Search the archive

TFPROVIDERCHECK

A command line tool that allows users to specify a list of allowed Terraform providers to verify whether they are the only providers in use.

SECURITY BUG ALLOWS ANYONE TO SPOOF MICROSOFT EMPLOYEE EMAILS

A researcher found an unpatched bug allowing anyone to impersonate Microsoft corporate email accounts for credible phishing attempts. He reported the email spoofing bug to Microsoft, but the company dismissed it after failing to reproduce the issue, so he then publicized the vulnerability on X.

‘ENCRYPTION IS DEEPLY THREATENING TO POWER': MEREDITH WHITTAKER OF MESSAGING APP SIGNAL

The CEO of Signal warned that the EU's proposed law to scan private messages for child exploitation material threatens web security. She argued it fundamentally undermines encryption by creating vulnerabilities that would have global implications beyond Europe.

DRIVING FORWARD IN ANDROID DRIVERS

Google's Project Zero team discusses a vulnerability in an Android driver related to JPEG decoding. The vulnerability allows for a race condition that can lead to memory corruption and potential exploitation. Attackers can achieve arbitrary read and write capabilities in the system by exploiting this vulnerability.

AWS ADDS PASSKEY MFA FOR ROOT AND IAM USERS

AWS has added passkeys to its list of supported MFA methods and has begun to enforce MFA for root users of organization management accounts.

LOS ANGELES UNITED BECOMES LATEST US SCHOOL DISTRICT TO BAN SMARTPHONES

The Los Angeles United School District banned students from using smartphones on campus to address mental health risks and distractions.

PRIVATE CLOUD COMPUTE: A NEW FRONTIER FOR AI PRIVACY IN THE CLOUD

In this blog post, Apple describes how it extends device security into the cloud by using Private Cloud Compute, ensuring user data privacy.

Join the Service Partner Program (takes <1 minute)

ASCENSION SAYS PERSONAL, HEALTH INFORMATION STOLEN IN RANSOMWARE ATTACK

US healthcare organization Ascension has revealed that a recent ransomware attack led to the theft of patient PII and PHI data. The attack disrupted Ascension's EHR, phone systems, and medical ordering, forcing patient diversions. While restoring systems, Ascension found attackers exfiltrated files from 7 of its 25,000 servers containing patient data.

PANERA WARNS OF EMPLOYEE DATA BREACH AFTER MARCH RANSOMWARE ATTACK

Panera Bread has notified employees of a data breach after attackers stole its data. It notified employees that information that they provided pursuant to their employment was breached, including social security numbers. Panera offered affected employees a year of CyEx Identity Theft Total.

NEW ARM 'TIKTAG' ATTACK IMPACTS GOOGLE CHROME, LINUX SYSTEMS

A new research called TIKTAG demonstrates attacks on ARM's Memory Tagging Extension (MTE) to leak data, impacting Google Chrome and Linux Systems. The attack exploits speculative execution to bypass security measures, potentially enabling memory corruption vulnerabilities. Researchers have proposed hardware modifications and code changes to mitigate TIKTAG attacks.

SIMPLIFY RISK AND COMPLIANCE ASSESSMENTS WITH THE NEW COMMON CONTROL LIBRARY IN AWS AUDIT MANAGER

AWS Audit Manager has added a new common control library that provides common controls with predefined and remapped AWS data sources. The common control library is based on external audits and supports multiple frameworks. A working example is included in the post.

DIRTY LITTLE SECRETS OF VULNERABILITY MANAGEMENT

This article explores some common misconceptions about vulnerability management and sheds light on why these make vulnerability management for open source software incredibly complex. It begins by discussing the difference between MITRE's position as secretariat of the CVE program vs the NVD's catalog before addressing why many CVEs that may have exploits available don't make it to CISA's KEV list. The article explains how EPSS scores work and how open source maintainers often skip reporting CVEs and instead only report to the GitHub Advisory Database, complicating matters.

ASSUMED BREACH: THE EVOLUTION OF OFFENSIVE SECURITY TESTING

TrustedSec elaborates on its new approach to red teaming and pentesting, which focuses on scenario-based breaches, as opposed to traditional internal pen tests, which focus mostly on physical intrusion-based scenarios whereby attackers plant a rogue device in the network. TrustedSec tests seven scenarios: SSO compromise, network pivot, endpoint compromise, perimeter compromise, DevOps, workstation compromise, and physical intrusion. The post includes a detailed description of the scenarios and testing methods.

your virtual seat

PYTE (PRODUCT LAUNCH)

Pyte's proprietary Secure Multiparty Computation (SMPC) technology makes it easy to run AI or ML computations on encrypted data without the need to move or decrypt the data.

