Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Omni Hotels has confirmed that cybercriminals stole customers' personal information, including names, email addresses, postal addresses, and guest loyalty program data. The ransomware gang Daixin claimed responsibility and threatened to leak customer records dating back to 2017 on its dark website, a common extortion tactic.
Cisco has disclosed a high-severity vulnerability in the Integrated Management Controller that affects various devices. A patch has been provided by Cisco to address the root escalation vulnerability. Exploit code has been released publicly, but there have been no known exploitations of the issue reported yet.
In this two-part series of blog posts, Google Project Zero details how it audited the Windows Registry for bugs over a 20-month period, resulting in 50 CVEs filed and fixed by Microsoft. The research led to the discovery of various memory corruption vulnerabilities with different exploitability levels. Upcoming blog posts will delve into practical exploitation techniques using registry vulnerabilities.
This post explores using Nuclei to find vulnerabilities in web applications. It sets up two scenarios: one involving an SSRF in an application hosted on Azure and the other a vulnerable TeamCity environment. The post goes through the process of setting up the scenarios, creating nuclei templates, and testing them.
Miggo's ADR (Application, Detection, and Response) is designed to do for applications what EDR does for endpoints. The ADR shows how people are using the application. It establishes baseline standards of behavior between different services, data flows, and authentication mechanisms, allowing it to identify and prevent subsequent malicious activities – in real time.
DNSViz is a tool suite for the analysis and visualization of DNS behavior including DNSSEC.
In a new paper, researchers from the University of Illinois Urbana-Champaign claim that AI agents combining large language models like OpenAI's GPT-4 with automation software can successfully exploit real-world security vulnerabilities by reading security advisories. They tested GPT-4 on 15 one-day vulnerabilities and it could exploit 87% of them, outperforming other models and open-source scanners.
Cloudflare has released its DDoS Threat Report for Q1 2024. The quarter featured a 50% increase in DDoS attacks from a year ago with more than half being DNS-based DDoS attacks. The most targeted industries were gambling and gaming.
The UK has announced that it will criminalize the creation and sharing of sexually explicit deepfake images.
Russian Sandworm hackers, linked to Russian military intelligence, posed as hacktivists in water utility breaches, using multiple online personas to hide their attacks.
CISA, FBI, and ODNI released a guidance document on securing election infrastructure from foreign influence tactics.
Sponsored
Can GenAI solve some of the most persistent industry challenges and help reduce cloud risk? This blog post by Orca Security [4] shows how AI is being used to tackle the cloud security skills shortage, reduce alert fatigue, break down organizational silos, and tackle other pressing industry issues.
↗️ Find out how AI-driven cloud security [5] simplifies investigations and accelerates remediation
A vulnerability in PuTTY 0.68-0.80 could allow attackers with access to 60 cryptographic signatures from a user to compute the private keys offline. These signatures could come from an attacker-controlled SSH server or signed git commits. The vulnerability arises from the way that PuTTY generates ECDSA nonces, which lacks robust cryptographic random number generators on specific Windows versions.
Ivanti fixed 27 vulnerabilities in its Avalanche MDM solution, including critical flaws that allowed remote attackers to execute commands. These security updates are crucial for protecting over 100,000 mobile devices from potential attacks. It is recommended that customers update to the latest Avalanche 6.4.3 version to stay secure.
Security researchers discovered a takeover attempt targeting the OpenJS Foundation similar to a recent incident with the XZ Utils project. Suspicious emails urged OpenJS to update a JavaScript project and designate new maintainers without proper involvement. Maintainers of open-source projects should be cautious of social engineering attacks targeting their sense of duty and community.
Delinea Secret Server is a PAM that helps organizations secure, manage, and monitor privileged accounts. This post delves through the process of hunting for an AuthN/AuthZ bypass, decompiling the relevant code sections, and crafting the exploit. It includes detailed reproduction steps and a proof of concept for obtaining admin access.
This post describes the reasoning and process followed to deploy Tailscale for a fully remote company. It goes over the motivation for this deployment, its advantages, and some tips and potential pitfalls in this setup. The post concludes with some features that were introduced since the original deployment that would have been helpful for future deployments.
This post provides an overview of SIEM correlation techniques. It begins by defining correlation, introducing the MITRE ATT&CK framework, and presenting an example of a simple correlation rule. The post then continues to work through an example of detecting a Brute Force Okta Login, while combining multiple TTPs and log sources.
A repository of libraries in different languages that provide secure-by-default functions to eliminate bug classes.
CVENotifier is a customizable notifier for CVEs based on keywords. This tool scrapes the CVE feed from vuldb.com, filters it based on keywords, and notifies via Slack about the latest CVEs only for the technology or the products you have listed as keywords.
Cloud-Key-Rotator is a program written in Golang that helps manage cloud service account key rotation. Not only does it support many different services, the tool also attempts to verify its actions as much as possible and aborts immediately if it encounters an error.
Stedi discovered a vulnerability in AWS STS that arose from its usage of IAM role trust policies that relied upon resource tags and request tags. AWS first denied the issue, then found that the scope of the problem was larger than initially believed, but still took 6 months to deploy a fix. A major issue is that the AWS IAM Policy Simulator lacks many IAM features, which makes it difficult and time consuming to properly test IAM policies.
