Search the archive

Intelligence Report

FLOW

Mixeway Flow is a versatile and comprehensive tool designed to serve as the ultimate Swiss army knife for DevSecOps processes. It streamlines the integration of security practices into your development and operations workflows, ensuring that your software is secure from the ground up.

DALEC

Dalec is a project aimed at providing a declarative format for building system packages and containers from those packages in a secure manner.

GUARDDOG

GuardDog is a CLI tool that utilizes Semgrep rules to identify malicious PyPi and npm packages or Go modules.

GARTNER 2024 HYPE CYCLE FOR EMERGING TECHNOLOGIES HIGHLIGHTS DEVELOPER PRODUCTIVITY, TOTAL EXPERIENCE, AI, AND SECURITY

The yearly hype cycle from Gartner suggests organizations will start adopting human-centric security and privacy techniques. Emerging technologies include AI TRiSM, cybersecurity mesh, digital immune systems, and homomorphic encryption.

WHAT DOES A SOC ANALYST DO?

This blog post provides an overview of the role of a SOC analyst. The main functions of a SOC analyst are security monitoring, incident detection, incident analysis, and incident response. Most SOCs are organized into tiers, with tier 1 analysts doing basic triage of alerts and higher tiered analysts doing more senior incident response and threat hunting.

ARDEN CLAIMS SERVICE REPORTS DATA BREACH, 139,000 AFFECTED

Arden Claims Service experienced a data breach in October 2023 that affected 139,000 people. Personal information, including names and possibly Social Security numbers, was stolen by a third party. The firm is providing affected individuals with free identity protection services.

U.S. APPEALS COURT RULES GEOFENCE WARRANTS ARE UNCONSTITUTIONAL

A Fifth Circuit appeals court judge ruled that geofence warrants, where law enforcement requests all data from users in an area, are unconstitutional.

DOJ SUES GEORGIA TECH OVER ALLEGEDLY FAILING TO MEET CYBER REQUIREMENTS FOR DOD CONTRACTS

The Justice Department is suing Georgia Tech for not meeting the cybersecurity standards needed for Pentagon contracts.

DEF CON 32: WHAT WE LEARNED ABOUT SECRETS SECURITY AT APPSEC VILLAGE

This post discusses the AppSec village and notes the utility of tools like GitGuardian to detect and address security vulnerabilities in software development.

100,000 IMPACTED BY JEWISH HOME LIFECARE DATA BREACH

Jewish Home Lifecare, a New York City healthcare nonprofit, disclosed a data breach impacting over 104,000 individuals. Hackers accessed personal and medical information, including Social Security numbers and financial details.

OREGON ZOO HACK IMPACTS OVER 100K

The Oregon Zoo disclosed a payment skimming malware attack that exfiltrated personal and credit card data of 100K individuals over 6 months. The breach follows similar incidents at other zoos. The stolen card data has been found for sale on dark web carding shops.

TOYOTA CONFIRMS BREACH AFTER 240GB OF STOLEN DATA LEAKS ON HACKING FORUMS

Toyota has confirmed a breach of 240GB of data but has not provided details on what the data contains or how many people are affected by it. The leaker claims that the data contains contacts, financials, customers, employees, photos, DBs, network infrastructure, emails, and more. The files were stolen or created on December 25, 2022, which suggests that the data may have been a backup.

EXECUTION GUARDRAILS: NO ONE LIKES UNINTENTIONAL EXPOSURE

A post from TrustedSec's Brandon McGrath which begins with a discussion of an engagement where his implant got caught by a member of the blue team. McGrath details how he uses a key ring consisting of host based checks, network checks, and external checks as an execution guardrail. In the example, the implant first checked the hostname of the system, then network shares, and finally a TXT record before downloading and launching the payload.

ENABLING TRUSTED TYPES IN A COMPLEX WEB APPLICATION: A CASE STUDY OF APPSHEET

Trusted Types is a defense-in-depth mechanism that protects against DOM XSS by implementing type systems to ensure that only safely constructed values can reach injection sinks. To rollout Trusted Types in AppSheet, the Google team followed a five stage process: report-only mode, collect and triage violations, refactor blockers, repeat the previous two steps, and enforcement. When investigating a Trusted Types violation, a report contains the source file where the violation occurred, the document URI which is the URI where the violation occurred, and the script-sample which includes the underlying API call that caused the violation and a prefix of the input that caused the violation.