HIJAGGER

Hijagger checks all maintainers of all npm and PyPi packages for hijackable packages through domain re-registration.

YETIHUNTER

YetiHunter is a tool for querying Snowflake environments for evidence of compromise based on IoCs from Permiso and the community.

ALLEGED BOSS OF ‘SCATTERED SPIDER' HACKING GROUP ARRESTED

A 22-year-old UK man arrested in Spain is allegedly the ringleader of the Scattered Spider cybercrime group behind hacks of Twilio, LastPass, DoorDash, Mailchimp, and others. He is accused of stealing data to access millions in funds. The man allegedly controlled $27 million in Bitcoin.

META PAUSES PLANS TO TRAIN AI USING EUROPEAN USERS' DATA, BOWING TO REGULATORY PRESSURE

Meta has paused plans to train its AI systems using data from EU and UK users following pushback from regulators. The Irish Data Protection Commission and the UK's ICO requested that Meta halt the initiative until concerns over compliance with GDPR privacy rules could be satisfied.

A NEW NORTH KOREAN GROUP EMERGES, DISRUPTING THE OPEN SOURCE ECOSYSTEM

A new North Korean threat actor named Moonstone Sleet has emerged. The group is targeting the open-source ecosystem with malicious npm packages. Its tactics mirror those of other North Korean groups, posing a constant threat to developers. Collaboration and vigilance are key to safeguarding the open-source community against these risks.

FORMER HEAD OF NSA JOINS OPENAI BOARD

OpenAI has appointed former NSA director Paul M. Nakasone, who led the NSA until February 2023, to its board of directors.

PROTECT AI'S JUNE 2024 VULNERABILITY REPORT

This report highlights 32 security defects reported as part of its bug bounty program.

MICROSOFT: NEW OUTLOOK SECURITY CHANGES COMING TO PERSONAL ACCOUNTS

Microsoft is making security changes to Outlook personal email accounts, phasing out basic authentication by September 16.

1️⃣ Read the report

2️⃣ Follow recommended security practices

SECURITY FIRM CYLANCE SAYS IT HAS BEEN HACKED, DATA PUT UP FOR SALE ONLINE

Cybersecurity firm Cylance confirmed a cyberattack where 34 million customer, employee, and partner emails and PII were stolen. The data is being sold on the dark web for $750,000. Cylance stated the breached data is relatively old and unrelated to the Snowflake hack.

PURE STORAGE SAYS ATTACKERS BROKE INTO A SNOWFLAKE ENVIRONMENT

Cloud storage provider Pure Storage disclosed that attackers gained unauthorized access to a Snowflake workspace containing customer telemetry data like company names, usernames, emails, and software versions. However, Pure Storage assured no sensitive data like passwords or customer-stored data was compromised.

ARM WARNS OF ACTIVELY EXPLOITED FLAW IN MALI GPU KERNEL DRIVERS

Arm has issued a security bulletin warning users of a vulnerability in the kernel drivers of Bifrost and Valhall GPUs. The vulnerability that is reportedly being actively exploited is a Use-After-Free vulnerability. These GPUs are used in smartphones, tablets, Chromebooks, various embedded devices, automotive infotainment systems, and smart TVs.

BYPASSING EDR NTDS.DIT PROTECTION USING BLUE TEAM TOOLS

This blog post details a method for extracting NTDS hashes while bypassing EDR and OS protections. The SYSTEM hive and NTDS.dit are needed to extract these hashes. The author utilized forensics tooling to extract these files without triggering EDR or OS protections.

HOW TO SECURELY TRANSFER FILES WITH PRESIGNED URLS

This blog post provides prescriptive guidance for generating presigned URLs that involves using tightly scoped IAM roles, unique minces, and VPC endpoints. It details a solution overview for deploying a presigned URL generation API and an access object API. The post concludes with best practices for sharing and monitoring presigned URLs such as using HTTPS for transit, tightly scoping CORS permissions, monitoring CloudWatch logs, and utilizing AWS WAF.

