Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A highly sophisticated cyber-attack on Leicester City Council has left some street lights illuminated day and night as an ongoing effect, weeks after the initial disruption to council services. The council was forced to take IT systems offline after the incident.
A report from Citizen Labs assessing the security of nine major cloud-based pinyin keyboard apps. The researchers found critical vulnerabilities in eight out of the nine assessed apps that would allow a passive network eavesdropper to decipher the user's keystrokes. Together with a previous report on Sogou, Citizen Labs estimates that up to one billion users are affected by these vulnerabilities.
This post describes how the author achieved unauthenticated remote code execution on a Mitel IP phone. They gained full root access to the device by exploiting vulnerabilities like command injection. Through careful exploitation and debugging, they successfully crafted an exploit payload for remote control of the device.
This post explains how you can prevent executable file uploads in PHP by calling a free API during the upload process that verifies file formats. By setting $allow_executables to false and optionally providing a $restrict_file_types whitelist, the API checks against 17+ million virus/malware signatures and rigorously verifies accepted formats, blocking executables and other threatening file types.
GitHub CSO Mike Hanley writes about their journey to implement a 2FA initiative to enhance software supply chain security by requiring developers to enable 2FA. The results showed a significant increase in 2FA adoption and a focus on secure authentication methods like passkeys. GitHub continues to prioritize user experience and aims to further improve account security measures in the future.
IBM announced it will acquire HashiCorp in a $6.4 billion deal to expand its cloud software offerings and tap into surging AI-driven demand. IBM will pay $35 per share, a 42.6% premium, for HashiCorp. HashiCorp is well known for Terraform, as well as Vault, Boundary, and Consul for security.
Nagomi Security has developed a proactive defense platform that enables security teams to optimize their existing cybersecurity solutions to identify risks, threats, and adversaries and their techniques.
BforeAI monitors most of the internet to establish a baseline for anomaly detection and stay ahead of cyber threats and prevent attacks before they happen. It autonomously maps and predicts malicious infrastructure to provide customers with preemptive defense and safeguard data, digital assets, users, and IT and OT networks.
More than 1,000 samples of the prolific Godfather mobile banking Trojan are circulating worldwide, targeting hundreds of banking apps across dozens of countries. First spotted in 2022, Godfather can record screens, intercept 2FA, initiate transfers, and more. Its developers are automatically generating new samples at scale to evade detection.
Google is further postponing its plan to phase out third-party cookies on Chrome, citing ongoing challenges in reconciling feedback from the industry, regulators, and developers. The long-delayed move to remove the small data files used for cross-site user tracking and ad targeting was originally announced in 2020 but has faced multiple delays due to significant considerations raised by various stakeholders.
Postman's Public API Network is unknowingly leaking thousands of live credentials from popular SaaS and cloud providers. The exposure of sensitive information is due to an unclear UI, ambiguous taxonomy, and the practice of publicly forking collections containing live API keys. Despite Postman's basic secret scanner, there is a significant risk of leaking secrets due to insufficient scanning and misleading terminology like "secret" environment variables.
The FTC is sending $5.6 million in refunds to Ring customers due to security failures
Gartner reports that 63% of organizations globally have partially or fully implemented a zero-trust strategy into their operations.
Google Meet now allows external participants, even those without Google accounts, to join encrypted calls through client-side encryption.
Sponsored
Fast-track software development with GenAI while staying secure. Download now for:
MITRE announced that it has discovered a network breach due to two chained Ivanti VPN zero days. The threat actors bypassed MFA via session hijacking to move laterally across the network and deployed a combination of webshells and backdoors to harvest credentials and maintain access. Evidence collected thus far shows that the attackers did not breach the core enterprise network or partner networks.
More than two months after a devastating ransomware attack, healthcare firm Change Healthcare finally confirmed paying a ransom. The payment of around $22 million in Bitcoin on March 1st was previously identified by researchers but unacknowledged by Change Healthcare. However, the company now warns that a "substantial proportion" of Americans' sensitive medical data may still have been stolen despite the ransom payment.
A phishing campaign is exploiting a bug in Nespresso's website to bypass detection by security tools that fail to identify malicious nested or hidden links. The attack begins with a phishing email about Microsoft sign-in activity. Clicking the link directs victims to a legitimate but compromised Nespresso URL, which delivers a fake Microsoft login page designed to steal credentials, all while evading security warnings due to the use of the Nespresso address.
This post from Lutra Security demonstrates an email phishing technique called Kobold Letters. In this attack, an attacker makes use of CSS selectors to make an email appear benign until it is forwarded, at which point the phishing email appears. This occurs because the HTML content is moved when the email is forwarded. Examples are provided for various email clients.
Common GitHub workflows rely upon long-lived credentials such as PATs or GitHub apps to interact with repos. To eliminate the possibility of credentials leaking, Chainguard built an STS for GitHub which exchanges short-term credentials for short-term credentials. The architecture for the middleware is described in the post.
This article discusses how to decode synology patch files using various reverse engineering techniques like decrypting an archive, extracting contents using keytypes and keybuffers, verifying message blocks, and decrypting entries using a ChaCha20Poly1305 key. It shows the process of decrypting and verifying entries in an archive using Python and various cryptographic functions. The article concludes with the successful decryption and verification of the contents of the archive entries.
