Search the archive

WIKILEAKS FOUNDER JULIAN ASSANGE REACHES PLEA DEAL

Julian Assange has agreed to a plea deal that will release him from prison in the UK and ensure no further jail time.

FOUR MEMBERS OF NOTORIOUS CYBERCRIME GROUP ‘FIN9' CHARGED FOR ROLES IN ATTACKING U.S. COMPANIES

Four Vietnamese nationals, allegedly part of the cybercrime group 'FIN9,' were charged with hacking into U.S. companies and causing over $71 million in losses.

INDONESIA WON'T PAY $8M RANSOM IN DATA CENTER ATTACK THAT DISRUPTED MAJOR PUBLIC SERVICES

Indonesia refuses to pay an $8 million ransom after a ransomware attack disrupted public services.

>> Read the full guide

>> Learn more about using Tines for security workflow automation

>> Start automating today with the always-free Community Edition

CDK GLOBAL BEGINS TO RESTORE SYSTEMS AFTER CYBER HACK HITS THOUSANDS OF RETAILERS

CDK Global, a retail technology provider serving over 15,000 North American locations, is working to restore systems after a cyberattack. Hackers have reportedly demanded a multi-million dollar ransom.

HACKER CLAIMS TO HAVE 30 MILLION CUSTOMER RECORDS FROM AUSTRALIAN TICKET SELLER GIANT TEG

A hacker is selling alleged customer data from Australia's TEG. They claim to have information on 30 million users including names, birthdates, and email addresses. This follows TEG-owned Ticketek's May disclosure of a data breach. While passwords were encrypted, other personal data may have been compromised.

SANTANDER EMPLOYEE DATA BREACH LINKED TO SNOWFLAKE ATTACK

Santander's US subsidiary is notifying over 12,000 employees of a data breach involving a third-party database. Hackers obtained employee names, Social Security numbers, and bank account information.

RESTRUCTURING THE BINARY NINJA DECOMPILER

Binary Ninja uses a control graph resolution algorithm to undo compiler optimizations by collapsing conditions to generate code that is more akin to what a programmer would write. Conditional complexity explosion leads to unwieldy conditional expressions in decompiled code, which could lead to the Binary Ninja decompiler in version 4.0 and prior crashing, falling back to adding gotos, or generating unsound or inaccurate code. Binary Ninja added a new set of algorithms to transform the control graph structure to optimize control flow recovery that achieved 100% accuracy in its test suite.

BYPASSING OKTA'S PASSWORDLESS MFA: TECHNICAL ANALYSIS AND DETECTION

Okta FastPass is a cryptographic MFA that facilitates passwordless authentication by creating a device-bound Proof of Possession factor upon device enrollment. OktaTerrify is a tool that can be used in conjunction with OktaInk in a workflow described in the article to bypass Okta FastPass and backdoor an Okta account on a compromised host. The article also provides examples of detecting this workflow in the Okta audit log.

HOW TO CREATE A PIPELINE FOR HARDENING AMAZON EKS NODES AND AUTOMATE UPDATES

A blog post from AWS Security on creating a pipeline for hardening EKS nodes. The pipeline uses EC2 Image Builder to apply the CIS benchmarks for Amazon Linux to build a custom image, then uses a State Machine to update the EKS nodes, and finally creates a Lambda function to send a weekly reminder to update if a new base image is available. A CloudFormation template is included in the post.

AGENTIC SECURITY

Agentic Security is an open-source vulnerability scanner for testing the resilience and reliability of LLMs

REDFLAG

RedFlag is a tool that leverages AI to detect high-risk code changes. The scanning is highly configurable and can be used to scope scanning to specific changes or releases.

XONA (PRODUCT LAUNCH)

Xona is a platform designed to provide secure access to critical systems in operational technology (OT) environments.

NEW YORK GOVERNOR SIGNS BILL REGULATING SOCIAL MEDIA ALGORITHMS

Amidst increasing scrutiny on the ways that social media affects mental health, NY Governor Kathy Hochul has signed a bill to regulate how social media algorithms treat users under the age of 18. Under the SAFE For Kids Act, social media platforms will be required to display content chronologically and limit late night notifications for users under the age of 18. The New York Child Data Protection Act will restrict websites from collecting and sharing data without consent for users under the age of 18.

US GOVERNMENT SANCTIONS TWELVE KASPERSKY LAB EXECUTIVES

The US government has sanctioned twelve Kaspersky Lab executives due to national security concerns. The ban on selling Kaspersky antivirus software will start on July 20, impacting US customers' software updates. The US Department of Commerce added Kaspersky entities to the Entity List for their alleged cooperation with Russian military and intelligence authorities.

