Search the archive

LLM PENTEST: LEVERAGING AGENT INTEGRATION FOR RCE

ADVANCING EMERGENCY RESPONSE SECURITY WITH AUTONOMOUS PENTESTING

Horizon3.ai's customer story highlights the implementation of autonomous pentesting to advance security in emergency response sectors, particularly 911 call centers. Utilizing its NodeZero platform, Horizon3.ai enables organizations to perform continuous security assessments, identifying vulnerabilities and enhancing defenses against cyber threats.

EVERYDAY GHIDRA: SYMBOLS — PRESCRIPTION LENSES FOR REVERSE ENGINEERS — PART 1

This blog post discusses the use of symbols in Ghidra for reverse engineering tasks. It emphasizes how symbols help clarify disassembled code by providing human-readable identifiers like function names, prototypes, and data types. This aids in transforming obscure assembly code into more understandable formats, similar to high-level programming languages. The post explains how symbols are extracted from binary exports and imports and their significance in making the reverse engineering process more intuitive and efficient.

KUBE NO TROUBLE

Kubent is a tool to check if a Kubernetes cluster is using deprecated APIs. It can be run in CI/CD pipelines or manually.

AWS SCP TO DENY FINANCIAL AGREEMENTS AND LONG-TERM RESERVATIONS

An SCP to prevent a member account from entering into long-term financial agreements or reservations.

BURPSCRIPT

BurpScript adds dynamic scripting abilities to Burp Suite, allowing you to write scripts in Python or Javascript to manipulate HTTP requests and responses.

ZSCALER TEST ENVIRONMENT EXPOSED

Zscaler has published a security update following posts on X that an isolated test environment on a server was unintentionally exposed. Zscaler has confirmed that there was no impact or compromise to customer, production, or corporate environments.

AMAZON ROUTE 53 RESOLVER DNS FIREWALL NOW SUPPORTS DOMAIN REDIRECTION

AWS has added the ability to enable Route 53 Resolver DNS Firewall to automatically skip the inspection of domains included in a redirection chain. Prior to this feature, all CNAMEs in a domain redirection chain would have to be explicitly allow-listed.

MINECRAFT SOURCE PACK BECOMES GATEWAY FOR ZEUS STEALER DISTRIBUTION

Fortinet's FortiGuard Labs has discovered that a dangerous malware called zEus stealer is being spread through a Minecraft source pack, targeting Windows users and stealing sensitive data like IP addresses and browser information. The malware cleverly disguises itself as a screensaver file to evade detection and maintains control over infected systems through auto-run entries and a command-and-control script. Users are urged to use MFA, download files from trustworthy sources, and be cautious when downloading custom game mods to protect against threats like zEus.

TIKTOK IS SUING THE U.S. GOVERNMENT TO STOP ITS APP BEING BANNED

TikTok has filed a lengthy lawsuit against the U.S. government arguing that the TikTok ban is unconstitutional and violates users' First Amendment rights.

MONDAY.COM REMOVES "SHARE UPDATE" FEATURE ABUSED FOR PHISHING ATTACKS

Monday.com removed its "Share Update" feature due to phishing attacks because it allowed users to send emails impersonating Monday.com.

FBI WARNS US RETAILERS THAT HACKERS ARE TARGETING THEIR GIFT CARD SYSTEMS

The FBI has issued a warning to US retailers about cybercriminals targeting gift card systems through phishing attacks on employees.

the full, ungated guide here

PHYSICAL SECURITY BIZ EXPOSES 1.2M FILES VIA UNPROTECTED DATABASE

Amberstone Security exposed nearly 1.3 million documents through a misconfigured public-facing database. The leaked data, dating back to 2017, contained over 99,000 snapshots of guards checking in for shifts. The data includes sensitive information like names, headshots, ID cards, and signatures, potentially compromising the security of the company's operations and personnel.

XIAOMI ANDROID DEVICES HIT BY MULTIPLE FLAWS ACROSS APPS AND SYSTEM COMPONENTS

Multiple security vulnerabilities have been disclosed in various Xiaomi Android device applications and system components that enable arbitrary access to activities, services, files with system privileges, phone settings, Xiaomi account details, and more.

UK CONFIRMS MINISTRY OF DEFENCE PAYROLL DATA EXPOSED IN DATA BREACH

A cyberattack on the UK Ministry of Defence exposed personal data of military personnel. The breach affected payroll records but did not disrupt salary payments. Investigations are ongoing to determine the cause of the breach, with potential foreign state involvement suspected.

