Search the archive

2️⃣ Learn more about Orca's CNAPP

3️⃣ Get a live demo

COX FIXED AN API AUTH BYPASS EXPOSING MILLIONS OF MODEMS TO ATTACKS

Bug bounty hunter Sam Curry discovered an API authentication bypass in Cox Communications' systems that could give attackers the same permissions as a tech support agent for the ISP. Attackers could use the bypass to obtain the PII of customers, reset modems, or gather WiFi information. Cox took the 700 exposed API endpoints down within hours of the report and fixed the issue the following day. It has found no evidence of exploitation.

MAJOR CYBERATTACK SEES NHS LONDON HOSPITALS DECLARE CRITICAL INCIDENT WITH OPERATIONS CANCELED

Two London hospital trusts were forced to cancel non-emergency operations and blood tests due to a major ransomware cyberattack on Synnovis, the company supplying pathology services to hospitals across six boroughs. The attack affected tens of thousands of NHS patients.

ZYXEL ISSUES EMERGENCY PATCH FOR END-OF-LIFE NAS DEVICES

Zyxel Networks has released a patch to address 3 critical vulnerabilities on older NAS devices. The vulnerabilities allowed for remote code execution. However, two flaws that could lead to information disclosure and privilege escalation were not fixed. Zyxel released these patches even though the devices have reached end-of-life as they were of critical severity and proof-of-concept exploits exist.

PHISHING WITH CLOUDFLARE WORKERS: TRANSPARENT PHISHING AND HTML SMUGGLING

Netskope Threat Labs is tracking two common phishing techniques that have been observed in phishing campaigns that utilize Cloudflare Workers. Attackers are utilizing Cloudflare Workers to deliver an encoded blob, which is reconstructed on the client to execute HTML smuggling attacks. Attackers are also utilizing Cloudflare Workers for transparent phishing attacks, creating MitM channels where attackers can intercept victims' credentials and MFA while relaying them to a destination server.

SOPHISTICATED RAT TARGETING GULP PROJECTS ON NPM

SECURING THE BUILDING BLOCKS: A DEEP DIVE INTO DEPENDENCY SECURITY

Choosing secure dependencies for your project to prevent security risks is important. Delete unused dependencies and vet the trustworthiness of the ones you use. Developers need to regularly scan and update dependencies to address any vulnerabilities.

APPTEGA

Apptega is a full-lifecycle compliance platform that gives MSSP providers the ability to build and manage cybersecurity and compliance programs. It delivers continuous compliance offerings and standardizes and validates existing services.

PROWLER

Prowler is an Open Source Security tool for AWS, Azure, GCP, and Kubernetes for performing security assessments, audits, incident response, compliance, continuous monitoring, hardening, and forensics readiness. It includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS, and more

AWESOME CI/CD ATTACKS

A curated list of techniques and tools for attacking and defending CI/CD pipelines.

LEAKED GOOGLE DATABASE REVEALS ITS SECRET PRIVACY AND SECURITY FAILURES

404 Media obtained a leak of internal Google privacy cases from 2013-2018. The leak provides insight into how Google manages privacy flags and the volume that it receives. Google has confirmed the authenticity of the leak but stressed that each flag was investigated and resolved.

MICROSOFT HIT WITH EU PRIVACY COMPLAINTS OVER SCHOOLS' USE OF 365 EDUCATION SUITE

A privacy rights non-profit has lodged two complaints against Microsoft with Austria's data protection authority over the use of Microsoft 365 Education by schools. The complaints raise concerns about the lack of transparency and legal basis for processing minors' data, which potentially violates GDPR's stringent requirements for protecting children's data.

CROOKS THREATEN TO LEAK 3B PERSONAL RECORDS 'STOLEN FROM BACKGROUND CHECK FIRM'

A criminal gang claimed to have obtained a massive database of 2.9 billion personal records on US, Canadian, and British citizens from a Florida firm handling background checks. The database allegedly contains sensitive information like full names, addresses, social security numbers, and details of relatives. The gang is planning to leak the 277GB of data.

HIGH-RISK ATLASSIAN CONFLUENCE RCE FIXED, POC AVAILABLE (CVE-2024-21683)

CVE-2024-21683 is a remote code execution vulnerability in the Confluence Server and Data Center that allows an authenticated attacker with high privileges to execute malicious Java code.

