BULLFROG
Bullfrog is a tool that increases the security of GitHub Actions workflows by defining a domain/IP allow list for outbound network connections that a workflow can access.
2024.07.10
Search the archive
Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Results
10,007 matchesEXPLORING COMPILED V8 JAVASCRIPT USAGE IN MALWARE
Malware authors are using compiled V8 JavaScript, a feature in Google's V8 engine, to convert JavaScript to low-level code. Checkpoint's "View8" tool can decompile malicious V8 applications, revealing how threat actors hide code and evade detection. This article analyzes malicious V8 bytecode to reveal insights into malware behavior.
2024.07.10
MICROSOFT-OWNED ADTECH XANDR ACCUSED OF EU PRIVACY BREACHES
European privacy group noyb is supporting a complaint against Xandr filed with Italy's data protection authority. The complaint alleges GDPR violations, including transparency failures and data access rights breaches related to microtargeted advertising profiles. If upheld, Xandr could face compliance orders and fines up to 4% of Microsoft's annual turnover.
2024.07.10
RUSSIA FORCES APPLE TO REMOVE DOZENS OF VPN APPS FROM APP STORE
Apple has removed 25 VPN apps from the Russian App Store at the request of Roskomnadzor, Russia's telecommunications watchdog. The ban targets apps used to access content deemed illegal in Russia, including NordVPN and Proton VPN.
2024.07.10
RANSOMWARE ATTACK DEMANDS REACH A STAGGERING $5.2M IN 2024
The average extortion demand per ransomware attack was over $5.2m in the first half of 2024, which saw 421 confirmed ransomware attacks impacting around 35.3 million records.
2024.07.10
LINKSYS VELOP ROUTERS SEND WI-FI PASSWORDS IN PLAINTEXT
Two models of Linksys Velop routers send SSIDs and passwords to AWS in plaintext.
2024.07.10
US AND PARTNERS DISRUPT BOT FARM PUSHING RUSSIAN PROPAGANDA
A bot farm pushing Russian propaganda on X was disrupted by a joint international law enforcement operation led by the U.S. Justice Department.
2024.07.10
Sponsored
TESTING — AND COSTS 50% LESS
Does your network have vulnerabilities hackers can exploit? If you're not network pentesting, you're not going to know.
2024.07.08
ALABAMA STATE DEPARTMENT OF EDUCATION SUFFERED A DATA BREACH FOLLOWING A BLOCKED ATTACK
The Alabama State Department of Education stopped a ransomware attack on June 17, but some data was accessed and services disrupted. Parents and education employees are advised to monitor their credit, as student and employee data may have been compromised.
2024.07.08
ROLL20, AN ONLINE TABLETOP ROLE-PLAYING GAME PLATFORM, DISCLOSES DATA BREACH
Roll20 announced a data breach on June 29 where a hacker accessed its administrative website for an hour. The breach potentially exposed users' personal information including names, email addresses, partial credit card numbers, and IP addresses.
2024.07.08
APACHE FIXED A SOURCE CODE DISCLOSURE FLAW IN APACHE HTTP SERVER
The Apache Foundation fixed a critical vulnerability (CVE-2024-39884) in its Apache HTTP Server related to source code disclosure. The vulnerability could lead to unauthorized access and remote code execution issues. Users are advised to update to version 2.4.61 to address these security concerns.
2024.07.08
JULY 2: POLYFILL.IO SUPPLY CHAIN ATTACK – DIGGING INTO THE WEB OF COMPROMISED DOMAINS
This post dives into a supply chain attack on the JavaScript library Polyfill.io that affected over 384,000 hosts, including major websites. While the immediate threat has been mitigated, experts advise removing all references to Polyfill.io.
2024.07.08
CATCHING COMPROMISED COOKIES
This post details how Slack detects compromised session cookies to prevent session hijacking. Slack Initially attempted to build its system by looking at the last accessed timestamp of a particular cookie to determine session forking but quickly determined that this led to a lot of false positives and added more information such as the IP address. The post also examines how performance concerns were mitigated and the rollout procedure.