WHY YOUR VPN MAY NOT BE AS SECURE AS IT CLAIMS

VPNs may not provide complete protection against snooping when connecting from untrusted networks. Attackers on the same network can abuse the DHCP protocol to force a target's traffic off the VPN tunnel without triggering alerts. By running a rogue DHCP server and manipulating gateway settings, attackers can snoop on the target's traffic while passing it through to the legitimate gateway, bypassing the VPN's encryption.

DOCKER IMAGELESS REPOSITORIES USED TO PUNT MALWARE AND PHISHING SCHEMES

JFrog identified that nearly 20% of repositories on DockerHub were imageless repositories that were involved in three campaigns to social engineer users to download malware or expose credit card information. The attacks would include links in the description of imageless repositories on DockerHub to redirect users to malicious pages. JFrog worked with DockerHub to remove the repositories and remove the capability to include links in imageless repositories' descriptions.

HOW NOT TO PROTECT YOUR ANDROID APPLICATIONS

This article advises against common security methods for Android apps, like relying on signing certificates and trusting the framework API, as they can be bypassed or manipulated by attackers. It also highlights the vulnerability of binary files in Android security, emphasizing the risk of hook attacks on dynamically linked binaries. The article suggests considering the potential benefits of cracked versions of apps as an alternative distribution channel with cost-effective advantages.

your infrastructure

CLOUD SECURITY FIRM WIZ RAISES WHOPPING $1 BILLION AT $12 BILLION VALUATION

Wiz has continued raising money to a staggering $12B valuation, with the goal of acquiring more companies to reach its target of $1B ARR by 2025. Its business now amounts to $350 million ARR.

ANETAC

Anetac has a Dynamic Identity and Security Platform that covers the threat attack surface of service accounts in hybrid environments, mapping access chains and automatically analyzing behavior.

MASTERPARSER

MasterParser seeks to be an all-in-one DFIR tool for analyzing Linux logs and extracting useful information. Currently, the tool has support for auth.log

POLICE RESURRECT LOCKBIT'S SITE AND TROLL THE RANSOMWARE GANG

Law enforcement agencies have resurrected the seized darkweb site of the infamous LockBit ransomware gang, teasing new revelations about the group. The revived site features posts with titles suggesting that authorities plan to release information about LockBit members and their activities within the next 24 hours in an apparent move to troll and warn the hackers after successfully infiltrating their operations earlier this year.

SSO TAX, CUT

This blog post discusses why Tailscale originally charged extra for advanced identity providers and why it decided to remove this charge. Tailscale requires SSO and doesn't allow for username + password authentication, but made the decision to charge extra for some paid/advanced identity providers, believing that clients of those IdPs might want premium features anyway. However, when Tailscale reevaluated its pricing structure, it realized that this created an SSO tax and customer feedback indicated that it didn't really impact their chosen services.

PDD IS A DYING FRAUDULENT COMPANY AND TEMU IS CLEVERLY HIDDEN SPYWARE

An internal and external investigation into PDD and its shopping app TEMU concluded that the app is spyware and is likely selling or looking to sell user data. Grizzly Research conducted its own decompilation of the TEMU app and corroborated with third-party researchers that the app is harvesting user data in malicious and hidden ways. The company's corporate financials and infrastructure are also suspect.

RSA CONFERENCE 2024 – ANNOUNCEMENTS SUMMARY (DAY 1)

Summary of all the announcements presented at RSA on day 1.

INTRODUCING CLOUDFLARE FOR UNIFIED RISK POSTURE

GOOGLE ROLLS BACK RECAPTCHA UPDATE TO FIX FIREFOX ISSUES

Google had to roll back a recent reCaptcha update because it broke in Firefox for Windows.

ANDROID BUG CAN LEAK DNS TRAFFIC WITH VPN KILL SWITCH ENABLED

An Android bug leaks DNS queries even with the VPN kill switch enabled, potentially exposing user privacy. The issue, where DNS information leaks when switching VPN servers, impacts all Android VPN apps. The bug persists in the latest Android OS version and could reveal users' online activities.

A MILLION AUSTRALIAN PUB GOERS WAKE UP TO FIND PERSONAL INFO LISTED ON LEAK SITE

A massive data leak has exposed over a million records of Australians who visited local pubs and clubs, including names, partial addresses, dates of birth, and venue details. The leaked data allegedly came from Outabox, a tech services company, and was posted on an anonymous leak site.

