Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
VF Group - which owns brands such as Vans, The North Face, and Timberland - reported that it suffered a data breach in December 2023. Stolen information included email addresses, full names, phone numbers, and billing and shipping addresses. The company maintains that no financial information could have been stolen as it doesn't collect or retain any.
A group of researchers discovered a method to bypass AWS’ Block Public Access protections in a way that will not be detected by AWS. The method requires using a Customer Managed KMS key and a permissive bucket policy.
This post discusses utilizing Visual Studio Code extensions as a persistence mechanism. It begins with an overview of the process of creating extensions for VS Code and then walks through the process of developing a malicious extension that utilizes activation events to install a malicious implant.
This post describes a project, inspired by linux_injector, for injecting code into a process on Android without the use of ptrace. The injector locates a function in /proc/mem to overwrite and then utilizes a multistage shell code injector to map memory and inject to it. The post goes through the process of developing the shell code and the injector in Rust.
bincapz is a tool to enumerate a list of predicted capabilities of a binary. It can be run in diff mode to catch any supply chain vulnerability.
AutoSmuggle is a tool that creates HTML or SVG files that can be smuggled past content filters.
ReverserAI provides automated reverse engineering assistance through the usage of LLMs. The LLMs are locally hosted and can be run on consumer-grade hardware.
This article provides an overview of the APFS file system. It begins by describing the data structures that make up a file in APFS, then describes the clone operation that allows for efficient file duplication and how hard links work. The post concludes by describing how to use the author’s tool to inspect APFS file attributes.
The House has passed a landmark data privacy bill. The bill prevents any company that is defined as a data broker from selling data to foreign adversaries. It now moves to the Senate along with the TikTok ban. The bill faces much wider bipartisan support.
GitHub has launched a beta for its code-scanning autofix feature. This feature combines CodeQL and Copilot to suggest fixes for detected vulnerabilities. GitHub promises that the feature can remediate two-thirds of vulnerabilities it finds with 90% coverage of its supported languages.
The U.S. is reportedly considering blacklisting the Chinese chipmakers that are responsible for making Huawei’s chips.
Glassdoor has announced a new policy that requires posters to verify their real names.
Hackers at Pwn2Own Vancouver 2024 earned $1,132,500 by demonstrating 29 zero-day vulnerabilities across various categories like web browsers, enterprise applications, and more.
Sponsored
There’s a ton of buzz around Zero Trust Networking [5]. Most of it is driven by security vendors targeting large enterprises with contracts worth hundreds of thousands of dollars. But what about smaller companies without big budgets for expensive network security solutions?
☁️ Try NetBird Cloud [8]for free
Three cybersecurity researchers found nearly 19 million plaintext passwords exposed on the internet due to misconfigured Firebase instances. They scanned over five million domains and identified 916 vulnerable websites. These instances revealed more than 125 million sensitive user records that included emails, names, passwords, phone numbers, and bank details.
USBGuard on Linux can be bypassed when not configured with specific vendor and product IDs, allowing attackers to circumvent USB authorization policies. Attackers can present devices as innocuous HID or hub devices while actually being malicious by exploiting the kernel's matching process.
This blog post describes a logic bug in the memory management unit of the ARM Mali GPU used in Pixel 8 phones that can be used to bypass Memory Tagging Extension (MTE). This vulnerability, GHSL-2023-005, is related to GPU memory handling, particularly JIT memory, and how it is managed by the kbase_context in the Mali GPU driver. Attackers can cause inconsistencies in GPU memory mapping by exploiting the race window between memory growth triggers.
This blog post delves into how SpecterInsight’s ransomware emulation capability functions and provides insights into the operational flow of a full emulated ransomware deployment kill chain. It details the tools used, the ransomware deployment process, ethical considerations, defense evasion techniques, obfuscation methods in PowerShell and C#, and the user prompt element in the ransom message. It also outlines the responsibilities of the encrypter, loader, ransom message/decrypter, and deployment script components in orchestrating the kill chain.
This article discusses the challenges faced by Alphabet in migrating to a BeyondCorp-style architecture, specifically the long tail of difficult use cases where gaps in tooling, available data, management buy-in, or specialized technical knowledge historically prevented users from migrating to a zero-trust model. The article also describes the processes, tools, and solutions created to handle these use cases and provides lessons learned to help others address the long tail of migration to a BeyondCorp-style architecture.
Sponsored
DAST finds vulnerabilities that cannot be discovered with Static Analysis (SAST) or Software Composition Analysis (SCA). Try it for free with Veracode [15]: → Launch rapid, on-demand scans earlier in development.
Ludus is a system built on Proxmox to simplify building easy-to-use cyber environments, or 'ranges', for testing and development. It comes with various templates.
