Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Two hackers helped recover funds in a Trezor wallet that an owner had lost the password to. The owner had created the password using the RoboForm password manager in 2013. The hackers exploited a known vulnerability in RoboForm to recover the wallet. A video demonstrating the hack is included in the article.
NIST has said that it will be receiving outside help to get the National Vulnerability Database (NVD) back on track within the next few months.
Okta warned customers of an ongoing credential stuffing attack targeting its Customer Identity Cloud (CIC) tool, advising users to either disable the cross-origin authentication feature being abused or implement recommended mitigations.
A class action lawsuit has been filed against Ticketmaster for a massive data breach affecting millions of consumers.
Pharmacy prescription services provider Sav-Rx is notifying around 2.8 million individuals that their personal information was compromised in a cyberattack on October 8, 2023. The compromised information includes names, addresses, dates of birth, email addresses, phone numbers, Social Security numbers, eligibility data, and insurance identification numbers.
The Internet Archive, a nonprofit digital library housing millions of historical documents and websites, has endured an intermittent Distributed Denial-of-Service (DDoS) cyber-attack for three days, limiting access to its vast collections including the Wayback Machine's web archive.
An RCE vulnerability TP-Link Archer C5400X router was recently disclosed after identification by OneKey. The vulnerability is a command injection and buffer overflow in the rftest binary, which is responsible for network self assessments. A patch that implements input sanitization was released to address the vulnerability.
Penetration testing tools are essential for efficient hacking and security assessments. While hacking without tools is possible, it is time-consuming and repetitive. These tools streamline basic scanning and security processes, saving time and effort. This post dives into some of the best penetration testing tools.
The Truffle Security team analyzed 10k JWTs found via Shodan and another 500 committed to public repos in GitHub. They used hashcat to attempt cracking the JWTs and found that 1.2% of symmetric keys used in production were guessable within seconds. This was caused by users implementing weak passwords (including the defaults used in documentation and examples) as their symmetric keys when setting up their authentication systems.
This blog post provides a walkthrough on how to programmatically map the attack surface of an application using GDB and Ghidra. It begins with walking through the strategy for identifying functions after ASLR and then shows how it can be implemented using GDB Python. The post takes this one step further and shows how to write a Ghidra Python script to generate the GDB Python script for each function and ignore artificially generated blocks.
Sponsored
In this webinar, the Guardsquare product team will cover two prominent mobile security approaches [10] (compiler-based vs wrapper solutions).
WTF Snapshot fuzzing of macOS targets, enabling users to perform precisely targeted fuzz testing of hard-to-pinpoint chunks of the macOS kernel.
Arcjet JS SDKs. Rate limiting, bot protection, email verification, and attack defense for Node.js, Next.js, Bun, and SvelteKit.
Sudo for Windows is a windows-specific implementation of the Sudo concept to escalate privilege from Linux/Unix. This means that certain elements of the traditional sudo experience are not present in Sudo for Windows and vice versa. Scripts and documentation that are written for sudo may not be able to be used directly with Sudo for Windows without some modification.
OpenAI has formed an internal Safety and Security Committee headed by CEO Sam Altman and composed of company insiders. Its goal is to oversee critical security decisions related to OpenAI's AI projects over the next 90 days, raising concerns among ethicists about the lack of independent oversight.
For more than 4 days, the Cogent root name server fell out of sync with all 12 of its peers. Cogent has fixed the issue but has refused to comment on the cause of the disparity. This could have led to DNS Cache poisoning issues or issues in DNSSEC.
IBM reported that its X-Force red team was able to compromise a network that they had allocated 3 weeks for in just 8 hours with the help of AI red teaming tools. The team found a vulnerability in the company's HR portal with the aid of the tooling and then installed a rootkit after exploiting the vulnerability and eventually pivoted through the network. IBM believes that these AI tools can be essential in analyzing the large volume of data accumulated in a red team assessment.
BreachForums is back not long after it was seized by law enforcement, bringing back ransomware leaks.
Auction house Christie disclosed a data breach following a RansomHub cyber attack that occurred this month.
The U.S. Treasury sanctioned three Chinese nationals for running the 911 S5 proxy botnet, a service that allowed routing web traffic through malware-infected computers globally.
Sponsored
The internet is running out of IP addresses on the IPv4 protocol, which is why IPv6 is seeing rapid adoption [4]. This change in protocol can impact many cybersecurity tools and programs that rely on IP addresses (such as for known malicious actors).
Following a 2016 attack, a database containing information of nearly 2M DOTA 2 developer forum users was leaked. The database contains usernames, passwords, email addresses, user identifiers, and IP addresses. The passwords were salted and hashed using MD5. Over 80% of the passwords have been cracked.
A data breach last year in Eindhoven exposed the personal information of 221,511 residents, including their citizen service numbers (BSNs). The breach was not disclosed to affected individuals as the municipality deemed the risk of identity theft unlikely and claimed the leak was internal and not accessible to outsiders. The Dutch data protection authority has since placed Eindhoven under stricter supervision due to numerous other breaches.
