A new malware strain that targets both Windows and Linux is being distributed as a base64 encoded payload from the aNotepad service. The WogRAT malware on Windows is loaded as a DLL and communicates with C2 servers via POST requests to receive commands for uploading and downloading files, waiting, running arbitrary commands, and terminating. The Linux version behaves similarly except that it uses a TinySHell backdoor to communicate with the C2 server over a reverse shell.
This interview delves into the extraordinary journey of Sam Paniagua, founder of fraud prevention firm Hive Forensics. An unconventional path, Paniagua's story is one of transformation, redemption, and unwavering determination in using cybersecurity innovation to safeguard dreams, livelihoods, and digital society's foundations.
UEFI attacks, which require advanced techniques, are becoming more prevalent. This article begins with an overview of the UEFI system and common attacks on UEFI malware. It then works through Rapid7’s Velociraptor tool’s capabilities for performing forensic investigations on UEFI malware-infected systems.
Golden SAML is a post-exploitation attack technique that involves extracting signing certificates from Active Directory Federation Services to forge signing certificates. In the wake of the Solar Winds attack, organizations were urged to move to a cloud-based SAML like Entra ID to prevent Golden SAML attacks. This post presents a new attack method that leverages externally generated SAML certificates to forge authentication responses from an Entra ID SAML server.
Sponsored
Tight deadlines for developers lead to security vulnerabilities, but good luck convincing executives to move slower. A more realistic solution? Faster security testing with Dynamic Analysis (DAST) [10]. Launch scans with a few clicks to rapidly find runtime vulnerabilities [10] in web apps and APIs, and see near-instant results with <5% FPR.
Breadlog maintains stable, unique references to log messages in your source code. This helps you identify application events from log messages using numerical IDs that stay the same even when a log message's content changes. No brittle or complex text parsing required.
syzkaller is an unsupervised coverage-guided kernel fuzzer.
Badgerboard is an open source example implementation of a hardware/software solution that can lift traffic from a Schneider Electric X80 backplane into "normal" network traffic to be inspected and acted upon by various network visibility security solutions, such as Snort. This repository includes a link to a blog post with more details on what the hardware and software setup looks like.
CISA has set up an Election Operations Center to coordinate threat responses for the 2024 primaries and elections, providing cybersecurity training, guidelines, and a Protect2024 website with resources for state officials. No credible threats have been detected yet. CISA is focused on potential DDoS, ransomware, and emerging AI risks to secure the electoral process.
Japan ordered messaging app LINE and its parent company NAVER to separate their tech stacks after a data breach exposed over 510,000 users' data. The government cited deep entanglements between the companies' systems and authentication services that enabled unauthorized access. They must now implement their own authentication tools and minimize interconnections.
The NSA has released a Cybersecurity information sheet that provides guidance on how to strengthen internal network control and contain network intrusions to a segmented portion of the network using Zero Trust principles. It is assisting DoD customers in piloting Zero Trust systems and is developing additional guidance for incorporating Zero Trust principles and designs into enterprise networks.
Spain’s data protection authority has ordered Worldcoin to temporarily stop collecting and processing personal data from the market.
Security researchers report that Flipper Zero devices can be used to execute an easy phishing attack that can compromise Tesla accounts and unlock and steal cars.
The FBI's Internet Crime Complaint Center (IC3) reported a record $12.5 billion in online crime losses in 2023, a 22% increase from the previous year, with 880,000 complaints received.
Sponsored
Cloud attacks are fast, and operating in the cloud securely requires a new mindset. Sysdig has introduced the 5/5/5 Benchmark for Cloud Detection and Response [6] as a new standard for incident response: 5 seconds to detect, 5 minutes triage, and 5 minutes to respond. To meet this benchmark, security teams need to focus on what’s happening right now — deployed applications — not only pre-delivery scanning. Runtime Insights [5] are key to identifying in-use [5] packages, configs, permissions, and network connections that pose an active risk.
New research shows that over 225,000 logs containing compromised OpenAI ChatGPT credentials were sold on underground markets between January and October 2023. The data came from devices infected with information stealer malware like LummaC2 and RedLine. Over 130,000 unique hosts with ChatGPT access were infiltrated during June-October alone, a 36% rise from earlier 2023.
Some of American Express' customers' credit card data was exposed after a merchant processor was hacked. American Express itself was not breached. The breach at the third-party service provider led to unauthorized access to customers' account numbers, names, and card expiration dates. It is unclear how many customers were impacted.
JetBrains has advised users to urgently patch two vulnerabilities in TeamCity servers. The less severe vulnerability allows unauthenticated users to obtain a limited amount of information disclosure and modification while the more severe vulnerability allows for a total server compromise. Cloud instances have been patched and show no evidence of exploitation.
Researchers created a computer worm called Morris II that targets AI-powered applications by using adversarial self-replicating prompts. They demonstrated it against AI email assistants for spamming and data exfiltration across different models and input types. The worm replicates itself through prompts that make AI models engage in malicious activities and propagation.
An in-depth guide on different types of Prompt Injection attacks. The guide also includes real-world examples of some attacks, best practices for preventing prompt injection, and tools that can aid in defending against prompt injection.
A guided tutorial on adding a new service detection to nmap. It walks through the process of cloning nmap, understanding the OPC UA specification, writing a script to capture the relevant probe, and adding the probe to nmap. It also includes details for testing and contributing the change to the official nmap project.