DROPBOX SAYS HACKERS STOLE CUSTOMER DATA AND AUTH SECRETS FROM ESIGNATURE SERVICE

Dropbox reported a breach of its Dropbox Sign signature platform. Attackers gained access to authentication tokens, MFA keys, hashed passwords, and customer information. Dropbox says that the attackers gained access through a backend system configuration tool.

HOW TO ENFORCE USAGE OF PRIVILEGED ACCESS WORKSTATIONS FOR ADMINS

This community post explains how to enforce the use of Privileged Access Workstations (PAWs) for administrators at Microsoft by using Conditional Access policies to block logins from non-PAW devices. It details steps such as tagging PAW devices, setting permissions in Microsoft Graph Explorer, and creating a device-based Conditional Access policy in the Entra Admin Center.

USING FEATURE FLAGS FOR SECURITY

This post provides a few examples of why it can be effective for security teams to adopt the use of feature flags. The proposed uses are: to release unreviewed code that can be enabled once it has been reviewed, to enable features only for external security testers as a beta, and to be able to speed up security incident response.

SEMGREP FOR TERRAFORM SECURITY

This article provides some use cases and examples of using Semgrep to secure Terraform deployments. Some examples presented are to use Semgrep to evangelize secure-by-default, internal modules, enforce opinionated rules, and prevent unverified providers. The article also works through an example of writing a custom rule for a more niche scenario.

PCAP DID WHAT

This repository presents an example of how to use the Zeek network monitoring tool with Grafana to analyze PCAP dumps and enable easy visual analysis. It contains a custom Zeek Docker build that generates Zeek log files with GeoIP, ASN, and JA3/JA4 fingerprints, a Python script for converting Zeek logs to SQLite database, as well as a custom Grafana Docker build with a pre-configured dashboard for analyzing Zeek Data.

APEX SECURITY

Apex's security platform provides organizations with visibility of their AI activities. Organizations can define what AI usage should look like within their environments and enforce security policies accordingly. The platform can detect violations of company policies, as well as detect and respond to attacks.

PREL

prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles and includes an approval process.

READ SATYA NADELLA'S MICROSOFT MEMO ON PUTTING SECURITY FIRST

Microsoft is overhauling its security processes, making security the "top priority" for all employees, after facing high-profile attacks. CEO Satya Nadella has instructed the company's over 200,000 employees to prioritize security above all else, even delaying new features or legacy support if needed.

COUNTERFEIT CISCO GEAR ENDED UP IN US MILITARY BASES, USED IN COMBAT OPERATIONS

A Florida resident, Onur Aksoy, was sentenced to 78 months in prison and ordered to pay $100 million in restitution to Cisco for running a counterfeit networking gear scam that generated $100 million in revenue and put U.S. military security at risk. Aksoy pleaded guilty to conspiring to traffic counterfeit goods, mail fraud, wire fraud, and importing fake Cisco products from China and Hong Kong and selling them as genuine through various online storefronts.

A SYSTEMATIC LITERATURE REVIEW ON ADVANCED PERSISTENT THREAT BEHAVIORS AND ITS DETECTION STRATEGY

This research paper from Oxford University Press discusses advanced persistent threats (APTs) and proposes a detection strategy based on multi-stage attack behaviors and network vulnerabilities. It emphasizes the importance of understanding APT attack-related behaviors to improve detection accuracy and response. By integrating attributes of APT attacks into detection methods, security experts can enhance their ability to prevent these sophisticated threats.

FRENCH CYBERWARRIORS READY TO TEST THEIR DEFENSE AGAINST HACKERS AND MALWARE DURING THE OLYMPICS

French cyberdefense is deep into preparation for the 2024 Paris Olympics.

THE STATE OF PENTESTING REPORT 2024

This report analyzes the impact of pentests, revealing a 21% increase in the number of findings per pentest engagement year-over-year.

FINLAND WARNS OF ANDROID MALWARE ATTACKS BREACHING BANK ACCOUNTS

Finland warns of an ongoing Android malware campaign targeting online bank accounts through deceitful SMS messages, impersonating banks, or payment service providers.

→ Read the full announcement

→ Get a demo of Secureframe's latest AI features

→ Visit Secureframe at RSAC [6] Booth #6573 in Moscone North Expo