2024.07.08
EXPLOITING CLIENT-SIDE PATH TRAVERSAL TO PERFORM CROSS-SITE REQUEST FORGERY
A group of researchers have discovered a method that utilizes Client-Side Path Traversal (CSPT) to achieve Cross-Site Request Forgery (CSRF). CSPT vulnerabilities have historically been viewed as low severity due to limited impact. This research shows that an attacker could utilize a CSPT vulnerability to chain a CSRF vulnerability and execute actions on behalf of an end user to a web application. The post includes examples of how CSPTs can be utilized to cause CSRF such as by using an open redirect to leak sensitive data associated with the source.
2024.07.08
GETREAL LABS
GetReal Labs provides real-time detection and deep understanding of deep fakes and supports forensic analysis.
2024.07.08
BBOT
A recursive internet scanner for hackers.
2024.07.08
IMAGE AUTOMATION CONTROLLER
A GitOps controller that patches container image tags in Git.
2024.07.08
MICROSOFT'S MIDNIGHT BLIZZARD SOURCE CODE BREACH ALSO IMPACTED FEDERAL AGENCIES
Microsoft notified the US Department of Veterans Affairs and other agencies about potential impacts from the "Midnight Blizzard" Russian hacking group's breach. The VA department reported a brief unauthorized access to a test environment. While some agencies' data may have been stolen, sensitive information was reportedly not compromised.
2024.07.08
HACKERS LEAK ALLEGED TAYLOR SWIFT TICKETS, AMP UP TICKETMASTER EXTORTION
Hackers have allegedly leaked Taylor Swift concert ticket data and demanded $2 million from Ticketmaster in an attack that seems to be attributable to the Snowflake breach. The data breach involved 166,000 barcode entries for upcoming concerts.
2024.07.08
ROCKYOU2024: 10 BILLION PASSWORDS LEAKED IN THE LARGEST COMPILATION OF ALL TIME
A new password compilation that consists of nearly 10 billion passwords was discovered by security researchers. The compilation expands on RockYou2021 with an additional 1.5 billion passwords.
2024.07.08
CHATGPT'S MUCH-HERALDED MAC APP WAS STORING CONVERSATIONS AS PLAIN TEXT
ChatGPT for Mac initially stored user chats in plain text that was accessible to any process on the machine.
2024.07.08
CLOUDFLARE 1.1.1.1 INCIDENT ON JUNE 27, 2024
This post details how a BGP hijack and route leak occurred on June 27 during the Cloudflare 1.1.1.1 incident, causing traffic disruptions.
2024.07.08
CISA RELEASES GUIDE TO OPERATIONAL SECURITY FOR ELECTION OFFICIALS
The CISA released a guide to help election officials improve operational security during elections.
2024.07.08
3 MILLION IOS AND MACOS APPS WERE EXPOSED TO POTENT SUPPLY-CHAIN ATTACKS
A group of researchers discovered 3 vulnerabilities in the CocoaPods trunk server. The first vulnerability allows attackers to social engineer pod developers by spoofing the XFH header when sending developers an email for authentication to generate a link to an attacker-controlled server. The second vulnerability allows attackers to take over abandoned pods without proof of ownership. The third vulnerability allows attackers to execute remote code on trunk servers with malicious MX records.
2024.07.05
LATEST INTEL CPUS IMPACTED BY NEW INDIRECTOR SIDE-CHANNEL ATTACK
Researchers have discovered a new Branch Target Injection vulnerability in Intel CPUs that could be used to steal sensitive information. The attack has three components: the iBranch Locator uses eviction-based techniques to identify the indices and tags of victim branches and determine the Indirect Branch Predictor entries for them, targeted injections are then performed against the prediction structures to perform speculative code execution, and then an ASLR bypass makes the prediction and manipulation of control flow of protected processes easier. The researchers reported their findings to Intel and recommended more aggressive use of the Indirect Branch Protection Barrier and bolstering the Branch Prediction Unit design.
2024.07.05
TWILIO CONFIRMS DATA BREACH AFTER HACKERS LEAK 33M AUTHY USER PHONE NUMBERS
The ShinyHunters hackers announced that they will leak 33M random phone numbers associated with Authy. Twilio has confirmed the breach. It reported that the vulnerability was due to an unauthenticated endpoint and that no systems were compromised. Twilio has secured the endpoint and is encouraging users to be vigilant for phishing and smishing attacks.
