Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
This article walks through the process of creating a Lambda function to automate scheduled secrets rotation. The Lambda is written with a placeholder function that can be customized with the steps to generate a new API key or other secret and then the AWS SDK is used to update the secret value. OpenTofu/Terraform code is provided in the post.
Part one of a hands-on series from TCM Security on getting started in hardware hacking. This post expands on some of the reasons to learn hardware hacking, why some basic hacking knowledge is helpful before starting, ways to get started for free, and tools that will prove useful for hardware hacking. The series will work on hacking a custom IoT firmware written for the Raspberry Pi Zero 2w.
This blog explains how VPN post-exploitation techniques can expose user credentials to attackers. Attackers can easily obtain credentials and access critical assets by compromising the VPN. To prevent this, use limited service accounts and dedicated identities for VPN authentication.
An offensive security toolset for Microsoft 365 focused on Microsoft Copilot, Copilot Studio, and Power Platform
Scamnetic automatically scans emails and text messages, as well as links, QR codes, images, and physical mail in an effort to identify potential risks.
DIANA is a tool that automates the creation of detections from threat intelligence feeds using LLMs. The tool allows for customizing the model, threat intelligence feed, and output language.
Cencora revealed that it suffered a breach this past February but declined to provide more information. 1.43M individuals have been notified, with notifications still being submitted as of July. Cencora has refused to comment on the cause of the data breach or the number of individuals that were impacted by it.
Mortgage lender LoanDepot reported nearly $27 million in costs from a ransomware attack in January. The breach compromised personal and financial data of over 16 million individuals. Expenses included investigation, remediation, customer notifications, legal fees, and commission guarantees.
Microsoft 365 has anti-phishing measures like the First Contact Safety Tip, but there are weaknesses that allow attackers to bypass them. Attackers can hide safety tips and spoof encryption icons in Outlook by manipulating CSS in HTML emails. Despite being notified, Microsoft has not yet fixed these issues, potentially leaving organizations vulnerable to phishing attacks.
Amazon Bedrock has achieved FedRAMP authorization for GovCloud users to access managed LLMs.
A man from Nashville was arrested for helping North Korean IT workers deceive U.S. companies.
Microsoft Exchange 2016 will lose support on October 14, 2025, so admins should consider moving to Exchange 2019 for continued security updates.
UK-based Mobile Guardian, a device management vendor for education, suffered a security breach on August 4. The incident led to unauthorized access to iOS and ChromeOS devices, causing 13,000 devices in Singapore to be remotely wiped. The attack unenrolled a small percentage of devices globally.
CrowdStrike has released a report explaining the software update crash that affected Windows systems worldwide. The crash was caused by a mix of security vulnerabilities and process gaps, leading to a system crash. CrowdStrike is working with Microsoft to improve security measures and prevent future incidents.
Now that Artifact Attestation is generally available, GitHub has published a walkthrough on how to use it. GitHub created the attest-build-provenance action, which can be added to a workflow to add an Attestation to a built artifact. GitHub also released a Kubernetes admission controller, which can be deployed in clusters to verify artifacts' attestations before deployment.
RedHunt Labs has introduced the Interactive Attack Surface Graph for cybersecurity management. The tool provides visual insights to identify threats and vulnerabilities efficiently. Similar graph-based tools can empower security teams to make informed decisions and protect digital assets effectively.
Researchers used a new verification framework, VeriCHERI, to find and fix a vulnerability in a processor vulnerable to Meltdown-style attacks. VeriCHERI focuses on security properties rather than conforming to a specification, making it effective in detecting vulnerabilities like timing side channels. This approach enhances security verification for processors like CHERIoT Ibex, improving protection against attacks exploiting microarchitectural weaknesses.
Amazon has revealed Mithra, an internal security platform that uses a massive graph database to defend its network. It processes vast amounts of data to identify threats, often automating responses without human intervention.
Humble is a humble and fast security-oriented HTTP headers analyzer.
A command line tool to query the list of public AWS IP Ranges without needing to write additional scripts or complex parsing. This allows for looking up details such as whether an IP belongs to AWS and if so what service/region it belongs to as well as what IPs are associated with a service/region.
The U.S. Justice Department and FTC have sued TikTok and ByteDance for allegedly violating children's privacy laws. The lawsuit claims TikTok collected data from millions of under-13 users, allowed them to interact with adults, and ignored parental deletion requests. TikTok denies these allegations.
Trail of Bits performed an audit of the popular macOS package manager, Homebrew. The audit found several issues in the brew CLI that could allow for unsandboxed, local code execution but this was in line with Homebrew's threat model of trusted formulae. The audit also uncovered misuse-prone patterns in the CI/CD process that could allow a lower-privileged insider to undermine the integrity and isolation assumptions made by the Homebrew CI/CD.
DARPA has announced a new project known as TRACTOR to address memory safety vulnerabilities in legacy software. The goal of the program is to create a tool to automatically convert legacy C code to Rust. DARPA is holding a Proposers Day with applications due by August 19.
Google Chrome will soon support Web Monetization, allowing website owners to receive micro-payments for their content.
CISA and FBI have released a guide to help organizations buying software understand the cybersecurity practices of vendors.
