) vulnerabilities are notoriously difficult to automatically detect as they do not follow set patterns and often require an understanding of the application logic and interdependencies. To address this problem, Unit 42 developed BOLABuster, which leverages LLMs for detecting BOLAs. BOLABuster takes an OpenAPI specification and then identifies all potentially vulnerable endpoints. It then establishes which endpoints are producers and which are consumers to map dependencies. The LLM determines the execution path to the potential BOLA and generates a test script. Unit 42 was able to find new vulnerabilities in Grafana, Harbor, and Easy!Appointments using BOLABuster.
2024.08.30·unit42.paloaltonetworks.com·9 min read·TLDR InfoSec Sponsored
You don't have to put your career on hold to get a high quality education. With 100% online classes, and six 8-week terms a year, SNHU offers the flexibility you need to take the next step. Find your InfoSec degree today [12] (US based students only)
My Privacy DNS' "Matrix" project is a handcrafted and completely self-managed DNS Firewall through Response Policy Zones.
Chalk captures metadata at build time. It can add a small 'chalk mark' (metadata) to any artifact so it can be identified in production. Chalk can also extract chalk marks and collect additional metadata about the operating environment when it does this.