2024.07.05
AMAZON DOCUMENTDB ANNOUNCES IAM DATABASE AUTHENTICATION
Amazon DocumentDB has added support for authentication using IAM users and role ARNs. Users and applications that connect to DocumentDB clusters can now use an IAM identity to authenticate, allowing for a passwordless experience. Clusters can also choose to allow both IAM and password authentication if desired.
2024.07.05
VULNERABILITIES IN COCOAPODS OPEN THE DOOR TO SUPPLY CHAIN ATTACKS AGAINST THOUSANDS OF IOS AND MACOS APPLICATIONS
Researchers from Evasec have found vulnerabilities in CocoaPods that could let attackers insert malicious code into popular iOS and macOS apps by claiming ownership of unclaimed pods. Developers using CocoaPods should check their open source dependencies for security risks, as these vulnerabilities could lead to supply chain attacks affecting thousands of Apple device apps. CocoaPods has addressed the vulnerabilities, but organizations should follow security steps to protect their code from potential exploits.
2024.07.05
THE RUNTIME SECRETS' SECURITY GAP
This blog post discusses a new solution that introduces encrypted secret delivery directly into application memory to prevent exposure. Secrets can be securely stored, delivered, and accessed without compromising security using tools like tang, clevis, and latchy.
2024.07.05
DECLARE YOUR AINDEPENDENCE: BLOCK AI BOTS, SCRAPERS, AND CRAWLERS WITH A SINGLE CLICK
Cloudflare has launched the ability for all accounts (including free accounts) to block all AI bots, crawlers, and scrapers with a single toggle under the Security -> Bots section. Cloudflare uses its global bot detection ML model to categorize traffic as potentially bot related. Under the new heuristic, traffic classified with a bot score under 30 will be blocked automatically.
2024.07.05
DNSTWIST
DNSTwist lets you find lookalike domains that adversaries can use to attack your domain. This can let you detect typosquatters, phishing attacks, fraud, and brand impersonation. It can be useful as an additional source of targeted threat intelligence.
2024.07.05
FILELESS-ELF-EXEC
fileless-elf-exec is a Python script that generates interpreted code which creates the supplied ELF as a file in memory and executes it. This makes it possible to execute binaries without leaving traces on the disk.
2024.07.05
INTRODUCING DOCS IN PROTON DRIVE
Proton is introducing end-to-end encrypted document editing and sharing to Proton Drive. The company states that all files, media, metadata, and keystrokes are completely encrypted and cannot be accessed by Proton or government surveillance (as it operates under Swiss privacy laws). Proton has begun rolling the feature out and it will be available to all users within the next few days.
2024.07.05
NEW GOLANG-BASED ZERGECA BOTNET CAPABLE OF POWERFUL DDOS ATTACKS
A new botnet named Zergeca can launch powerful DDoS attacks and has advanced capabilities like proxying and reverse shell. It is written in Golang and uses DNS-over-HTTPS for communication with its command-and-control servers. The botnet has been actively targeting countries like Canada, Germany, and the U.S. with various attack methods.
2024.07.05
MALLOX RANSOMWARE: LINUX VARIANT DECRYPTOR FOUND
Mallox ransomware, which has been active since 2021, has evolved to target Linux systems using custom Python scripts for payload delivery and data exfiltration. The new variant employs AES-256 CBC encryption, appends .lmallox to encrypted files, and utilizes a Flask-based web panel for creating customized ransomware builds. Researchers have discovered decryptors for several build IDs and provided methods for detecting and hunting Mallox infrastructure using security tools like Uptycs XDR and search engines such as FOFA and Censys.
2024.07.05
EUROPOL ANNOUNCES CRACKDOWN ON COBALT STRIKE SERVERS USED BY CYBERCRIMINALS
Europol took down almost 600 Cobalt Strike servers used by cybercriminals in a global crackdown.
2024.07.05
OVHCLOUD BLAMES RECORD-BREAKING DDOS ATTACK ON MIKROTIK BOTNET
OVHcloud has been able to track a massive DDoS attack in May, which reached 2.5 Tbps, to Mikrotik botnet.
