Search the archive

Start for free now →

MALICIOUS PYTHON PACKAGE TARGETS MACOS DEVELOPERS TO ACCESS THEIR GCP ACCOUNTS

A Python package named "lr-utils-lib" was found to have hidden malicious code targeting macOS systems to steal Google Cloud Platform credentials. The malware sends harvested credentials to a remote server and is linked to a fake LinkedIn profile, raising concerns about social engineering tactics and AI verification challenges. This incident highlights the importance of cybersecurity practices, such as vetting third-party packages and critically evaluating information from AI sources, in preventing potential security risks for individuals and enterprises.

CRYPTO EXCHANGE GEMINI DISCLOSES THIRD-PARTY DATA BREACH

Gemini cryptocurrency exchange disclosed a data breach involving banking information of some customers. The breach was caused by a cyberattack on a third-party service provider. Gemini is advising impacted individuals to stay vigilant and take measures to protect their bank accounts from potential fraud.

CRITICAL BUG IN DOCKER ENGINE ALLOWED ATTACKERS TO BYPASS AUTHORIZATION PLUGINS

A critical bug in Docker Engine lets attackers bypass authorization plugins in certain versions by sending API requests with no content, leading to potential unauthorized actions like privilege escalation. The vulnerability, tracked as CVE-2024-41110, affects specific versions of Docker Engine up to v27.1.0 and Docker Desktop up to version 4.32.0. It can be mitigated by updating to the latest patched versions, avoiding AuthZ plugins, and restricting access to the Docker API.

MAPPING THE ATTACK SURFACE FROM THE INSIDE

The Mercari Security team discusses its process for creating a tool to map an attack surface. The first iteration of the tool sought to scan IaC for domains and scan them using the Burp Enterprise API. This strategy failed, as their IaC did not contain all domains. The next iteration involved directly querying asset inventories from AWS and GCP and then spinning up a GCR task to utilize a Chromium browser to take screenshots and then visualize the hostnames and IP addresses found.

THREAT HUNTING - SUSPICIOUS NAMED PIPES

This blog post discusses how Named Pipes can be used by attackers for Command and Control and how defenders like EDRs can detect these usages. Attackers can exploit named pipes to move laterally within a network. Monitoring named pipe creation and communication patterns can help detect malicious activities.

NVIDIA EMBRACES LLMS & COMMONSENSE CYBERSECURITY STRATEGY

Nvidia's team will be sharing insights from red-teaming the company's AI systems. While AI applications pose significant enterprise risks due to their privileged status, existing security practices can be adapted to address these new threats.

Tired of endlessly triaging open source vulnerabilities? FOSSA

cuts through the noise by identifying package upgrades that resolve multiple security issues at once. Now you can knock out dozens of vulnerabilities with one fix, instead of chasing CVEs one at a time.

Ready to work smarter? Try FOSSA free today

ASKJOE

AskJOE is a Ghidra script that calls OpenAI's API to add meaning to decompiled functions.

INTRODUCING SIGMA FILTERS

Sigma Filters are a new tool that helps Security Operations Centers manage threat detection more effectively. They allow for the creation of specific filters separate from detection rules, improving rule management and reducing false positives. By using Sigma Filters, SOC analysts can better tailor detection rules to their unique environments and avoid detection evasion by attackers.

ZEROTIER (PRODUCT LAUNCH)

Zerotier creates secure connections between devices such as routers or IoT devices and has them talking away as if they're on a local network to secure them.

BUILDING A SECURITY PLATFORM ENGINEERING TEAM

Kane Narraway, a security manager at Canva, writes about the benefits of a Security Platform Engineering team that can develop new solutions to scale security as well as build secure-by-default systems with other teams. Narraway reflects on the reality that in many organizations, security engineers form this function as another part of their role which can lead to complications when employees leave or maintain the system. Narraway suggests that this function should come after a security team is fully staffed and should ideally be composed of at least two software engineers and a manager.

DAGGERFLY: ESPIONAGE GROUP MAKES MAJOR UPDATE TO TOOLSET

The Macma backdoor is linked to the Daggerfly toolkit. Symantec has shared code and infrastructure with other known Daggerfly malware. A new Windows backdoor named Suzafk, capable of using TCP or OneDrive for command and control purposes, has been added to the Daggerfly toolkit. Daggerfly is a sophisticated espionage group with a wide range of tools targeting various operating systems and the ability to quickly update its toolset to evade detection.

