Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Qantas fixed a bug with its app which allowed some passengers to view the flight details and names of other passengers. The company assures users that the bug was not due to a cybersecurity incident but rather a “technology issue.” No additional personal information or financial information was shared.
A 9.9 severity vulnerability in the WordPress Automatic plugin was disclosed in March. The vulnerability is a SQL injection that could allow unauthenticated attackers to create admin accounts and take over a WordPress site. WPScan has logged more than 5 million attempts to exploit the vulnerability since disclosure.
Panda Restaurant Group experienced a data breach in March, leading to the theft of associates' personal information. The breach affected corporate systems but not in-store operations or guest experience. The company is offering affected individuals credit monitoring services and advises vigilance against identity theft.
An exploration of the BlackBerry MDM solution. It walks through the process of reverse engineering the BlackBerry MDM client and uncovers several flaws in the authentication scheme. The vulnerabilities were reported to and dismissed by BlackBerry.
This blog post details how the now-retired domain code.microsoft.com was turned into a honeypot by Microsoft to collect threat intelligence on malicious activities targeting its infrastructure. By repurposing the dangling subdomain, Microsoft was able to attract and monitor attackers, gaining valuable insights to enhance its security measures. The honeypot successfully detected and mitigated a potential malware hosting incident in 2021.
This blog post discusses using password spraying to gain access to Microsoft 365 accounts during red team engagements. It highlights the importance of avoiding lockouts and utilizing tools like Fireprox for successful password spraying. The approach involves testing methodologies, being mindful of client communications, and exploiting MFA gaps for initial access.
The systemd team has created a replacement for sudo called run0 for version 256. run0 does not require SUID to run.
Prompt Injection Defenses is a collection of different practical and proposed defenses against prompt injection.
The Kubenomicon is a collection of offensive security techniques for Kubernetes clusters. It's heavily inspired by the Microsoft Kubernetes Threat Matrix.
A post from the maintainer of the webauthn-rs library on why they believe that passkeys will ultimately fail. The author lays out their original hopes for webauthn and why we failed to get there. Reasons for the failure of passkeys include corporations acting in their own self-interest, anti-open source behaviors, and messy implementations ruining the user experience around passkeys.
The ArcaneDoor espionage tool is an example of state-sponsored actors targeting perimeter network devices from multiple vendors. It exploits two vulnerabilities, CVE-2024-20353 and CVE-2024-20359, and is not limited to Cisco devices. These authors recommend bolstering perimeter security and adopting robust security practices to prevent these types of attacks.
This blog post talks about how MFA, or multifactor authentication, is facing challenges with phishing attacks and session hijacking. Attacks on MFA factors like passwords and OTPs can compromise user security. Organizations need to prioritize stronger authentication methods to protect against evolving threats.
CISA and the FBI advise software companies to fix path traversal vulnerabilities before releasing products to prevent attackers from exploiting file manipulation for malicious purposes.
Researchers can now earn up to $450,000 for reporting critical vulnerabilities in top-tier applications.
The AI-powered Rabbit R1 gadget is actually just an Android app that can run on a regular phone.
Google's enhanced security measures helped block 2.28 million privacy-violating apps from its Play Store in 2023. The company banned 333,000 bad accounts, rejected nearly 200,000 apps using sensitive permissions, and worked with SDK providers to reduce data access and sharing, impacting over 790,000 apps and improving user privacy.
The FCC reported that Verizon, AT&T, T-Mobile, and Sprint sold data “aggregators” access to their customers' location data. This data was then resold to third-party location-based service providers. The FCC has issued a fine for circumventing the requirement to obtain user consent after the telecommunications providers were alerted of this issue and did not remediate it.
Over 25,000 people had their personal and financial data stolen in a breach at the Philadelphia Inquirer in May 2023. The breach disrupted newspaper operations, but the website remained unaffected. The ransomware group responsible, named Cuba, published stolen files after the newspaper refused to pay a ransom.
Avast tracked a campaign that targeted users in the Asian region with fake recruitment offers. Victims were socially engineered into installing and running a Trojan version of AmazonVNC that utilized a 0-day to install a novel RAT. This RAT had the ability to change file timestamps.
This blog post takes a critical look at an academic paper that received widespread media attention which claimed to have built an LLM Agent that can exploit one-day vulnerabilities. The author points out that the paper included an agent that had Internet access and that the authors of the paper chose CVEs that had very detailed exploits and PoCs available. The post concludes that the paper demonstrated the capabilities of GPT-4 as an intelligent scanner and crawler but based on the data provided didn't demonstrate its ability to rediscover these vulnerabilities or generate novel exploit code.
Sprinto is a security compliance platform that works with any cloud setup and helps monitor entity-level risks and controls from a single dashboard. It focuses on continuous compliance and healthy operational practices.
Application Inspector is a source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a JSON-based rules engine. It is ideal for scanning components before use or detecting feature-level changes.
GraphQL Cop is a Python utility that runs common security tests against GraphQL APIs. It can be incorporated into CI/CD and provides cURL requests for any findings.