FCC VOTE ON TAP FOR RULES TO SECURE FUNDAMENTAL COMPONENT OF THE INTERNET

The FCC is considering a rule to enhance security for a vital part of the internet known as the Border Gateway Protocol.

DATA FIRM EXECS CONVICTED FOR HELPING FRAUDSTERS TARGET THE ELDERLY

Two former executives of Epsilon Data Management LLC were convicted of selling consumer data to fraudsters for over a decade.

THREAT ACTOR COMPROMISING SNOWFLAKE DATABASE CUSTOMERS

A campaign by threat actors to use stolen credentials to breach Snowflake databases that do not have MFA or 2FA enabled has been reported. The threat actor is using custom tooling for the Snowflake environment to carry out theft and extortion operations. It is believed that there hasn't been any compromise of Snowflake's internal systems.

LIVE NATION TOOK 11 DAYS TO CONFIRM THE MASSIVE TICKETMASTER DATA BREACH

Live Nation Entertainment acknowledged a data breach in a regulatory filing after an individual claimed to be selling data on 560 million Ticketmaster customers on hacking forums for $500,000. The breach involved unauthorized access to a third-party cloud database containing customer data like names, addresses, and credit card details.

HUGGING FACE SAYS IT DETECTED ‘UNAUTHORIZED ACCESS' TO ITS AI MODEL HOSTING PLATFORM

Hugging Face disclosed late Friday that its security team detected unauthorized access to Spaces, its platform for sharing and hosting AI models, earlier in the week. The intrusion involved potential access to private "secrets" used as keys to protected resources. As a precaution, Hugging Face revoked numerous tokens and recommended users refresh keys and switch to more secure access tokens.

SERVER-SIDE REQUEST FORGERY (SSRF) LAB

This post explains what server-side request forgery (SSRF) is and describes some common examples while walking through a PortSwigger Lab. It also demonstrates how to identify and exploit SSRF vulnerabilities.

CREDENTIALS LEAKING WITH SUBDOMAIN TAKEOVER

Truffle Security's team provides a deep dive into how localStorage can be abused in a subdomain takeover. They discovered a subdomain takeover vulnerability on Readme.io that could allow an attacker to compromise any credentials entered in the original or compromised page. The Readme team originally did not intend to fix the issue so Truffle Security created custom domains for 600 vulnerable companies and contacted them directly.

NON-PRODUCTION ENDPOINTS AS AN ATTACK SURFACE IN AWS

The Datadog Security team discovered a new method for AWS privilege enumeration that can bypass CloudTrail logging. The method involves querying ce:GetCostAndUsage and route53resolver:ListFirewallConfigs for access to various other resources. The AWS team has fixed the specific bypasses and worked with the Datadog team to identify additional potential attack vectors.

the webinar here!

SECRETGEN-CONTROLLER

secretgen-controller provides Custom Resource Definitions (CRDs) to specify which secrets need to be generated on a Kubernetes cluster. It supports generating secrets, exporting and importing secrets, registry secrets across namespaces, and generating secrets from data residing in other Kubernetes resources.

STORMSPOTTER

Stormspotter is a red team tool for graphing and visualizing Azure and Azure AD objects.

C/SIDE (PRODUCT LAUNCH)

C/side provides tools for monitoring, optimizing, and securing third-party scripts in browsers to keep users safe from vulnerabilities and zero-day attacks.

JAPANESE CRYPTO EXCHANGE DMM BITCOIN SUFFERS $305M HACK

Japanese cryptocurrency exchange DMM Bitcoin disclosed a major hack resulting in the loss of 48 billion yen ($305 million) worth of bitcoin, with 4,502.9 BTC stolen. The hacker split the funds across 10 wallets. DMM halted spot buys and warned of delayed yen withdrawals. It vowed to compensate the lost bitcoin with group company support to guarantee the full amount.

NETFLIX PAID OUT OVER $1 MILLION VIA BUG BOUNTY PROGRAM

Netflix announced that it has paid out over $1 million in bug bounties since launching its program in 2016. Over 5,600 researchers have contributed nearly 8,000 vulnerability reports, with 845 rewarded, including over 25% critical or high severity.

INTRODUCING ARTIFACT ATTESTATION

The OpenSSF and GitHub have launched Artifact Attestations to allow for generating SigStore artifact attestations but adding a GitHub action to configure the signature without the need to manage a PKI infrastructure. The signatures utilize the OpenSSF's PKI infrastructure and can be verified using the GitHub CLI. Integrations with Kubernetes and other providers are planned.