CHECK POINT RESEARCH REPORTS HIGHEST INCREASE OF GLOBAL CYBER ATTACKS SEEN IN LAST TWO YEARS – A 30% INCREASE IN Q2 2024 GLOBAL CYBER ATTACKS

There was a 30% YoY increase in global cyberattacks in Q2 2024, averaging 1,636 attacks per organization weekly. Education/Research, Government/Military, and Healthcare were the most targeted sectors with Latin America, Africa, and Europe seeing the largest increase in attacks.

X BEGINS TRAINING GROK AI WITH YOUR POSTS, HERE'S HOW TO DISABLE

X quietly started using public posts to train its Grok AI chat platform without notifying users - this post discusses how this can be disabled.

CHROME WILL NOW PROMPT SOME USERS TO SEND PASSWORDS FOR SUSPICIOUS FILES

Google is extending Enhanced mode feature for Safe Browsing in Chrome to allow users to upload password-protected executable files for deep scanning for malware detection.

US DOJ INDICTS NORTH KOREAN HACKER FOR RANSOMWARE ATTACKS ON HOSPITALS

The US Department of Justice indicted a North Korean hacker for ransomware attacks on healthcare facilities, linking the funds to illicit activities in North Korea.

Try AI in Tines for free →

MICHIGAN MEDICINE NOTIFIES NEARLY 57K PATIENTS AFTER HEALTH INFORMATION POTENTIALLY EXPOSED IN CYBERATTACK

Michigan Medicine reported a data breach affecting approximately 57,000 individuals. Hackers accessed employee email accounts on May 23 and 29 and potentially accessed personal and health information.

KNOWBE4 DISCOVERS REMOTE WORKER IS REALLY A NORTH KOREAN HACKER

KnowBe4 recently disclosed that a remote software engineer that it hired was a North Korean hacker who was able to make it through the interview process and pass a background check. KnowBe4 detected that the hacker's Mac immediately started loading malware. The employee refused to take a call with the team and then became unresponsive, which led KnowBe4 to contact the FBI and Mandiant.

PKFAIL: UNTRUSTED PLATFORM KEYS UNDERMINE SECURE BOOT ON UEFI ECOSYSTEM

The Binarly team has published research on how leaked private keys like the ones from Intel Boot Guard and American Megatrends International were exposed. Hardware containing these keys is still being deployed. The PKfail issue exposes poor cryptographic management practices that put devices at risk of being bypassed during the boot process. To mitigate PKfail, device vendors should follow best practices for key management and users should stay informed about security patches.

HOW WE SECURELY GENERATE SENSITIVE SECRETS

Monzo wanted a secret generation process that no entity could compromise or manipulate. Password managers with passkeys grant this assurance but don't scale to services that need to run in cloud environments. To achieve its goal, Monzo built a repeatable, deterministic build process that utilized AWS Nitro Enclaves to securely generate secrets. This was used to cryptographically verify the integrity of environments.

A HARD LOOK AT GUARDDUTY SHORTCOMINGS

This article evaluates Amazon GuardDuty's coverage, efficacy, and cost. Coverage was limited to core attacks on core services, with few finding types across a few services. Foundational features are worth enabling, but others can be costly. GuardDuty failed to detect many tested attacks and had a best-case latency of 5:08 for an S3 ransomware simulation.

UNFASHIONABLY SECURE: WHY WE USE ISOLATED VMS

This blog post discusses the use of isolated virtual machines (VMs) to provide complete customer data separation in the architecture of Thinkst Canary. Each customer has their own VM, ensuring strong boundaries between services and data. This approach offers benefits like improved security, performance monitoring, regulatory compliance, and hardware fault isolation.

LAKERA (PRODUCT LAUNCH)

Lakera is a low-latency AI application firewall that secures traffic into and out of generative AI applications

GPT4-CAPTCHA-BYPASS

This project is a CLI tool for testing various types of captchas including puzzle, text, complicated text, and reCAPTCHA using Python and Selenium. The tool uses OpenAI GPT-4 to help solve the captchas.

FLOWANALYZER

FlowAnalyzer is a tool to help with low level understanding of OAuth 2.0 Grants/Flows. It includes support for OIDC as well as a dedicated section on JWTs.

FORGET SECURITY – GOOGLE'S RECAPTCHA V2 IS EXPLOITING USERS FOR PROFIT

Google's reCAPTCHA service, while promoted as a security mechanism, is actually harvesting user information and labor worth billions. reCAPTCHA is disliked by users, costly in time and resources, and vulnerable to bots.

