Tal Be'ery, co-founder of ZenGo, performed a first ever analysis of AWS Session Tokens to uncover the components that make up a session token. The goal of this research was to discover if the tokens contained sensitive information and if tokens could be edited for forgery as well as other attack vectors. The research found that session tokens are base64 encoded protobufs that store most of the interesting information in a userEncryptedData field. The researchers found that they could forge tokens however AWS rejected forged tokens. The post includes more details about the reversing process and protobuf fields.
2024.08.02·links.tldrnewsletter.com·17 min read·TLDR InfoSec An exploration of how to incrementally improve credentials access in AWS. The post begins with outlining a “vanilla” credentials workflow before detailing how environment variables do not solve the threats inherent with having plaintext credentials. It then outlines how to store secrets in Secrets Manager and have the application dynamically retrieve them to eliminate plaintext secrets from production. The next improvement comes from using KMS to encrypt secrets before using them in CI/CD pipelines to reduce the presence of plaintext credentials. The post then details steps that service providers can use to improve credential management for customers including bringing your own key.
This blog post discusses creating a custom implant for evasive purposes by avoiding detection through customized payloads. It explains the process of building the implant in C and includes details on server setup, interactive features, client functionality, and testing against security tools. The conclusion highlights the advantages of custom implants but also emphasizes the need for caution due to potential limitations and security considerations.
Fleet is an open-source version of FleetDM's tool. It is built on Osquery and can be used for vulnerability monitoring, MDM, detection engineering, and other applications.
A collection of templates for SOC2 policies and procedures. The templates can be outputted as an HTML dashboard or in PDF.
Clutch Security is a platform that gives security teams visibility into all of an organization's non-human identities. The platform allows security teams to understand which NHIs exist within the organization and identify associated risks.
Ransomware attacks are rising, with an 18% year-on-year increase reported by Zscaler ThreatLabz. A record $75 million ransom was allegedly paid this year. The U.S. faces nearly half of all attacks, with a 93% increase. The U.K. was the second most targeted country.
The UK Electoral Commission was reprimanded by the ICO for a security lapse that left millions of voters' data vulnerable to hackers. The breach, which lasted over a year from August 2021, was enabled by unchanged passwords and outdated software.
A joint analysis by Infoblox and Eclypsium reveals that Russian cybercriminals are exploiting DNS weaknesses in "Sitting Ducks" attacks to hijack domains without accessing owner accounts. This method, easier and less detectable than other hijacking techniques, has affected over 35,000 domains since 2018.
The average cost of a data breach jumped 10% to $4.88 million in 2023.
Twilio has shut down its Authy for Desktop app, logging users out and discontinuing the service.
Hackers used Stack Exchange to trick developers into downloading malicious Python packages that could steal cryptocurrency.
Sponsored
Between DSPM, AI data management, and cloud risk, it's a new era in data security. Explore the latest trends at BigID's virtual CISO summit [4], designed exclusively for security leaders like you.
A new version of Mandrake Android spyware infiltrated Google Play in 2022 and remained undetected for two years with over 32,000 downloads. This sophisticated spyware allows attackers to steal data, control devices, and blackmail victims. Five apps carried the malware, with AirFS being the most recent one.
Microsoft has posted a warning about a vulnerability in domain joined ESXi hypervisors. ESXi hypervisors were found to consider any member of the AD group “ESX Admins” to have full administrative privileges. Microsoft recommends applying the latest patches. The post includes threat hunting queries.
Wiz has detected a campaign that targets exposed Selenium Grid services. The attackers are using the Selenium WebDriver API to run a Python reverse shell to download a crypto miner. Selenium warns against exposing Selenium Grid to the public Internet and enabling authentication by default.
2024.07.31·links.tldrnewsletter.com·10 min read·TLDR InfoSec iChano AtHome Camera is a pair of applications that enable smartphones and computers to be used as smart cameras. The applications use a custom encryption protocol instead of HTTPS. This author first attempted to crack the encryption protocol using static reverse engineering but discovered that it was using Blowfish in ECB mode. Decryption with this method didn't work, so the author utilized a Frida script to decrypt messages and hijack cameras on the network.
This blog post discusses how CISOs face urgent challenges in establishing effective security practices and provides some guidelines on how to create effective AI Cybersecurity policy. Key recommendations include prohibiting sensitive data sharing with public AI platforms, validating AI-generated information, and adopting a zero-trust approach. While AI presents risks, it also offers significant benefits when used wisely, making a thoughtful security strategy crucial for organizations navigating this evolving landscape.
Sponsored
Last year saw a 429% increase in stolen data [11], along with an 84% increase in ransomware attacks. Is geopolitical instability to blame? How can security orgs outmaneuver adversary tactics and techniques? And what is the role of open-source intelligence (OSINT)? Download the
Lineaje comprises a software bill of materials (SBOM) manager and an SBOM exchange, as well as a third-party risk manager and an open source risk manager, which can be used by companies that source, build, buy, or use software applications.
Arcjet's JS SDKs feature rate limiting, bot protection, email verification, and attack defense for Node.js, Next.js, Bun, and SvelteKit.
RedGuard is a C2 front flow control tool with AV and EDR evasion.
