Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A vulnerability in MSI SMM driver allowed attackers to run unauthorized code by exploiting a buffer overflow. The exploit involved setting a variable to corrupt SMRAM, leading to potential system compromise. Mitigation required setting DataSize to 8 for status message writing to physical memory.
Palo Alto Networks patched a critical command execution flaw in its Cortex XSOAR product, allowing attackers to run commands without authentication. The company also addressed vulnerabilities in other products like Prisma Access Browser and PAN-OS, releasing patches to fix the issues. While no known attacks have occurred, Palo Alto Networks is proactive about addressing cybersecurity threats in its products.
A Reddit user experienced a $9,000 bill due to a CloudFront WAF bypass. A comment presented a list of suggestions to improve WAF usage such as blocking the AWSManagedRulesAmazonIPReputationList list, setting rate limits at various levels with COUNT actions to determine baselines to block, restricting access to the S3 bucket, and blocking geos that customers don't reside in. The comment also suggested using AWS Shield Advanced, which gives access to the Shield Response Team and has a WAF allowance included in its $3,000/month cost.
This article details an exploration of how email parsers handle the more arcane parts of the RFC. It begins with background about ways that the RFC treats some special characters like escapes and comments. The article then details how the author utilized encoded words to bypass access controls to obtain access to protected environments using encoded words before taking it a step further to achieve RCE using puny codes. Relevant tooling for automating encoded word discovery with Turbo Intruder and fuzzing with punycode as well as a CTF are included.
The 3 Billion people nationwide data breach has led to leaked records including names, addresses, and Social Security numbers. Data aggregator NPD is facing a class action lawsuit over the breach.
Sponsored
Whether you're already in cyber or looking for your first role, a university degree [11] can help you stand out and deepen your knowledge. Explore online Bachelor of Science degrees from Southern New Hampshire University [11] (SNHU) for 24/7 online accessibility, affordable tuition rates, and flexible terms starts.
Project Apeman is a tool for generating and visualizing AWS attack paths.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Daemon to ban hosts that cause multiple authentication errors.
NIST has announced the first set of standards for post-quantum cryptography: ML-KEM, ML-DSA, and SLH-DSA. ML-KEM uses a lattice system to create a secure communication channel whereas the other algorithms are for creation and verification of digital signatures. IBM's Dario Gil urges companies to start adopting these standards now as threat actors may be stockpiling encrypted data to crack with a quantum computer, which Gil theorizes should be available within the next 10 years.
This post breaks Detection as Code (DaC) into four components: language, testing, integration, and monitoring. When a team starts adopting DaC, they may use markup languages before moving on to query languages and finally general purpose programming languages. As teams adopt testing for their DaC, they will likely begin with unit testing before adopting other forms of testing like integration testing and end-to-end testing. Teams will also add more monitoring and integrations as they mature. A maturity matrix is included at the end of the post.
NIST announced new post-quantum cryptography standards, including SLH-DSA. Trail of Bits created a Rust implementation of SLH-DSA for secure cryptographic use. Its open-source project, which focuses on security and usability improvements, aids the transition to post-quantum cryptography.
Microsoft has removed the 32GB limit for FAT32 partitions in Windows 11, now allowing sizes up to 2TB.
A new vulnerability in GitHub called ArtiPACKED could let attackers take over repositories by leaking tokens and compromising cloud services.
A cybercriminal known as "J P Morgan" has been extradited to the United States after a decade-long investigation.
Evolution Mining, an Australian gold mining company, reported a ransomware attack on August 8. It believes the incident is contained and is working with cyber forensic experts. The company doesn't expect a material impact on operations. The group responsible for the attack remains unidentified.
MalwareBytes detected a malware campaign that used Google ads to pose as a download page for the Google authenticator app. The downloaded file was hosted on GitHub and was actually the DeerStealer infostealer. This post includes screenshots showing how the attacker was able to make the ad look legitimate by registering a verified advertiser profile.
SAP released security patches for 17 vulnerabilities, including a critical flaw allowing remote attackers to bypass authentication and compromise systems. The flaw impacts SAP BusinessObjects Business Intelligence Platform versions 430 and 440. Hackers target such flaws to access valuable corporate networks, so it's crucial to apply updates promptly.
Azure Health Bot Service, a platform for AI health assistants, had critical vulnerabilities allowing cross-tenant access. Microsoft has applied mitigations across affected services and regions. No customer action is required.
James Kettle presented at DEFCON on how he exploited timing attacks with delays as low as 200 microseconds. To reduce noise, Kettle utilized HTTP/2 to send multiple requests that arrived at the same time and interleaved a ping packet to force HTTP header coalescing, trying to hit slow code paths. He was able to effectively demonstrate the efficacy of this technique in discovering hidden parameters, server-side injections, and reverse-proxy misconfigurations.
This text discusses the importance of code security and the vulnerabilities that can arise when working with XML parsers in C++ code. It covers the XXE vulnerability and provides examples of insecure and secure code implementations to prevent such vulnerabilities. The author aims to help beginners improve their security code review skills by understanding and mitigating common XML vulnerabilities.
LeakSignal's platform allows customers to block sensitive data before it is logged, observe and redact it during calls to outbound third-party application programming interfaces (APIs), and observe and set limits on internal API data access.
PANIX is a highly customizable Linux persistence tool for security researchers, detection engineers, and penetration testers. It prioritizes functionality over stealth and is easily detectable.