INVISIBLE GHOST: ALARMING VULNERABILITY IN GITHUB COPILOT

The "Invisible ghost" vulnerability in GitHub Copilot allows hidden instructions to be embedded using invisible Unicode characters. It can be used to manipulate code suggestions without developer awareness and potentially inject harmful code.

CLOUDFLARE REPORTS THAT NEARLY 7% OF INTERNET TRAFFIC IS MALICIOUS

Cloudflare's State of Application Security Report revealed that 6.8% of all Internet traffic is malicious, with wars and elections theorized to be driving the uptick. It also noted that DDoS attacks are also on the rise, having blocked 4.5M DDoS attacks in the first quarter of 2024. About 38% of all HTTP requests processed by Cloudflare are classified as bot traffic.

DOUBLE DIPPING CHEAT DEVELOPER GETS CAUGHT RED-HANDED

The developer of the EvolvedAim cheat for Escape From Tarkov was caught selling the cheat with an information stealer embedded, putting users at risk.

ANYONE CAN ACCESS DELETED AND PRIVATE REPOSITORY DATA ON GITHUB

GitHub's repository design allows access to data from deleted and private repositories indefinitely, creating a significant security vulnerability known as Cross Fork Object Reference (CFOR).

MOVING TO A MORE PRIVACY-RESPECTING AND EFFICIENT METHOD OF CHECKING CERTIFICATE REVOCATION

Let's Encrypt will stop supporting OCSP in favor of CRLs for better privacy and efficiency.

TELEGRAM ZERO-DAY ENABLED MALWARE DELIVERY

ESET discovered a vulnerability in Telegram for Android dubbed EvilVideo which allows attackers to disguise malicious APK files as videos. The exploit uses Telegram's automatic file downloading so when users play the "video," they're prompted to install a malicious app.

SAFETY GEAR GIANT CADRE HOLDINGS REPORTS CYBERSECURITY BREACH

Cadre Holdings reported a cybersecurity breach on July 15. The company detected unauthorized access to its systems, promptly initiated response protocols, and engaged external experts. While certain operations are affected, the full impact remains unclear. Cadre is working to restore normal operations and continues to investigate the incident.

SQUARESPACE PUBLISHES ABOUT DOMAIN HIJACKING INCIDENTS

Squarespace has published an incident report about how some Squarespace Domains customers had their accounts compromised, leading to unauthorized changes in domain settings. Squarespace suspended affected accounts for security and restored access after verifying customer identities. It has strengthened security measures and continues to monitor for any abnormal activity.

UNIVERSAL CLOUD THREAT MODEL

Securosis and PrimeHarbor Technologies put together a provider and industry agnostic threat model for cloud environments. The model covers threat actors, objectives, targets, and techniques. The authors note that the vast majority of cloud attacks are untargeted/undifferentiated as even small targets can provide financial incentives.

GETTING STARTED WITH EXPLOIT DEVELOPMENT

A collection of courses to learn exploit development. The list of resources begins with buffer overflows before moving on to return oriented programming and other forms of corruption vulnerabilities. Each link includes an explanation of why that resource was chosen.

A FIVE YEAR RETROSPECTIVE ON DETECTION AS CODE

Detection as Code is the concept of taking advantage of the codifying process when writing detections. Detection as Code does not require the use of a full programming language and goes beyond storing detections in Sigma format. The future of Detection as Code lies in utilizing test driven development and CI/CD pipelines as well as utilizing LLMs to audit and improve context around detections.

PROTEXXA (PRODUCT LAUNCH)

Protexxa is an AI-powered platform that helps companies understand their cyber health. It finds exposed passwords, provides incident response plans, and recommends improvements.

BLT

OWASP BLT is a bug logging tool to report issues and get points.

RESPOTTER

Respotter is a honeypot designed to detect running instances of Responder. Respotter sends requests for a bogus host name and takes advantage of the fact that Responder will respond to any query.

GOOGLE'S PLAN TO TURN OFF THIRD-PARTY COOKIES IN CHROME IS DYING

Google has abandoned plans to disable third-party cookie tracking by default in Chrome. Instead, users will be asked to make an informed choice about tracking across websites. This decision follows years of testing and delays as early tests of Google's Privacy Sandbox alternative showed weaker results for re-marketing efforts.