HakTrails is a command line tool for querying the SecurityTrails API for DNS recon.
Retina is an eBPF-based Kubernetes network observability platform that provides a centralized hub for monitoring application and network health and cluster security.
This document details the steps taken to identify a vulnerability in FortiGate and create a working exploit. It explains the changes made to the function, such as additional length checks and error messages, to address the vulnerability.
A deep-dive into Kubernetes RBAC. The guide provides an overview of RBAC options in Kubernetes, best practices, and tool comparisons. It explores of how RBAC factored into k8s attacks in 2023 and includes a tutorial on using KSOC.
This post describes the process of escalating privileges from a restricted shell to an unrestricted shell in a text-based game. It details a method for using echo and history to read and write arbitrary files when standard tools are restricted.
The White House and the Environmental Protection Agency have warned US governors that cyberattacks are disabling water systems throughout the country.
The US Federal Trade Commission has issued a warning about scammers impersonating its employees to steal money from American citizens.
Oracle has advised Apple users to hold off on installing the macOS 14.4 update on ARM-based Macs due to a bug that causes Java processes to abruptly terminate on affected devices. It affects all Java versions from 8 to the latest JDK 22 builds.
StopCrypt is an incredibly prolific ransomware that targets individuals with smaller ransomware payments as opposed to targeting businesses for larger payments. A newer variant has been found that uses advanced techniques like dynamically constructed API calls and process hollowing to evade detection.
More than 70 million records from an unspecified division of AT&T were leaked on the Breached hacking forum. The legitimacy of the stolen data has been verified, though its source remains uncertain, possibly linked to a third-party organization.
Researchers have identified a new data leakage vulnerability called GhostRace which affects modern CPUs that support speculative execution. This vulnerability allows attackers to extract data from the processor through speculative executable code paths, posing a significant security risk.
This article is about the risks of insider threats in open-source projects that use GitHub Actions. Users with write access to a repository can push and immediately delete malicious Git tags. This vulnerability can be mitigated by enabling Tag protection so that these commits don’t trigger malicious actions.
Obsidian can be used for performing live correlations and statistics at scale using private Cyber Threat Intelligence datasets. Due to the local nature of Obsidian, this setup can provide privacy and security. Additional features like plugins can help extend the tool with features like diagrams, mind maps, statistics, and charts.
Sponsored
Organizations are inundated with alerts and potential vulnerabilities, making it crucial to sift through the noise and prioritize responses efficiently.
DNS-Tunnel-Keylogger is a tool for lightweight exfiltration and persistence, with properties that prevent detection. It uses DNS tunneling/exfiltration to bypass firewalls and avoid detection.
GitDoorCheck is a static analyzer for GitHub repositories powered by OpenAI-compatible LLMs. The tool uses GPT-4 or other compatible LLMs to scan repositories for backdoors and output the results as a JSON. It can be added to CI/CD pipelines.
Indicator of Canary is a collection of PoCs gathered from research on identifying canaries in various file formats.
Android malware targeting the elderly was sent out as fabricated wedding invitations. The victims, believing the APK to contain more details about a free wedding, installed the malware and ended up having their SMS data stolen. The malware used a Telegram bot as its command and control server.
As the publishers of CVEs, the NVD is a core part of many security systems. The NVD recently posted an announcement that it is establishing a consortium to address challenges within the organization. This has led to 90% of proposed CVEs going unassigned and the association of CPEs, CVSS, and CWEs to CVEs to be severely halted. This author proposes a few alternatives to the NVD.
Researchers from Augusta University have developed a new acoustic side-channel attack that can deduce user input based on typing patterns. The attack leverages the distinctive sound emissions of different keystrokes and users' typing patterns. The method can reach a typing prediction accuracy of 43% on average, even in poor conditions such as environments with noise, and does not require controlled recording conditions.
The NSA has released a collection of ten guides for improving Cloud Security posture.
The US Department of Justice is recovering $2.3 million in cryptocurrency from a "pig butchering" fraud scheme that targeted at least 37 people across the United States.
The International Monetary Fund (IMF) disclosed a cyber incident detected in February after unknown attackers breached 11 IMF email accounts hosted on Microsoft's Office 365 platform.
Nissan will be informing around 100,000 people in Australia and New Zealand that their data was breached over the next few weeks. Up to ten percent of victims had government identification stolen while the rest had other PII stolen. Nissan will be offering 12 months of free credit monitoring for affected individuals.
Fortinet has a critical vulnerability in its FortiClient EMS that enables remote code execution. The SQL injection vulnerability enables unauthenticated attackers to execute arbitrary commands. Horizon3 said that it will release a technical deep dive and proof-of-concept exploit code next week.