Sponsored
Don't sleep on domain security! Claim this offer by Webnames [11] to automatically scan your domain names for security vulnerabilities and get actionable recommendations — including your domain's registrar lock status, Whois privacy status, and SSL/TLS connection status.
Blauhaunt is a tool suite for filtering and visualizing logon events that seeks to track logon events and actions from the user.
Strikeready is a security management platform that empowers SOC with AI automations and provides assistance to complex threats.
Bash script which quickly identifies open network ports and any associated vulnerabilities.
Researchers have discovered a dependency confusion vulnerability affecting the archived Apache Cordova App Harness project. Dependency confusion attacks exploit the fact that package managers prioritize public repositories over private ones, allowing attackers to publish malicious packages with the same name publicly.
The director general of the UK's National Crime Agency has urged Meta to reconsider its rollout of end-to-end encryption (E2EE) on Instagram, echoing concerns raised by European police chiefs about compromising law enforcement's ability to identify illegal activity. The call follows a joint declaration expressing concern over tech platforms implementing encryption that prevents access to message content for monitoring purposes, citing potential threats to child safety.
This article discusses Intellexa Consortium, which is a network of spyware companies that is facing sanctions for selling surveillance software with human rights and security risks. The consortium's complex structure involves multiple companies and investors, prompting calls for tighter oversight and regulation in the spyware market. Governments are urged to implement "know-your-vendor" requirements to increase transparency and accountability in the industry.
The popular EvilGinx phishing framework has launched an integration with the GoPhish framework in the newest release.
Mandiant's annual M-Trends report highlights improvements in defender capabilities, with global median time to identify dropping from 16 days in 2022 to 10 days in 2023.
Phylum discusses the approaches nation-state actors are taking to publish malware to Node Package Manager (NPM).
Since early 2023, the Akira ransomware has victimized over 250 organizations globally across multiple sectors, receiving over $42 million in ransom payments. Initially targeting Windows, it started infecting VMware ESXi virtual machines in April 2023 and has been deployed with Megazord malware since August 2023.
Frontier Communications has shut down operations after suffering a cyberattack on April 14 that resulted in the theft of PII. Containment efforts involved taking systems offline, leading to material operational disruptions. Frontier disclosed the breach impacted "portions" of its IT environment in an SEC filing but did not provide details on the type of PII accessed or those affected.
Threat actors are exploiting a GitHub flaw to distribute malware through URLs linked to a Microsoft repository, tricking users into thinking the files are safe. This is accomplished by leaving a comment with an uploaded file in a Microsoft repository in GitHub, which uploads the file to GitHub CDN associated with Microsoft's repository, allowing the attacker to make the URLs look more trustworthy. GitHub and Microsoft have been contacted regarding this issue, but the distribution of malware continues through Microsoft's GitHub repository.
This blog dives into server-side template injection, how it can occur, how to identify attempts, and how to set one up. Server-side template injection is when an attacker uses native template syntax to inject a malicious payload into a template, which is then executed server-side.
This blog post explains how to modify and add functionality to a dotnet application by manipulating its binary disassembly. The author demonstrates the process of injecting custom code into the application and reassembling it to create a backdoor. The manual approach described involves working with the disassembled code, adding new instructions, and reassembling the application to achieve the desired modifications without causing errors.
Hackers are targeting cloud apps and identities without touching endpoints. Organizations are at risk due to gaps in securing cloud identities. It is crucial that organizations focus on securing identities to protect services in the cloud effectively.
Sponsored
Join the virtual Cloud Security Capture the Flag Challenge! You'll have one hour to complete as many challenges as possible. Top 3 scorers will win a Valve Steam Deck [10] and all game participants will receive a $25 DoorDash gift card [10] to enjoy lunch after the session.
TrojAI is an AI security platform that allows customers to secure AI models and applications from risks and attacks.
A command-line tool that allows developers to find security vulnerabilities within a Java project using SAST and SCA.
LES is a tool that is designed to check for the exposure of a kernel to known exploits. It can also report on the state of various kernel hardening features.
MagicDot is a set of several critical vulnerabilities in Windows related to path handling. It includes a remote code execution flaw and elevation of privilege flaws involving shadow copy restoration and file deletion, as well as techniques for an unprivileged user to gain rootkit-like abilities. These vulnerabilities stem from how Windows removes trailing dots and spaces during path conversion, permitting malicious path manipulation.
Cybercriminals are exploiting recently patched OpenMetadata vulnerabilities in exposed Kubernetes clusters to illegally mine cryptocurrency using victims' resources. The open-source data organization tool had five flaws fixed in March that allowed authentication bypass and remote code execution if left unpatched.
This article discusses the Fuxnet malware attack by the Blackjack hacking group against Moscollector that targeted Moscow's infrastructure monitoring systems. Initially reported to affect around 500 sensor gateways, recent updates indicate broader impact with 1,700 gateways compromised. The malware destroyed data and disabled network systems, aiming to disrupt emergency services in Moscow by targeting sensor gateways and flooding sensor channels with random data packets.
A French hospital in Cannes had to postpone medical treatments and return to using pen and paper due to a cyberattack.
The history of how cybercrime has evolved into a $1.5 trillion industry over the past decade.
FBI Director Christopher Wray warns about China's increasing threat to U.S. critical infrastructure through hacking operations.