5 STEPS FOR CREATING AN APPSEC PROGRAM

This post lays out 5 steps to building an AppSec program. Start by creating or updating application and infrastructure diagrams to engage security partners and gain visibility into the attack surface. Existing security tools should then be mapped to the diagrams. The limitations of those tools should be explored and then repeatable processes should be built around security. After a program reaches this level of maturity, further projects such as secure libraries, terraform modules, and DAST integrations can be pursued.

BACKSLASH SECURITY (PRODUCT LAUNCH)

Backslash combines SCA, SAST, SBOM, VEX, and secrets detection with a single platform that uncovers the most critical risks through reachability analysis.

WITNESS

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

OPENRECALL

OpenRecall is a fully open-source, privacy-first alternative to Microsoft's Recall feature. It offers similar digital history functionality as Microsoft's Recall but functions completely on device and is cross-platform.

IOS 18 CRACKS DOWN ON APPS ASKING FOR FULL ADDRESS BOOK ACCESS

Apple unveiled new privacy features in iOS 18 that restrict apps from accessing users' full address books. Apps must first get permission to access contacts before users can pick which specific contacts to share. This two-step process aims to prevent apps from covertly building social networks from address books without consent.

GOOGLE'S PRIVACY SANDBOX MORE LIKE A PRIVACY MIRAGE, CAMPAIGNERS CLAIM

Privacy campaigner noyb filed a GDPR complaint alleging Google's Privacy Sandbox API, meant to replace third-party cookies, still allows Google to track users within Chrome without proper consent.

OPERATION CELESTIAL FORCE EMPLOYS MOBILE AND DESKTOP MALWARE TO TARGET INDIAN ENTITIES

A malware called Celestial Force uses mobile and desktop malware like GravityRAT and HeavyLift to target Indian entities. The malware is managed through a tool called GravityAdmin, facilitating malicious activities on infected devices. The operation involves various campaigns that target different platforms with overlapping infrastructure to distribute malicious payloads.

10 YEARS OF THE GITHUB SECURITY BUG BOUNTY PROGRAM

GitHub has paid over $4 million through its 10-year-old bug bounty program.

PSA: BARTENDER MAC APP UNDER NEW OWNERSHIP

Mac users have raised concerns after discovering that the popular Bartender app was sold and the certificate changed with no communication by the new owners.

WATCH OUT! CISA WARNS IT IS BEING IMPERSONATED BY SCAMMERS

Scammers are pretending to be CISA employees to trick people into giving them personal information or money.

👉 Download the kit from SecureFrame (free!)

NEW YORK TIMES SOURCE CODE STOLEN USING EXPOSED GITHUB TOKEN

An attacker posted an archive of stolen source code and data belonging to the New York Times onto 4chan. The leaker claims to have accessed the source code via a compromised GitHub token which was confirmed by The Times. The Times stated that the leak did not impact any internal corporate systems or operations.

MALICIOUS VSCODE EXTENSIONS WITH MILLIONS OF INSTALLS DISCOVERED

A group of Israeli researchers managed to infect over 100 organizations by typosquatting the Dracula extension. The researchers created a domain for their typosquatted extension, which allowed them to become a verified publisher and increase credibility. They identified over 1,200 extensions that were known to have malicious code on the VSCode extension marketplace.

UPDATES FOR SECURITY ISSUE AFFECTING INTELLIJ-BASED IDES 2023.1+ AND JETBRAINS GITHUB PLUGIN

JetBrains has disclosed security issues affecting IntelliJ-based IDEs and the JetBrains GitHub Plugin leading to an access tokens leak. The issue has been fixed in the latest IDE versions. Users are urged to update and revoke any affected GitHub tokens. JetBrains has provided instructions on how to revoke tokens and set up the plugin again if needed.

A GUIDE TO KUBERNETES LOGS THAT ISN'T A VENDOR PITCH

This post explains logging in Kubernetes clusters using the 4Cs of cloud-native security framework. Code level logging can be achieved with sidecar pods. Cloud level logging relies on the specific cloud's services (for example CloudTrail on AWS). Container level logging isn't generally helpful for security. The post contains a deep dive into using and enabling AuditPolicy to collect logs at the cluster level.

WHAT HAPPENED TO RASP?

A blog post looking at the decline of RASP and the rise of ADR. The post outlines various nontechnical and technical critiques that stymied RASP's implementation such as unclear time-to-value and added complexity. It concludes by looking at how ADR might address some of these concerns but concludes that it's too early to tell if it will succeed.