This landmark settlement between Texas and Meta for $1.4 billion over Facebook's facial recognition feature sets a precedent for privacy rights enforcement. The lawsuit, filed in 2022, claimed the "Tag Suggestions" feature breached biometric identifiers and deceptive trade practices acts.
The Kids Online Safety Act (KOSA) has passed the Senate. This act requires online platforms to protect minors from various harms. It mandates transparency in algorithm use, opt-out options for data collection, and limits on addictive features. Critics worry about potential misuse of surveillance and censorship.
SideWinder is targeting ports and maritime facilities in the Mediterranean Sea and Indian Ocean using phishing emails with specific themes and logos. The threat actor uses techniques like spear-phishing and document exploitation to deliver targeted implants. Malicious documents with remote template injection techniques are used to gain initial access to victims' systems.
New laws will require Australian businesses to disclose ransom payments to hackers to increase transparency and combat ransomware attacks.
Crooks bypassed Google's email verification to create Workspace accounts and access third-party services - the issue was fixed within 72 hours of discovery.
This post uncovers new cybercrime tools that pose increased threats to security, highlighting the rapid evolution of AI-powered hacking services and their potential for mass exploitation.
Sponsored
Manual penetration testing will only get you so far, and most companies rarely find the time and resources to do it regularly.
A Python package named "lr-utils-lib" was found to have hidden malicious code targeting macOS systems to steal Google Cloud Platform credentials. The malware sends harvested credentials to a remote server and is linked to a fake LinkedIn profile, raising concerns about social engineering tactics and AI verification challenges. This incident highlights the importance of cybersecurity practices, such as vetting third-party packages and critically evaluating information from AI sources, in preventing potential security risks for individuals and enterprises.
Gemini cryptocurrency exchange disclosed a data breach involving banking information of some customers. The breach was caused by a cyberattack on a third-party service provider. Gemini is advising impacted individuals to stay vigilant and take measures to protect their bank accounts from potential fraud.
A critical bug in Docker Engine lets attackers bypass authorization plugins in certain versions by sending API requests with no content, leading to potential unauthorized actions like privilege escalation. The vulnerability, tracked as CVE-2024-41110, affects specific versions of Docker Engine up to v27.1.0 and Docker Desktop up to version 4.32.0. It can be mitigated by updating to the latest patched versions, avoiding AuthZ plugins, and restricting access to the Docker API.
The Mercari Security team discusses its process for creating a tool to map an attack surface. The first iteration of the tool sought to scan IaC for domains and scan them using the Burp Enterprise API. This strategy failed, as their IaC did not contain all domains. The next iteration involved directly querying asset inventories from AWS and GCP and then spinning up a GCR task to utilize a Chromium browser to take screenshots and then visualize the hostnames and IP addresses found.
This blog post discusses how Named Pipes can be used by attackers for Command and Control and how defenders like EDRs can detect these usages. Attackers can exploit named pipes to move laterally within a network. Monitoring named pipe creation and communication patterns can help detect malicious activities.
2024.07.29·links.tldrnewsletter.com·17 min read·TLDR InfoSec Nvidia's team will be sharing insights from red-teaming the company's AI systems. While AI applications pose significant enterprise risks due to their privileged status, existing security practices can be adapted to address these new threats.
Sponsored
cuts through the noise by identifying package upgrades that resolve multiple security issues at once. Now you can knock out dozens of vulnerabilities with one fix, instead of chasing CVEs one at a time.
AskJOE is a Ghidra script that calls OpenAI's API to add meaning to decompiled functions.
Sigma Filters are a new tool that helps Security Operations Centers manage threat detection more effectively. They allow for the creation of specific filters separate from detection rules, improving rule management and reducing false positives. By using Sigma Filters, SOC analysts can better tailor detection rules to their unique environments and avoid detection evasion by attackers.
Zerotier creates secure connections between devices such as routers or IoT devices and has them talking away as if they're on a local network to secure them.
Kane Narraway, a security manager at Canva, writes about the benefits of a Security Platform Engineering team that can develop new solutions to scale security as well as build secure-by-default systems with other teams. Narraway reflects on the reality that in many organizations, security engineers form this function as another part of their role which can lead to complications when employees leave or maintain the system. Narraway suggests that this function should come after a security team is fully staffed and should ideally be composed of at least two software engineers and a manager.
The Macma backdoor is linked to the Daggerfly toolkit. Symantec has shared code and infrastructure with other known Daggerfly malware. A new Windows backdoor named Suzafk, capable of using TCP or OneDrive for command and control purposes, has been added to the Daggerfly toolkit. Daggerfly is a sophisticated espionage group with a wide range of tools targeting various operating systems and the ability to quickly update its toolset to evade detection.
2024.07.29·symantec-enterprise-blogs.security.com·4 min read·TLDR InfoSec There was a 30% YoY increase in global cyberattacks in Q2 2024, averaging 1,636 attacks per organization weekly. Education/Research, Government/Military, and Healthcare were the most targeted sectors with Latin America, Africa, and Europe seeing the largest increase in attacks.
X quietly started using public posts to train its Grok AI chat platform without notifying users - this post discusses how this can be disabled.
Google is extending Enhanced mode feature for Safe Browsing in Chrome to allow users to upload password-protected executable files for deep scanning for malware detection.