GITHUB ACTIONS EXPLOITATION: DEPENDABOT

Synacktiv discovered a novel GitHub Actions exploitation technique leveraging Dependabot to compromise repositories and push arbitrary code. The vulnerability stems from workflows using the 'pull_request_target' event with weak access controls based on the 'github.actor' context, which can be manipulated by triggering Dependabot actions on a forked repository. Synacktiv demonstrated successful exploits against the spring-security and trpc projects, highlighting the importance of careful workflow configuration and the use of tools like octoscan for detecting such vulnerabilities.

with Guardsquare

LINX SECURITY (PRODUCT LAUNCH)

Linx uses analytics and AI to scan and understand the landscape of an organization's system to link all identities together and to actual, active employees. In the process, it also finds IDs that are no longer connected to active users so that they can be removed.

GRAPHQLER

GraphQLer is a dependency-aware API fuzzer that uses relationships between objects and mutations to inform its testing

GRIMOIRE

Grimoire is a tool that generates datasets of cloud audit logs for detection engineering. The tool currently supports the ability to detonate Stratus Red Team or AWS CLI commands and stream the CloudTrail logs to an output file.

NATIONAL PUBLIC DATA PUBLISHED ITS OWN PASSWORDS

MICROSOFT SAYS ALL AZURE SIGN-INS WILL NOW NEED TO USE MULTI-FACTOR AUTHENTICATION TO ENHANCE ACCOUNT SECURITY

Microsoft will soon require multi-factor authentication for all Azure sign-ins to enhance account security. The rollout will happen in two phases, first for the Azure portal and admin centers, then for Azure CLI, PowerShell, and other tools.

POST-QUANTUM CRYPTOGRAPHY: WHAT COMES NEXT?

In the wake of NIST releasing the first set of post-quantum cryptography standards, the UK's NCSC has started a series of posts on how organizations should respond. Implementations and protocols like TLS still need to be updated to make use of post-quantum cryptography which will likely take years. NCSC advises that the key actions that organizations can take now are to inventory the use of cryptography in their own environments and in their supply chains.

WINDOWS 0-DAY WAS EXPLOITED BY NORTH KOREA TO INSTALL ADVANCED ROOTKIT

Hackers linked to North Korea exploited a Windows zero-day vulnerability to install advanced malware.

DESIGN FLAW HAS MICROSOFT AUTHENTICATOR OVERWRITING MFA ACCOUNTS, LOCKING USERS OUT

Microsoft Authenticator has a design flaw that can overwrite accounts, causing users to be locked out unexpectedly.

PHRACK 71 RELEASED (EZINE)

The 71st issue of beloved hacker e-zine Phrack has been released after nearly 2 years since the last issue.

→ If you're ready to get started with PolicyTree, why not start now?

→ To learn more about streamlining your compliance journey, check out the Compliance Starter Pathway [5].

AUTOCANADA INVESTIGATING CYBERSECURITY BREACH, AS IT ANNOUNCES LOSS FROM PREVIOUS INCIDENT

AutoCanada reported a cybersecurity breach on August 11, potentially disrupting operations. This follows a separate incident involving CDK Global's software outage in June, which contributed to AutoCanada's $33.1 million Q2 loss. The company is investigating the extent of the latest breach and its impact on data security.

460K IMPACTED BY KOOTENAI HEALTH RANSOMWARE ATTACK

Kootenai Health, an Idaho-based healthcare provider, reported a data breach affecting over 460,000 individuals. The incident involved network access and data exfiltration of personal and health information.

GOOGLE WILL UPDATE PIXEL PHONES TO REMOVE VERIZON'S UNSAFE DEMO APP

Security researchers discovered a vulnerable app called Showcase.apk that was included in numerous Pixels' firmware without any way to remove it. Google has clarified that this app is used in Verizon demo phones and has committed to removing it in a future update. There is no evidence that the app has been exploited as an attacker would first require physical access and a user's password to install the app, which provides numerous other attack vectors.

SSRF: A COMPLETE GUIDE TO EXPLOITING ADVANCED SSRF VULNERABILITIES

This is a guide on exploiting SSRF vulnerabilities. It begins by explaining what SSRFs are and how to exploit basic SSRF vulnerabilities before discussing how to bypass common defenses like host and protocol allowlisting. The guide then provides an introduction to some advanced SSRFs like SSRFs in PDF generators, second order SSRFs, blind SSRFs, and SSRFs via DNS rebinding.