ONNX STORE: PHISHING-AS-A-SERVICE PLATFORM TARGETING FINANCIAL INSTITUTION

This article discusses a Phishing-as-a-Service called ONNX that threat actors are using to orchestrate phishing attacks through embedded QR codes in PDF attachments. NNX Store is suspected to be a rebranded version of the Caffeine phishing kit that offers services like 2FA bypass mechanisms and Cloudflare protection. The platform facilitates the distribution of phishing tools and aids cybercriminals in stealing credentials for financial gain and potential ransomware attacks.

FIVE MEN CONVICTED FOR OPERATING ILLEGAL STREAMING SITE JETFLICKS

Five men were convicted for operating the illegal streaming site Jetflicks, which offered pirated movies and TV episodes.

PCC: BOLD STEP FORWARD, NOT WITHOUT FLAWS

An analysis of Apple's Private Cloud Compute solution determined that while various best practices for security are followed, there are still questions around the ML tradeoffs.

A BIRD'S-EYE VIEW: SHAREFINDER-HOW THREAT ACTORS DISCOVER FILE SHARES (THE DFIR REPORT)

This DFIR report is on how threat actors discover file shares and how canaries can be used as a defense strategy.

* Manual cloud deployments are still widespread

* Usage of short-lived credentials in CI/CD pipelines is lower than expected

The full report is well-worth reading. Grab a copy here

KRAKEN CRYPTO EXCHANGE HIT BY $3 MILLION THEFT EXPLOITING ZERO-DAY FLAW

Crypto exchange Kraken disclosed a critical zero-day flaw exploited by a security researcher to steal $3 million in digital assets. The vulnerability allowed artificial balance inflation by initiating deposits without completion. Kraken fixed the issue within 47 minutes and has stated that no client assets were at risk.

MASSACHUSETTS 911 OUTAGE CAUSED BY ERRANT FIREWALL

Massachusetts experienced a two-hour statewide 911 outage caused by an errant firewall installed by vendor Comtech to prevent cyberattacks. The firewall blocked calls from reaching dispatch centers. No emergencies were reportedly impacted, as dispatch centers could identify and return unsuccessful calls.

HACKERS DERAIL AMTRAK GUEST REWARDS ACCOUNTS IN BREACH

Amtrak has disclosed a data breach that affects users of the Guest Rewards program. It determined that there was no breach of its systems and that accounts were accessed via credentials leaked in previous breaches. Stolen information included names, contact information, rewards account numbers, partial credit card data, dates of birth, and transaction/trip information.

FAKE GOOGLE CHROME ERRORS TRICK YOU INTO RUNNING MALICIOUS POWERSHELL SCRIPTS

Proofpoint analysts have identified three attack chains that seek to social engineer users into running malicious Powershell scripts. The first two attack chains load a script hosted on Binance's chain which shows the user a fake Google Chrome error and prompts them to “install a root certificate” by copying a Powershell script into an admin Powershell console. The third attack chain sends an email resembling Microsoft Word documents and prompts users to install a Word Online extension which then prompts the user to “fix” the document by running a Powershell script or downloading and executing a file.

HIJACKING GITHUB RUNNERS TO COMPROMISE THE ORGANIZATION

This article discusses a novel attack technique that utilizes developer access to a lower privilege GitHub repository to escalate privileges to a total compromise of all GitHub Actions pipelines in the organization. The attack makes use of a command injection vulnerability caused by utilizing the branch name directly in a command run on a self-hosted runner. This access is then used to register a new runner with the ubuntu-latest tag that will be used for any actions trying to use the GitHub hosted ubuntu-latest runner.

WTF IS CDR?

This post explores what Cloud Detection and Response tools are and provides some insight into the vendor landscape. CDR tools tie together logs from the Kubernetes control plane, containers, and cloud events into a single timeline for analysts along with response and remediation actions. The post concludes with an overview of the landscape, highlighting Upwind and Sweet as vendors capable of typing cloud and Kubernetes events together.

POMERIUM (PRODUCT LAUNCH)

Pomerium offers a unified access control solution that prioritizes access over restriction, dynamically verifying user identities and context to improve security.

SN1PER

Sn1per helps save time by automating the execution of open source and commercial tools to discover vulnerabilities across your entire attack surface.

NETFETCH

Netfetch is a tool that scans Kubernetes networks to identify whether any pods are running without a network policy. The tool provides a CLI and dashboard for visualization.

NEW GOVERNMENT BAN ON KASPERSKY WOULD PREVENT COMPANY FROM UPDATING MALWARE SIGNATURES IN U.S.