A Merrill employee accidentally exposed the personal data of almost 2,000 Walmart pension plan members through an email error. The exposed information included names and Social Security numbers. The incident led to the offer of identity theft protection services for those affected.
MITRE reveals through a series of blog posts how the cyber attack on its organization in late 2023 involved exploiting Ivanti zero-days to create rogue virtual machines within MITRE's VMware environment.
This post covers the significance of access control in Node.js Express applications, the consequences of compromised access control, and strategies to prevent access control vulnerabilities that can lead to disastrous private data leaks.
A blog post that walks through the process of creating custom Semgrep rules to address two common issues in Ruby. The first is an in-depth look at a common footgun that's present in the sanitize_sql function and now to build a rule to detect it. The second is an in-depth look at common issues when utilizing Pundit and building rules for them.
EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files. It can run in automated mode to scan a given IP space and perform a set of deletions or manual mode for more targeted deletion.
Averlon enables customers to easily enroll their cloud environments and get an overview of their security risks across all cloud assets, including network access, policies, and software connectivity.
Multilingual library made for validation, various form fields, such as email, telephone, password, CPF, CNPJ, credit card, magic numbers for image mimetype validation, and much more.
ZAP has introduced a new add-on for testing gRPC. The tool allows for easy encoding, editing, and decoding of Protobuf messages. This blog post includes installation instructions and a feature tutorial.
NCC Group has released the Cranim toolkit that helps create visualizations for cryptography using a math visualization library called Manim. It provides easy-to-use tools for animating cryptographic concepts and code snippets efficiently. The toolkit is designed to be accessible and user-friendly for computer science educators and enthusiasts.
A massive data leak in India exposed the biometric information of millions during elections. The leaked database contained fingerprints and facial scans of police, military personnel, and civilians. The incident raises concerns about identity theft and election security and highlights the need for stronger data security practices and regulations to protect citizens' privacy.
This report dives into the top threats of the first three months of the year.
CISOs are increasingly worried about cyber attacks, with 70% fearing their organization is at risk with Ransomware as the top threat.
Google released an emergency update to fix the eighth actively exploited vulnerability in Chrome, tracked as CVE-2024-5274.
Sponsored
Legacy MFT often means inadequate encryption, poor access controls, and insufficient monitoring. And that's before we talk about compliance, compatibility, and user experience.
A cyberattack on healthcare provider CentroMed exposed the personal and medical data of 400,000 patients, including names, addresses, birth dates, medical information, Social Security numbers, and financial details. The breach was discovered on May 1st after unauthorized access on April 30th.
London Drugs confirmed a ransomware attack stole corporate files with employee information but stated it is unwilling and unable to pay the demanded ransom. Patient/customer databases currently appear uncompromised. LockBit ransomware group claims London Drugs was willing to pay $8 million initially. It is now demanding $25 million to avoid a data leak.
Microsoft released an emergency out-of-band update to fix a bug that causes errors when trying to apply the May 2024 patch Tuesday updates in Windows Server 2019. The error is more likely to affect servers without the English (United States) language pack, but has been seen in servers that do as well. Microsoft confirmed that the bug was connected to the English (United States) language pack and that the update will fail if the language pack can't be located.
A guide to upgrading EKS clusters that includes an overview as well as detailed commands. Kubernetes supports security updates for the current and previous 2 minor versions, which means that version upgrades are frequently necessary. During upgrades, users are responsible for initiating the upgrade and upgrading the data plane whereas AWS manages the control plane upgrades.
This article details findings from the leak of logs belonging to Estate, an interception operation that carried out thousands of automated phone calls for phishing attacks. Members can only sign up to Estate with referral codes and once registered can search through breached account passwords for victims. Estate contains automated scripts to convince victims to provide SMS OTPs or credit card security codes.
A blog post that describes the difficulty in creating IDE plugins and how Sourcegraph aims to solve this by implementing plugins for its AI assistant, Cody. There are over a dozen popular IDEs that each utilize different APIs, leading to plugin developers needing to reimplement each feature for every IDE, an insurmountable barrier. Sourcegraph is attempting to solve this problem with Cody by utilizing a separate Cody binary to orchestrate interactions with each IDE's API instead of fully implementing each feature for each IDE.
Sponsored
Looking to enhance your application security reporting? Check out Snyk's latest resource REPORTING APPSEC RISK UP TO YOUR CISO [12] - a guide for you on risk prioritization, risk introduction and measuring your AppSec program. Be proactive on risk reporting and gauge your CISO early on in your application development workflow! Download the
Eraser helps Kubernetes admins remove a list of non-running images from all Kubernetes nodes in a cluster.
Amplifier has launched a self-healing AI copilot (Ampy) that helps employees understand the risks they are creating and helps them address the identified issues. The AI copilot guides employees through security protocols, involving them in the process of improving the organization's security posture.