2024.07.05
STUDY: NEARLY 60% OF GOOGLE SEARCHES END WITH ZERO CLICKS
A recent study found that almost 60% of Google searches don't result in users clicking on search results.
2024.07.05
Sponsored
LONG
Security positions are in high demand. They offer excellent compensation and stability amid a shakier tech ecosystem.
2024.07.03
Request information and apply for free.
_SNHU is currently only accepting US students for this program._
2024.07.03
degrees.snhu.eduTLDR InfoSec
REGRESSHION: REMOTE UNAUTHENTICATED CODE EXECUTION VULNERABILITY IN OPENSSH SERVER
A vulnerability from 2006 has been reintroduced in OpenSSH. This vulnerability is caused by a signal handler race condition and could allow for unauthenticated remote code execution as root on glibc-based Linux systems. Qualys identified over 14 million potentially vulnerable internet-facing SSH servers and recommends immediate patching to prevent exploitation.
2024.07.03
JUNIPER NETWORKS RELEASES EMERGENCY PATCHES FOR CRITICAL VULNERABILITY
Juniper Networks has released emergency patches for routers due to a critical CVE. The vulnerability is an authentication bypass in Juniper Networks' Session Smart Routers and Conductors running with a redundant peer. Juniper does not have evidence of ongoing exploitation but urges immediate patching.
2024.07.03
EVOLVE BANK DATA BREACH IMPACTED FINTECH FIRMS WISE AND AFFIRM
Fintech firms Wise and Affirm were impacted by a recent data breach at Evolve Bank. Evolve Bank & Trust confirmed the security breach and is investigating the incident. Affirm and Wise are reaching out to customers whose data may have been compromised.
2024.07.03
MITIGATING SKELETON KEY, A NEW TYPE OF GENERATIVE AI JAILBREAK TECHNIQUE
Researchers at Microsoft found a new generative AI jailbreak technique to avoid guardrails in models. The Skeleton Key attack involves asking the model to augment its behavior as opposed to modifying it by having the model provide a warning before the blocked content instead of refusing to produce it. This blog provides examples of Skeleton Key prompts and some suggestions, such as output filtering, to mitigate this attack.
2024.07.03
ATTACK PATHS INTO VMS IN THE CLOUD
A comprehensive overview of different attacks against VM services from AWS, Azure, and GCP. The overview examines six classes of attack vectors and provides a scenario, overview, example attack, and mitigation for each attack. The attack vectors are vulnerability exploitation, startup script manipulation, SSH key push, direct code execution, SSH over middleware, and serial console access.
2024.07.03
EXTENDING BURP SUITE FOR FUN AND PROFIT - THE MONTOYA WAY
The first part of an ongoing series on building Burp Suite extensions using the new Montoya API. The first post explains Burp Extender and the Montoya API and walks through the process of setting up your environment to build a Hello World extension. Subsequent posts include topics such as interacting with HTTP requests and websockets, modifying the UI, and adding functionality to the context menu.
2024.07.03
INTRODUCING DETECTION AS CODE BETA SUPPORT IN RUNREVEAL
RunReveal has introduced Detection as Code in beta, enabling users to manage security detections using code. This feature integrates with the runreveal CLI, allowing easy export and import of detections in JSON or YAML formats. Users can create, test, and deploy new detections efficiently, with GitHub actions supporting CI/CD workflows.
2024.07.03
HSC24REDTEAMINFRA
This repository includes the slides and code used for the workshop Red Team Infrastructure Automation at HSC24. It also includes some automation scripts to start with for redirectors, teamservers, RedELK, and more.
2024.07.03
CHROMEDB
Chromedb is a tool that can read Chromium data like cookies and local storage straight from disk without spinning up the browser.
2024.07.03
SUPPLY CHAIN COMPROMISE LEADS TO TROJANIZED INSTALLERS FOR NOTEZILLA, RECENTX, COPYWHIZ
Trojanized installers for Notezilla, RecentX, and Copywhiz have been discovered distributing malware capable of stealing information and executing additional payloads. The malware observed can steal browser credentials, cryptocurrency wallet information, clipboard contents, and keystrokes. These malicious installers, belonging to a malware family known as dllFake, were distributed through the official website and have been active since early June.
2024.07.03