AppLockerGen is a tool that simplifies the process for generating AppLocker XML policies. The webapp features prebuilt policies as well as GUIs for merging or generating policies.
The FBI has dismantled servers and domains associated with the Radar/Dispossessor ransomware group, which evolved from piggybacking on LockBit's stolen data to becoming an independent operation. The takedown involved international collaboration with UK and German law enforcement agencies.
Research reveals prompt injection attacks on LLMs are primarily used by job seekers bypassing HR screeners and AI protesters, not criminals. The technique overrides initial instructions given to AI models. While direct injections are common, indirect injections via web pages or documents also occur.
Cloudflare Radar now includes insights on HTTP request traffic, allowing users to compare bytes with requests for better traffic analysis. New graphs have been added to show HTTP request-based traffic data on the Overview and Traffic sections of Cloudflare Radar. These new metrics offer a clearer view of user behavior and traffic patterns.
Apple will be disabling the ability to override Gatekeeper with Control-click when opening software that isn't properly signed or notarized.
A suspected Iranian cyber intrusion targeted the Trump and Biden campaigns, with stolen documents leaked to media outlets.
NIST has released new encryption standards to protect against quantum computer attacks.
Sponsored
Service Control Policies (SCPs) can be intimidating, but they are an essential part of working in AWS, especially when used to keep a lid on excessive permissions and reduce unnecessary risk!
NCC Group researchers have discovered vulnerabilities in Sonos smart speakers that allow remote code execution and potential eavesdropping. The flaw affects Wi-Fi drivers and could be exploited by nearby attackers. These vulnerabilities have now been patched by Sonos and updating drivers is recommended.
Researchers have discovered a security flaw, dubbed Sinkclose, in AMD processors, affecting chips since 2006. The vulnerability allows hackers to run malicious code in the chip's privileged System Management Mode. While requiring initial access, Sinkclose enables deep-seated malware installation that can survive OS reinstallation and be extremely difficult to remove.
Security researchers discovered severe vulnerabilities in Ecovacs robots that allow hackers to take control via Bluetooth from up to 450 feet away. Once compromised, attackers can remotely access cameras, microphones, and Wi-Fi credentials. Ecovacs hasn't responded to the researchers' reports, leaving these vulnerabilities potentially exploitable.
Researchers deployed canary tokens (aka fake AWS credentials) in public online locations to study threat actor behavior. These digital tripwires triggered alerts when accessed, revealing patterns in credential discovery and attack methods.
TrailShark is a tool that integrates AWS CloudTrail logs with Wireshark for real-time analysis of API calls. It helps identify vulnerabilities in AWS services by monitoring internal API interactions. TrailShark offers features like advanced filtering, inner API call analysis, and custom event creation to enhance security and transparency in AWS environments.
Security researchers discovered a new vulnerability whereby websites can bypass protections and send requests to 0.0.0.0 and reach internal APIs that are listening on localhost. This vulnerability was able to bypass Google Chrome's Private Network Access protections because 0.0.0.0 was not on the blocklist that it uses. Following the researchers' findings, all major browsers have committed to blocking requests to 0.0.0.0 and establishing Private Network Access as a standard which will include 0.0.0.0 in its blocklist.
Endari provides customers with scalable solutions for protecting assets and customer data without the need for a full-time security team.
Code Pathfinder, the open-source alternative to CodeQL. Designed for precise flow analysis and advanced structural search, it identifies vulnerabilities in source code.
A CloudFormation template to create reasonable account defaults around Cost Surprise Alerting.
Oracle has agreed to pay $115 million to settle a class action lawsuit alleging user data misuse. The settlement, which affects 220 million people, requires Oracle to address privacy violations and implement an audit program for customer compliance.
A new CPU vulnerability called GhostWrite affects a common RISC-V processor, allowing attackers to read/write to any part of the computer's memory. Mitigating GhostWrite requires disabling around half of the CPU's functionality, leading to a significant 77% performance hit by turning off the vector extension support. The vulnerability is not related to speculative execution. RISC-V chips are becoming more popular targets for security researchers and attackers.
This author discusses Detection as Code and lessons learned in five years as it has evolved beyond simply writing detection logic in programming languages to focus instead on codifying processes and leveraging CI/CD pipelines for automated checks and version control. Test-Driven Detection (TDD), which emphasizes test creation before writing detection logic, is emerging as a best practice. LLMs show promise in auditing and improving detector descriptions within CI/CD pipelines but aren't suitable for creating detection logic.
2.7 billion personal records, including Social Security numbers, were leaked from National Public Data on a hacking forum, exposing sensitive information of people in the US.
The UK and France are consulting on commercial cyber intrusion capabilities through the Pall Mall Process.
The White House released a report on open-source software security initiatives that details activities planned by the OS3I for 2024-2025.
ADT disclosed hackers obtained limited customer information like email, phone, and addresses. The breach, which affects a small percentage of its 6 million customers, involved accessing customer order databases, but ADT says home security systems and financial data were not compromised.
The Grand Palais Réunion des musées nationaux in France was hit by a cyberattack on August 3, causing operational disruptions. While reports linked the ransomware attack to disruptions at other museums like the Louvre, the Louvre director denied any impact on their institution.
A group of researchers from SafeBreach Labs presented a new attack at Black Hat that can be used to craft custom downgrades of critical OS components. The researchers found that a malicious action list XML file can push a Windows Downdate tool that bypasses all verification steps. Microsoft has been working with the researchers to develop a patch to prevent this attack and has released two CVEs related to it.