Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
This blog post provides a detailed breakdown of the flaws in Lua runtime that led to an exploit in the video game Factorio. It's possible to leak memory addresses and manipulate objects in memory by exploiting Lua's handling of numbers as doubles. This manipulation allows for security flaws like bypassing ASLR in programs using Lua.
The Fakebat loader is a widespread loader malware sold as a service on cybercrime forums since at least December 2022. It is distributed through malvertising, fake software updates, and social engineering tactics. The malware offers anti-detection features and targets popular software applications.
Xbox Live experienced a seven-hour outage - Microsoft has since fixed the technical issues.
The Biden Administration is providing $504 million to expand twelve US tech hubs as part of the Tech Hub development program.
Google Pixel 6 series phones are being "bricked" after being factory reset.
Sponsored
As a 5* rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $7,000 per year [4] and ensure your business is always protected.
There is a vulnerability in Apple AirPods that allows anyone with the Bluetooth MAC address to connect and access the microphone or music. An update is available for affected AirPods models to fix the issue. Android users may face challenges updating the firmware as AirPods typically auto-update only with iOS or macOS devices.
Shoezone UK has reported a cyberattack that led to unauthorized access to its online systems and data. Despite the breach, the company's website is still functioning, and trade operations were not disrupted. Shoezone is taking steps to investigate the incident and protect customer data.
TeamViewer has notified customers that its corporate network was breached by APT29, also known as Cozy Bear and Midnight Blizzard. It assured customers that its corporate and customer networks are completely separate and no customer information was compromised. Health-ISAC informed providers that it has detected threat actors exploiting TeamViewer to attack networks. It is unclear if the two are related.
An in-depth blog post from GitHub that explores how unsafe deserialization vulnerabilities manifest in Ruby and works through the process of creating a gadget chain to detect unsafe deserialization vulnerabilities in the Oj library. The post breaks down how the universal deserialization gadget for Marshal works and how it can be adapted to the Oj and other deserialization libraries. It then extends the gadget chain that they create to achieve RCE using the zip command and lists the vulnerable sinks that CodeQL uses to detect unsafe deserialization vulnerabilities.
Rami McCarthy scraped AWS for publicly exposed SSM Command Documents that allow a configured IAM user to run a set of bundled commands against an instance. McCarthy detected exposed API keys and other secrets, S3 buckets, and other artifacts in the 2,472 exposed documents. AWS should make documents private by default and scan for exposed secrets automatically.
This blog post from CloudFlare outlines the ML algorithm used to identify and block residential proxy abuse. This model helps protect against distributed attacks while minimizing false positives for legitimate users. CloudFlare users can enable MLv8 to take advantage of this feature.
Web Check is an all-in-one OSINT tool for analyzing websites. This repository includes information for deploying the tool on Netlify, Vercel, Docker, or building from source. A live demo is also included.
Domain Protect GCP is a project that scans Google DNS across a GCP organization for domain records vulnerable to takeover. Alerts can be sent to Slack or email.
ELFie Scanner is a C++ POC for advanced process memory scanning that attempts to detect a number of malicious techniques used by threat actors and those that have been incorporated into open-source user-mode rootkits. It inspects every running process (both x86/x64) and its corresponding loaded libraries to look for evil. It then outputs the resultant telemetry into a NDJSON file.
Google will block websites using Entrust certificates in Chrome starting November 2024 due to compliance failures and security issues. This decision aims to ensure secure connections between browsers and websites, with users being warned of insecure connections from Entrust-issued certificates. Website operators are advised to switch to other trusted certificate authorities to avoid disruptions by October 31.
A report from CISA examined 172 broadly deployed open source projects. Some key findings include that 52% of the analyzed projects contain code written in memory unsafe languages, 55% of the total lines of code across all projects were written in memory unsafe languages, and that the median proportion of lines of code written in memory unsafe languages across the ten largest projects was 62.5% with four projects exceeding 94%. CISA notes that some of these projects are designed with critical performance and resource constraints where memory unsafe languages will likely remain prevalent.
This article discusses a critical DoS vulnerability that was found in WebRTC media servers that affected real-time communication availability. The vulnerability stems from a race condition between ICE and DTLS traffic, allowing attackers to disrupt media sessions. Exploiting this vulnerability involves sending a DTLS ClientHello message with a null cipher suite to targeted UDP ports on the media server.
308 different models of Sharp Multi-Function Printers (MFP) are vulnerable to 17 attacks outlined in this blog post.
Google Chrome is introducing an "Unrestricted WebUSB" feature for isolated web apps to access sensitive USB devices.
Zyxel NAS devices in Europe are facing a Mirai-like botnet attack due to critical vulnerabilities (CVE-2024-29973).
Sponsored
'Shift Left Security' doesn't end with code. Misconfigurations in source code management [4] (SCM) platforms like GitHub can be a serious problem. For example:
A new vulnerability affecting the SFTP module of MOVEit's software has been disclosed. With a CVSS score of 7.4, the vulnerability allows attackers to perform a forced authentication attack or upload an SSH public key to impersonate users without authentication. The vulnerability is under active exploitation.
Ollama recently fixed a vulnerability discovered by Wiz that could result in path traversal. The vulnerability exploits the lack of input validation in the /api/pull endpoint of the Ollama servers by using a specially crafted request to overwrite arbitrary files on the host system. Wiz's researchers note that there are still publicly exposed Ollama servers that are vulnerable to this flaw.