BEWARE: FAKE BROWSER UPDATES DELIVER BITRAT AND LUMMA STEALER MALWARE

Fake browser updates are being used to spread malware like BitRAT and Lumma Stealer.

THE NSA ADVISES YOU TO TURN YOUR PHONE OFF AND BACK ON ONCE A WEEK - HERE'S WHY

The NSA recommends turning your phone off and back on weekly to protect against security threats like malware and spyware.

POLICE DISMANTLE PIRATED TV STREAMING NETWORK THAT MADE $5.7 MILLION

Spanish police dismantled a network that made $5.7 million from illegal TV streaming by arresting 8 individuals and taking the servers offline.

Register for free to save your spot

MYSTERY MALWARE DESTROYS 600,000 ROUTERS FROM A SINGLE ISP DURING 72-HOUR SPAN

Last October, there was an incident where over 600,000 routers belonging to an unnamed ISP were permanently bricked by malware over 72 hours. The malware, known as Chalubo, executed custom code that overwrote router firmware, rendering ActionTec T3200 models unusable with a red light.

DATA BREACH EXPOSES DETAILS OF 25K CURRENT AND FORMER BBC EMPLOYEES

The BBC's pension scheme notified 25K current and former employees that their personal data had been exposed in a breach. The notification did not include details of how the breach occurred other than that the data had been copied from an online data storage service. Exposed information includes dates of birth, home addresses, and national insurance numbers, but does not include financial information.

COOLER MASTER HIT BY DATA BREACH EXPOSING 500K CUSTOMERS' INFORMATION

A threat actor called Ghostr claimed to have stolen 103 GB of data from Cooler Master including corporate, vendor, sales, warranty, inventory, and HR data as well as 500K fanzone members' information. The threat actor claims that the fanzone information includes names, addresses, dates of birth, phone numbers, emails, and unencrypted credit card information. Data samples did not confirm whether credit card information was stolen.

COVERAGE GUIDES FUZZING - EXTENDING INSTRUMENTATION TO HUNT DOWN BUGS FASTER

Coverage guided fuzzing is a technique used by some fuzzers to determine if a fuzzing input will discover a new edge. This article walks through the process of modifying the Fuzzli fuzzer to find a known vulnerability in JerryScript. The article also contains instructions to set up an environment to replicate the findings.

THE BEST WAY TO START WITH AWS SECURITY HUB

A lab from Rich Mogull's Cloud Security Lab A Week series on using AWS Security Hub. Security Hub is a unified view of various AWS security services across all regions and accounts in an organization. Mogull goes over the steps of setting up AWS Security Hub to act as a CSPM.

HOW MALWARE AUTHORS PLAY WITH THE LNK FILE FORMAT

Malware authors are utilizing LNK files as a malware delivery mechanism now that Microsoft is deprecating Macros. This blog post goes into detail on various techniques that are used by the malware authors like running minimized, executing other binaries as well as icon smuggling. The post contains links for defenders to use for analyzing LNK files.

ZENDATA

Zendata is a no-code platform that provides data usage insights and controls to address risks and maintain compliance, particularly when it comes to the use of AI.

PDNSSOC

pDNSSOC is a toolset that leverages MISP indicators via a pDNS-based infrastructure to act as a poor man's SOC.

AWESOME DETECTION ENGINEERING

A collection of resources on the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity

EURO COPS DISRUPT MALWARE DROPPERS, SEIZE THOUSANDS OF DOMAINS

An international law enforcement operation led by Europol named Operation Endgame resulted in multiple arrests, searches, seizures, and takedowns targeting malware droppers and their operators. The coordinated action across several countries, described as the largest-ever crackdown on botnets used for ransomware deployment, disrupted the operations of notorious droppers like IcedID, Bumblebee, SystemBC, Pikabot, Smokeloader, and Trickbot.

MOONSTONE SLEET EMERGES AS NEW NORTH KOREAN THREAT ACTOR WITH NEW BAG OF TRICKS

Microsoft has identified a new North Korean threat group called Moonstone Sleet that employs a combination of traditional and unique attack methods. Notable techniques the group uses include creating fake companies and job postings, using trojanized tools, and developing a fully functional malicious game called DETANKWAR.