A critical vulnerability has been discovered in the R programming language, widely used for data analysis and AI/ML, that allows arbitrary code execution when deserializing specially crafted RDS and RDX files. The vulnerability exploits R's handling of serialization/deserialization, enabling attackers to embed malicious code in file metadata for execution upon opening the files.
Cybersecurity researchers have uncovered multiple malicious campaigns targeting Docker Hub that planted millions of "imageless" containers over the past five years. Over 4 million repositories have been found to be empty except for documentation containing links to phishing or malware sites.
CISA reports that it notified 1,754 Internet-facing devices that they might be vulnerable to ransomware. Of those, 852 were resolved.
Google has updated its Minimum Viable Secure Product standard, focusing on essential security controls for products and services.
The U.S. Department of Homeland Security has released new guidelines to protect critical infrastructure from AI risks and a report on AI misuse in CBRN threats.
> Demonstrate your commitment [4] to security and compliance with readiness reports, automated questionnaires, and Trust Centers
Sponsored
Kaiser is notifying 13.4 million current and former members and patients of a data breach. After conducting an investigation, Kaiser found that certain online technologies previously installed on its websites and mobile apps may have transmitted personal information to third-party advertisers. The data shared includes member names and IP addresses, whether the members were signed into a Kaiser Permanente account, how members navigated the website and mobile apps, and search terms used in the health encyclopedia.
According to research done by Akamai, fake USPS smishing attacks delivered traffic to fake USPS sites that were on par, or even exceeding, traffic to the legitimate USPS website. Akamai conducted a fairly conservative analysis by deriving a malicious domain list from one smishing text that an employee received. The attacks have been successful, despite many public awareness campaigns to protect users from them.
A critical zero-day vulnerability (CVE-2024-4040) in CrushFTP, a managed file transfer software, remains unpatched in over 1,400 instances. The flaw allows remote code execution by escaping the VFS sandbox. CrushFTP is urging customers to update after disclosing in-the-wild exploitation.
S3 Bucket Encryption options all equate to access control more than encryption. In nearly every S3 encryption option (default SSE, KMS, and SSE-C), the user can either download the decrypted file if they have permissions to the encryption material or cannot download the file. Since a user never actually interacts with the encrypted file, the encryption feels more like access control.
This article provides an overview of the benefits of IMDSv2 vs IMDSv1. It covers detection methods to identify EC2 instances with IMDSv1 enabled and CloudWatch queries to identify access to the service. It also details how to disable the service and place guardrails to prevent instances being launched with it enabled.
This blog post discusses automating API vulnerability testing using Postman Workflows, a feature that streamlines the process of demonstrating API vulnerabilities without programming. By creating sequences of HTTP requests within Postman, users can automate tasks like identifying Broken Object-Level Authorization (BOLA) vulnerabilities and retrieving sensitive data. Postman Workflows offer a visual drag-and-drop approach to building automated flows for API testing and exploitation.
Sponsored
Capable of seamlessly ingesting any log, in any language, the enhanced MDR solution now uses AI to deliver precision-guided detection. With thorough, contextual investigations, CYREBRO focuses on what truly matters. Read about CYREBRO's Managed Detection & Response [11].
A collection of Slack bots from OpenAI that integrate with OpenAI's APIs to streamline security teams' workflows.
Prophet AI for Security Operations filters incoming alerts and, for each of them, gathers, correlates, and analyzes data from multiple sources to provide a determination and a detailed summary of the investigation.
Know the exact crate versions used to build your Rust executable. Audit binaries for known bugs or security vulnerabilities in production, at scale, with zero bookkeeping.
Microsoft is grappling with a series of high-profile security incidents that have undermined trust in the tech giant. Hackers have spied on Microsoft's senior leadership emails, exploited Microsoft Exchange and Cloud services to access business and government email accounts, and stolen source code despite efforts to improve defenses. The company's security culture is inadequate and requires an overhaul.
The UK's controversial Investigatory Powers (Amendment) Bill 2024, dubbed the "snooper's charter", has received royal assent and will expand the digital surveillance capabilities of intelligence agencies, police, and others under the existing Investigatory Powers Act 2016. The amendments allow authorities to gather more data from citizens, including telecoms activity, to tackle "modern threats", including national security and child abuse. Critics have raised privacy concerns over the widened powers.
This blog post from Google Security describes how the Find My feature was built with privacy and end-to-end encryption while utilizing crowdsourcing. Safety-first protections, such as aggregation by default and at-home protection, help prevent unwanted tracking and ensure user safety. Users also have full control over their device participation in the network, providing options to contribute to aggregated location reporting or opt-out completely.
Simple guide on how to get your data off Google.
PCI DSS 4.0 now requires Certificate Transparency Monitoring to ensure all trusted certificates are accounted for.
Sponsored
WorkOS is bolstering its vision to become the world's best identity platform with the acquisition of Warrant - an open source authorization service.
Open Devin, an AI software tool, had path traversal and DNS rebinding vulnerabilities that could lead to data exfiltration. The community swiftly fixed these issues. Mitigations include using authentication, enforcing host header value, and employing TLS for protection.