The US government has expanded its ban on Kaspersky software due to national security concerns, preventing the company from providing updates to customers in the U.S. This ban will impact the ability of Kaspersky software to detect threats on American systems over time. Existing Kaspersky customers in the U.S. have until September 29 to find alternative antivirus software.

YEAR-ROUND STRATEGIES FOR CAREER GROWTH

This blog post goes into detail about performance reviews, career ladders, and career growth strategies. Career growth is something that employees should be thinking about year-round. ICs can use hype lists to jot down what they worked on, the impact it made, and any notes they had. They should utilize this list in performance reviews in addition to making sure that their work is visible throughout the company.

6 QUESTIONS TO ASK WHEN INTERVIEWING FOR AN APPSEC ROLE

This post provides a list of questions to ask when interviewing for an AppSec role. The questions aim to understand the culture of the team, interactions with other teams, and what your work would look like. An explanation of why each question should be asked is provided.

UPDATE YOUR WINDOWS PC TO AVOID A SERIOUS WI-FI VULNERABILITY

Microsoft patched a critical vulnerability in Windows 10 and 11 that could allow hackers to remotely access devices on public Wi-Fi networks without user interaction.

AMD INVESTIGATING CLAIMS THAT COMPANY'S DATA WAS STOLEN IN HACK

An organization called "Intelbroker" conducted a breach of AMD's data.

LINUX VERSION OF RANSOMHUB RANSOMWARE TARGETS VMWARE ESXI VMS

The RansomHub ransomware operation is using a Linux encryptor designed specifically to encrypt VMware ESXi environments in corporate attacks.

Request information and apply for free.

_SNHU is currently only accepting US students for this program._

UK'S TOTAL FITNESS EXPOSED NEARLY 500K IMAGES OF MEMBERS, STAFF THROUGH UNPROTECTED DATABASE

A researcher claims UK gym chain Total Fitness left a database containing over 474,000 member and staff images, including identity documents and payment info, publicly accessible without a password. Total Fitness stated the images were used for legitimate purposes and that only a small subset contained identifiable information. The issue highlights the potential risks of data exposure.

LIFE360 CONFIRMS A HACKER STOLE TILE TRACKER IDS AND CUSTOMER INFO

A hacker breached the systems behind Tile device trackers and stole customer data like names, addresses, emails, and phone numbers by accessing a law enforcement request tool. Tile's parent company Life360 confirmed the breach, stating that the hacker attempted extortion.

HIGH-SEVERITY VULNERABILITIES AFFECT A WIDE RANGE OF ASUS ROUTER MODELS

Asus has released updates patching multiple critical vulnerabilities in its routers. The first is an authentication bypass that allows remote attackers to log into the router with no authentication. The second vulnerability is a buffer overflow that could allow attackers with administrative access to execute arbitrary commands. The third vulnerability allows attackers to execute remote commands with no user interaction. Asus hasn't seen any exploitation of these vulnerabilities.

ATTACKERS DEPLOYING NEW TACTICS IN CAMPAIGN TARGETING EXPOSED DOCKER APIS

This blog post dives into a new malware campaign that targets exposed Docker API endpoints to deliver cryptocurrency miners and other payloads. The campaign uses a remote access tool to execute more malware and a utility to spread via SSH.

BUILDING TO PREVENT SUBDOMAIN TAKEOVERS

This blog post discusses architectural decisions that can be made by platforms offering custom domains to proactively prevent subdomain takeovers. The most common mitigation method employed is requiring domain verification, which is most commonly implemented as a TXT record with a verification string. Other mechanisms suggested are to add entropy to the underlying record to make it difficult to generate an identical record, preventing the re-registration of custom domains, and charging for custom domains.

7 REASONS WHY SECURITY WILL ALWAYS BE AMAZON'S TOP PRIORITY

AWS CISO, Chris Bentz, details some of the ideas driving AWS' security prioritization with a focus on generative AI. Bentz highlights some conventional wisdom such as focusing on the basics, security being everyone's job, and security requiring innovation and being necessary to innovation. He also touches on the importance of customers having control over their data and the potential value of generative AI in the AWS security strategy.

MOVE FROM ALWAYS-ON PRIVILEGES TO ON-DEMAND ACCESS WITH NEW PRIVILEGED ACCESS MANAGER

Google Cloud's Privileged Access Manager (PAM) enhances security by granting on-demand access with just-in-time approvals. PAM helps organizations shift from always-on privileges to time-bound, approved access for improved security and operational efficiency. IAM admins can create entitlements for users to request specific access, promoting least privilege principles.

JDVRIF

Hide data within JPG images using this steganography privacy tool. Post images on Mastodon and other hosting sites.