Cryptographer and Professor Matthew Green addresses the new e-print authored by Yilei Chen, “Quantum Algorithms for Lattice Problems," which could potentially threaten current lattice-based encryption schemes. Despite the significance of this discovery, it may not immediately affect widely used schemes like Kyber or Dilithium. The cryptography community is closely monitoring this development for potential implications for future encryption security.
The FTC fined Cerebral $7 million for sharing users' sensitive health data with third parties without consent. Cerebral misled consumers about its privacy practices and failed to protect their information. The company must now improve its privacy policies and delete unnecessary consumer data.
Chirp Systems' smart locks have a security flaw allowing remote access to 50,000 homes - the company hasn't fixed it despite being notified in 2021.
The NSA has released guidance aimed at national security and defense companies deploying AI systems for securing AI systems to prevent malicious activities.
Cloudflare's DDOS Threat Report for 2024 Q1 contains interesting tidbits like how Sweden experienced a 466% surge in DDoS attacks following its acceptance to the NATO alliance.
Roku acknowledged a security breach where hackers gained access to around 576,000 user accounts. This is the second such incident for the streaming device maker, raising concerns about the company's data security measures and the potential exposure of users' personal information.
Threat actors are exploiting a critical command injection vulnerability (CVE-2024-3400) in Palo Alto Networks firewalls that allows unauthenticated attackers to execute arbitrary code with root privileges. The vulnerability, with a severity score of 10/10, affects the GlobalProtect feature in PAN-OS versions 10.2, 11.0, and 11.1.
A hacker breached Canadian retail chain Giant Tiger, exposing 2.8 million customer records with personal information. The compromised data included email addresses, names, phone numbers, and physical addresses, but financial information was not affected. Customers can check if their data was leaked using the HaveIBeenPwned service.
This blog summarizes the architecture of a fully-featured open source SOC lab consisting of powerful technologies used by Fortune 500 companies. Despite being open source, these tools offer comprehensive security incident detection, response, automation, and threat intelligence capabilities.
This blog post explores the internals of seccomp including its architecture, key concepts, and practical applications. The post provides kernel code examples that refer to x86_64 architecture with Linux kernel version 6.7.1. The second part of the post is expected to cover seccomp notifications.
This article discusses a significant security breach involving the XZ compression tool, used widely in Linux distributions, which was discovered to contain a malicious backdoor. This backdoor specifically targeted distribution builds using GCC and glibc, raising serious concerns about supply chain security. The openSUSE team, upon discovering the threat, acted swiftly to remove the compromised software and rebuild affected packages to ensure system integrity. The scenario emphasizes the need for heightened security measures and more robust community vigilance in open-source projects.
Sponsored
Compliance can be a major pain point. But with a streamlined workflow and expert guidance, it doesn't have to be. Secureframe [9] automates compliance from zero to audit-ready, with guided support from in-house experts — and makes sure you maintain compliance while you scale. ✅ Trusted by Nasdaq, Smartcar, and Lyra Health
Simbian is an autonomous security platform for enterprises. Humans make all the strategic decisions while AI implements those decisions.
A Kubernetes attack graph tool that enables automated calculation of attack paths between assets in a cluster.
hauditor is a tool designed to analyze the security headers returned by a web page and report dangerous configurations.
A former security engineer at Amazon, Shakeeb Ahmed was sentenced to three years in prison for hacking two cryptocurrency exchanges in July 2022 and stealing over $12.3 million. He pled guilty to computer fraud charges in December 2023 following his arrest in July. Ahmed exploited security flaws to insert fake pricing data and fraudulently generate inflated fees, which he then withdrew.
Attackers are manipulating GitHub search rankings by creating malicious repositories with popular names and topics and using automated updates and fake stars to deceive users. The recent campaign involves a large malware executable that targets cryptocurrency wallets, establishing persistence through a scheduled task.
Royal Mail introduced barcoded stamps to enhance security and prevent forgeries, but counterfeit stamps have flooded the UK. Customers face fines for unknowingly using fake stamps purchased at Post Offices. The transition to barcoded stamps raised privacy concerns due to the potential loss of anonymity in mail.
The FBI warns of a large wave of text message scams that trick people into clicking links to pay unpaid tolls.
LastPass avoided a security breach in which an employee was targeted with a deepfake scam impersonating the CEO.
Google has introduced Chrome Enterprise Premium, a new version of its browser for organizations that offers advanced security features for a monthly fee per user.
Sponsored
Chainguard interviewed security leaders [3] across various industries to see how many hours they are spending on vulnerability management tasks including scanning for, triaging, and remediating CVEs. Key findings include: ⏱️ Thousands of hours [3] annually are spent on CVE management.
Apple has sent threat notifications to iPhone users in 92 countries warning them about potential targeting by mercenary spyware attacks. The alerts state that Apple detected attempts to remotely compromise the users' iPhones, likely due to who they are or what they do. The warnings come amid rising concerns over state-sponsored efforts to influence elections, though Apple did not comment on the timing.
Irish taxi software firm iCabbi suffered a data breach that exposed nearly 300,000 customers' personal data, including names, emails, and phone numbers of senior officials and journalists. The breach was due to an unprotected database resulting from "human error" during a database migration. iCabbi acknowledged the breach, stating that it notified affected taxi companies, but did not disclose if any individuals suffered losses.