REUSABLE WORKFLOW IS GOOD… UNTIL YOU REALIZE YOUR IDENTITY IS ALSO REUSABLE BY ANYONE

Keyless signing is used in conjunction with sigstore by organizations to sign artifacts to enable artifact attestation. A novel attack method shows that if a repository publishes a reusable workflow to sign artifacts using sigstore, an attacker can use that workflow to sign artifacts with a SAN of the reusable workflow's repository. The researcher does not believe that this is a worrisome threat as they could only find two repositories that the attack would actually work against and even then the impact would depend on how the potential victim verified the signature.

BUCKET MONOPOLY: BREACHING AWS ACCOUNTS THROUGH SHADOW RESOURCES

Researchers have discovered a novel attack technique in AWS whereby an attacker can create S3 buckets that utilize the naming system of AWS services to in some cases even achieve RCE. When certain features in Cloudformation, Glue, EMR, Sagemaker, ServiceCatalog, or Codestar are first used, AWS creates an S3 bucket with a scheme such as cf-templates-- (for Cloudformation templates). If an attacker were to create a bucket with a guessed hash that matches the one that AWS would create for an account, the attacker would control the bucket and its contents. AWS has fixed the vulnerabilities in all services other than Codestar, which is not accepting new customers.

DAZZ (PRODUCT LAUNCH)

Dazz is an ASPM platform focused on automating the remediation processes.

PASSWORDPUSHER

Securely share sensitive information with automatic expiration and deletion after a set number of views or duration. Track who, what, and when with full audit logs.

HUNTSMAN

Huntsman is a social engineering tool that features an email enumerator, username generator, and context validator. It offers full coverage of the hunter.io and snov.io APIs and limited coverage of the skrapp.io API.

IRANIAN GROUP USED CHATGPT TO TRY TO INFLUENCE US ELECTION, OPENAI SAYS

OpenAI has banned accounts from an Iranian group, Storm-2035, for using ChatGPT to generate content aimed at influencing the US presidential election and other issues.

INTRODUCING AUTOMATIC SSL/TLS: SECURING AND SIMPLIFYING ORIGIN CONNECTIVITY

Cloudflare offers various options to control encryption between Cloudflare and origin servers that range from never encrypting to following the client request's encryption mode to always using TLS. To simplify the decision process for Cloudflare customers, Cloudflare introduced the SSL/TLS Recommender which would scan origin pages to suggest the best encryption settings. However, Cloudflare found that only 30% of customers were enabling the chosen setting in the UI. To increase adoption, Cloudflare is introducing Automatic SSL/TLS, which will automatically enable the SSL/TLS Recommender's recommended setting.

EXPLOITING HUGGING FACE'S ASSISTANTS TO EXTRACT USERS' DATA

This article demonstrates how Hugging Face's Chat is vulnerable to techniques like Sleepy Agent and Image Markdown Rendering, which can be exploited to extract users' data. These vulnerabilities allow attackers to manipulate the AI model to extract sensitive information like email addresses without the user's knowledge. Users should be cautious when using AI assistants and read the system prompts to avoid falling victim to data extraction attacks.

PALO ALTO NETWORKS CEO APOLOGIZES FOR HAPPY HOUR DISPLAY FEATURING WOMEN WITH LAMPSHADES ON THEIR HEADS

The display was neither consistent with the company's values nor in line with its actions and aspiration to support and celebrate women in Cybersecurity.

GCORE RADAR: DDOS ATTACK TRENDS IN Q1-Q2 2024

This DDoS report shows a 46% increase in DDoS attacks in H1 2024 compared to H1 2023.

GOOGLE TOOK THREE MONTHS TO REMOVE SCAM APP THAT STOLE OVER $5 MILLION IN CRYPTO: LAWSUIT

Google took three months to remove a scam app from its Play Store that tricked into losing over $5 million in cryptocurrency.

* Use AI to vet third parties and scan incoming security reports

* Use AI to collect and map evidence in any format against any framework

free with 1,000 AI credits

MACOS STEALER POSING AS LOOM IS SPREADING VIA GOOGLE ADS

Moonlock Labs has uncovered a new AMOS stealer variant that spreads by masquerading as the Loom screen recorder on Google Ads. In addition to usual infostealer malware capabilities, this new variant contains the capability to clone and swap legitimate apps such as a crypto wallet to wipe victims' wallets. This variant also includes files that suggest that it is targeting gamers.