Cloudflare is launching Firewall for AI, a protection layer to identify abuses against large language models before they reach the models. It will include features like rate limiting, sensitive data detection, and prompt validation to detect exploits and data extraction attempts, leveraging Cloudflare's network to protect users and LLMs.
Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution.
A free service that allows users to subscribe to TlS certificate expiry notifications via RSS. No sign-up is required and notifications are generated at 30 days, 7 days, and 1 day until expiration.
Security firm Rapid7 criticized JetBrains for silently patching two vulnerabilities in TeamCity before public disclosure, violating coordinated vulnerability disclosure norms. Despite Rapid7's policy against silent patching, JetBrains released patches without an advisory or notifying researchers. Rapid7 then published details of the vulnerabilities after JetBrains ignored inquiries.
A fake ransomware group called Mogilevich admitted to lying about hacking Fortnite maker Epic Games in an attempt to trick hackers into buying tools from them. The group claimed to have accessed Epic's data but later revealed they fabricated the incident to quickly gain visibility and scam victims through their trafficking scheme.
A retired Army lieutenant colonel, David Slater, was arrested and accused of disclosing sensitive national defense information. Slater was the victim of a romance scam and disclosed information about Ukraine including details of officials and command centers. Some of the information provided was classified as secret.
Answers for AWS is an independent survey of AWS users on various AWS services. This year there were 426 respondents to questions in categories such as IaC, serverless, AI, and CI/CD.
Change Healthcare reportedly made a $22 million payment to the BlackCat ransomware group. However, the FBI seized BlackCat's website and the group attempted an exit scam by withholding ransomware payment commissions and shutting down.
Many widely used internet-connected video doorbells have significant security flaws. These devices often expose sensitive information like home IP addresses and WiFi network names without encryption, leaving them vulnerable to cyber-attacks.
GitHub is struggling to contain an ongoing attack that is flooding the site with millions of malicious code repositories mimicking legitimate ones. The fake repositories contain hidden malware that steals passwords and cryptocurrency from developers. Removing the repositories is like playing whack-a-mole as some malicious forks are surviving and getting re-forked, compounding the problem.
A database belonging to YX International, which routes millions of SMS messages daily, was left exposed online without a password. The database contained sensitive one-time passcodes that grant access to accounts on Facebook, Google, and TikTok. The company secured the database after being contacted by a security researcher.
Taiwan's defense ministry has confirmed that hackers stole sensitive military and government documents from Chunghwa Telecom and sold them online. The breach, initially reported by TVBS, included 1.7TB of data that the hackers claim contains contracts and information from the armed forces, foreign ministry, and coast guard.
As AI advances, serious questions arise about its potential impacts on society. Could it destroy civilization, turn us into zombies, or view humans as we view dogs? While AI poses risks, thoughtful regulation and ethical development can help realize benefits and avoid pitfalls depicted in sci-fi like 2001: A Space Odyssey with HAL. This post dives into the current ways we are preparing against AI as a society.
Terraform can be configured to store state files in a remote backend. This post looks at how attackers can leverage compromised state files. It begins by demonstrating how an attacker could cause AWS resource deletion by confusing a Terraform user into applying a modified state file that results in resource deletion. It then goes on to demonstrate the process of writing and publishing a malicious Terraform provider that can execute code upon Terraform plan or apply and then demonstrates how this can be combined with state file modification to hijack CI/CD systems.
This post begins with an overview of what passkeys are and how they work. The post then discusses threat models around phishing, stolen credentials, and MFA as they relate to passkeys. It concludes with a warning not to implement WebAuthn manually before providing some implementation considerations for passkeys.
with Veracode [11]: ✅ <5% false positive rate
Sponsored
Web applications have critical vulnerabilities that only dynamic
My Privacy DNS' "Matrix" project is a handcrafted and completely self-managed DNS Firewall through Response Policy Zones.
reconFTW is a tool designed to perform automated recon on target domains by running the best set of tools for scanning and finding vulnerabilities
The Bluetooth Landscape Exploration & Enumeration Platform (BLEEP) can be used for enumerating Bluetooth devices. It can also be used to automate Bluetooth vulnerability discovery.
The Biden administration issued an executive order on February 28th identifying "countries of concern" that exploit Americans' personal data as a national emergency. The order aims to prevent these unspecified countries from accessing bulk sensitive data about Americans. It cites the vast commercial data market selling people's information as a crisis necessitating action.
With security improvements to endpoints, cyber threats have shifted to the perimeter. Many perimeter devices are not built to be secure by design and therefore are ripe targets for exploitation.
Attribute-based access control can be implemented in AWS via tags that store attributes on both Principals and Resources. This post looks at improvements to ABAC since 2020 as well as issues that remain.
A U.S. judge has ordered NSO Group to hand over its source code for Pegasus and other products to Meta as part of the social media giant's ongoing litigation against the Israeli spyware vendor.
Semgrep Code now supports static analysis for C and C++. Exclusive to the platform, static analysis parses source code before macro expansion, bypassing the complexities associated with C/C++ analysis.
The BlackCat/ALPHV ransomware gang has claimed responsibility for a cyberattack on Optum, a subsidiary of UnitedHealth Group. The attack caused an ongoing outage affecting the Change Healthcare platform, a large payment exchange platform used by more than 70,000 pharmacies across the United States. The gang claims to have stolen 6TB of data from Change Healthcare's network, including sensitive personal information.
Security flaws have been discovered in several internet-connected doorbell cameras, including ones made by EKEN. The most serious issue allows hackers to take full control of a camera by holding down a button and scanning a QR code. Retailers have been alerted, but only some have removed the vulnerable cameras from sale.