A South Korean telecom company infected over 600,000 users with malware for using torrent services. The malware caused missing files, created strange folders, and disabled PCs. Police identified and charged individuals connected to the attack. Investigations are still ongoing.
This blog post examines behavior from an attacker that Datadog saw in several customer environments. The attacker probed for S3 buckets and AWS Secrets Manager secrets, which is common but also, less commonly, probed for Glacier vaults. In all cases, the attacker did not take follow on actions. The attacker also signed their AWS API requests manually as opposed to using a library such as boto3, which handles signing.
This blog post describes how Google Cloud HMAC keys have vulnerabilities related to logging, management, and auditing. Users can create unlimited HMAC keys without proper oversight or control. These issues could lead to security risks and challenges for administrators in Google Cloud.
This blog post was written as a response to Google Project Zero's naptime LLM tool and proposes an alternative approach to building automated bug finders. Different approaches, such as the Catalyst-AI Reasoning Module, aim to enhance LLMs' effectiveness in detecting bugs by utilizing specific prompts and tools.
Fuzz Map is a fuzzer for GUIs that automatically identifies states using code coverage and builds a visual map. The page includes an interactive demo.
Cloud Commotion is a tool that deploys deliberately vulnerable infrastructure using Terraform for alerting capabilities testing.
Whispers is an information security analysis tool designed for identifying hardcoded secrets in structured text and static code.
The Joint Cyber Defense Collaborative organized a 4 hour tabletop exercise with government and AI industry experts. The goal of the exercise was to spearhead the development of an AI Security Incident Collaboration Playbook by JCDC. The exercise simulated an incident involving an AI-enabled system. Participants worked through operational collaboration and information sharing protocols for incident response.
Cyberespionage groups are using ransomware for financial gain and to disrupt critical infrastructure. ChamelGang, a suspected Chinese APT group, targeted institutions in India and Brazil with ransomware. BestCrypt and BitLocker were also used in ransomware attacks affecting organizations in North America, South America, and Europe.
The LockBit ransomware group falsely claimed to have hacked the US Federal Reserve. The real victim was Evolve Bank & Trust. Evolve Bank & Trust confirmed a security breach that involved leaked personal information and is conducting an investigation. The incident has been contained, and affected customers will be directly contacted.
A critical vulnerability in GitLab allows attackers to run pipelines as any user.
The Polyfill service, which was found to be serving malware, claims it has been defamed and has relaunched on a new domain.
Microsoft disclosed that Russian hackers accessed more customer emails than previously known, including those of senior leadership and government agencies.
BTCTurk, Turkey's largest crypto exchange, was hacked. One analyst claims that the stolen currency amounted to nearly 51M euros. BTCTurk reported that the attack was caused by a vulnerability that allowed uncontrolled withdrawals to be processed. The exchange halted withdrawals and deposits to investigate the attack.
CDK Global announced that it will likely take several days to restore service to nearly 15,000 car dealerships that rely on its software. It has been working with clients to find alternative ways to conduct business. Some dealerships report resorting to conducting business and keeping records by hand temporarily.
Over 100,000 websites were affected by a supply chain attack on the Polyfill.io service where a script was modified to redirect users to malicious sites. Polyfill.io is a service that provides code that enables modern browser features on older browsers. It was compromised after being acquired by a Chinese company. Cloudflare and Fastly created their own mirrors of the service to mitigate risks.
This project from Google's Project Zero explores how large language models (LLMs) can improve vulnerability discovery in cybersecurity testing by up to 20x in the CyberSecEval 2 benchmark. The researchers developed a framework called Naptime that significantly enhances LLM performance in identifying and analyzing vulnerabilities. Naptime automates variant analysis and closely mimics the approach of human security experts by incorporating specialized tools and principles.
Fly.io operates a custom OIDC IdP that allows apps running in Fly Machines to access AWS services without a user needing to directly interact with AWS. Fly utilizes a custom init server that fly machines boot into, which exposes a Unix socket to access the Fly Machine API that contains the OIDC information. Fly then detects if an AWS_ROLE_ARN is set and if so, generates an OIDC token, saves it to a file, and sets the appropriate environment variables for the AWS SDK.
This blog post explains how to reverse engineer eBPF programs by examining their structure and using helper functions. The eBPF calling convention defines the return value and program flow. Understanding the verifier rules is crucial for writing effective eBPF programs.
Mutahunter is an open source language agnostic LLM-based mutation testing tool that leverages LLM models to inject context-aware faults into codebases.
GCPwn is an all-purpose red team GCP toolkit modeled after pacu for AWS.
Ronin is a free and open source Ruby toolkit for security research and development. Ronin 2.1.0 open beta testing phase is now live until July 19th, with the official release scheduled for July 22nd. Participants can install Ronin 2.1.0.rc1 using the provided script and are encouraged to test new commands and libraries and report any issues to the GitHub repository for a chance to receive a free sticker.
A new tool called "k4spreader" is being used by the "8220" mining gang to install malware like the Tsunami DDoS botnet and PwnRig mining program. The tool is still in development with three observed variants. It is designed to download and execute malicious files, primarily Tsunami and PwnRig.
AWS IAM Access Analyzer has launched a new update that allows for the detection of unused roles, access keys, and passwords. It provides a quick link to delete the credential when IAM Access Analyzer detects an unused credential.
The LockBit ransomware gang published alleged US Federal Reserve data after ransom negotiations broke down. It threatened to release 33 terabytes of banking information if a ransom demand wasn't met.