Samsung's bug bounty program has increased its maximum bug bounty reward to $1 million and introduced bonus rewards for high-quality vulnerability reports.
Sponsored
IT admin work is an unavoidable part of running a secure organization — but you can cut at least half of it with the right systems in place.
Researchers are tracking a campaign that utilizes 2,600 Telegram bots to promote malicious Android APKs controlled by 13 C2 servers. The bots deliver the malware by either directing victims to fake download pages that mimic Google Play or by promising to deliver victims a pirated APK. The malware transmits captured SMS messages to a website that offers anonymization services by using these phone numbers to relay OTP codes.
Checkmarx researchers have discovered an infostealer campaign targeting users of the Raydium and Solana blockchains. The campaign published a set of PyPi packages purporting to be official packages and then posted high quality responses on StackExchange threads that promoted the malicious packages. The packages were downloaded over 2,000 times before being removed from PyPi.
A new Android trojan called BlankBot, aimed at Turkish users, offers attackers extensive malicious capabilities. It poses as utility apps and tricks users into granting permissions. BlankBot can log device information, steal sensitive data, and perform custom injections.
This post breaks down the pros and cons of storing JWT tokens in cookies vs Session/Local Storage. Neither option is completely secure. Cookies used with HttpOnly are protected from JavaScript but they are vulnerable to CSRF and can be used in XSS attacks because the browser will send them on every request. Session and Local Storage are not vulnerable to CSRF but are designed to be accessed from JavaScript and are also vulnerable to XSS. Session Storage is per-tab, so users that open a link in a new tab will be logged out in that tab.
This article begins with discussing some dark patterns in cloud pentesting before offering a 7 stage roadmap to ramp up in AWS pentesting. The first couple of stages begin with solving Red Team labs with official and community walkthroughs before beginning to do CTFs independently. The next couple of stages involve automating exploits for CTFs and learning to build a secure AWS environment with CloudSLAW. The final stages focus on filling in knowledge gaps, synthesizing knowledge, and continuous learning.
Use secure guardrails instead of traditional “shift-left” gates. Secure guardrails integrate directly into developer workflow, should offer autofixes or advice that aligns with organization policies, and should empower developers to write more secure code and use secure-by-default libraries while also allowing developers to adjust or override guardrails when needed. Semgrep can be used to implement secure guardrails and provides a scorecard to grade your implementation of secure guardrails.
Prompt Airlines is an AI Security CTF that contains 5 levels of increasingly difficult challenges. The ultimate goal is to manipulate an AI chatbot to get a free airline ticket.
Dioptra is a software test platform for assessing the trustworthy characteristics of AI. Trustworthy AI is valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair - with harmful bias managed.
urlhunter is a recon tool that enables search on URLs exposed via shortener services such as bit.ly and goo.gl.
Since 2018, 138 legal firms globally have confirmed ransomware attacks affecting 2.9 million records. 2023 saw the most attacks (45) and records impacted (1.6 million). Average ransom demands are $2.47 million, with $1.65 million typically paid.
Researchers have uncovered a new DDoS campaign called Panamorfi targeting misconfigured Jupyter Notebooks. It uses a Java-based tool, mineping, to launch TCP flood attacks. The attack exploits exposed Jupyter instances to download malicious files, which then connect to a Discord channel and execute the DDoS tool, overwhelming target servers.
This post discusses leveraging vulnerabilities in iOS to achieve full Remote Code Execution (RCE) in WebRTC based protocols. It covers topics like breaking Address Space Layout Randomization (ASLR) and exploiting shared libraries like SignalServiceKit. By chaining together various leaks and utilizing ARM64 ROP chains, the researchers successfully achieved their goal of leaking Signal-iOS's database.
A Chinese hacking group named StormBamboo compromised an ISP to inject malware into software updates by exploiting insecure update mechanisms.
A Russia-linked group used car-for-sale phishing lure to target diplomats with a Windows backdoor called HeadLace.
CISA appointed Lisa Einstein as its first Chief Artificial Intelligence Officer to advance cybersecurity efforts in using AI responsibly.
Sponsored
Many companies think of compliance in terms of templates and generic checklists. These box-ticking exercises are high-effort, slow, and can cause teams to take compliance and security less seriously (or treat it as a nuisance).
DigiCert announced that it will be revoking 0.4% of certificates issued from August 2019 to June 2024. The CABF baseline domain verification requirement is to publish a CNAME record with the domain followed by an underscore and random value. A bug introduced in August 2019 led to some code paths not appending the underscore which could potentially lead to clashes between the record and subdomains. DigiCert says this is unlikely due to the random value having 150 bits of entropy, but nevertheless has notified customers that it will be revoking affected certificates.
CISA and several security companies are warning that two ServiceNow vulnerabilities that were reported by AssetNote on July 11 are being actively exploited. The vulnerabilities allow attackers to access databases and exfiltrate data as well as read arbitrary files. Researchers warn of between 13k to 42k vulnerable ServiceNow instances ranging across the private and public sectors.
Microsoft admitted its defensive implementation worsened the Azure outage on July 30, which was initially triggered by a DDoS attack. DDOS attacks aim to overwhelm systems with malicious traffic. They are becoming increasingly common, so Microsoft should have been able to prevent the outage.