Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Pepco, a European discount retailer, lost €15 million in a phishing attack targeting its Hungarian business. Whether the funds are recoverable is uncertain. The company is financially stable and currently conducting a security review. No customer or employee data was compromised.
This post breaks down 10 security features that can be used to enhance your Okta security posture. Highlighted features include ThreatInsight, behavior profiling, admin and user session management, and password and MFA policies.
A tutorial from AWS on how to utilize the newly added `STRIPE_CREDENTIALS` managed data identifier in Amazon Macie to identify Stripe API keys in S3 Buckets. It walks through setting up the Macie job and includes sample data.
Cloudflare made the decision to abandon its usage of Nginx in favor of building its own proxy. This article goes through the issues Cloudflare faced with Nginx and the design decisions that went into Pingora's design. It concludes with an in-depth review of the performance gains that were achieved.
Scanme is a Go package for network scanning. It can scan single IP addresses for open ports.
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes interfaces for alerting, dashboards, hunting, PCAP, and case management.
Infisical is an open-source secrets management platform that features a dashboard, client SDKs for fetching secrets, an API, and integrations with several platforms, like Kubernetes and Terraform.
An invitation to a wine-tasting event was discovered to be part of a targeted spearphishing campaign that distributed a new stealthy backdoor called WINELOADER to European diplomats. The invitation included a malicious link to a fake questionnaire - targets were told that the questionnaire must be filled out in order to participate in the event. The link redirected to a compromised site that downloaded a file containing obfuscated JavaScript code to execute the attack.
Researchers discovered a malicious AI model on Hugging Face that could enable attackers to gain full control of users' machines. The model executes code after loading a pickle file, leaving victims unaware that their systems were compromised.
Ubiquiti EdgeRouters are being used by the Russian-backed APT28 group to collect information and proxy malicious traffic. The FBI revealed that it accessed routers belonging to businesses and homes to remove APT28’s malware and add firewall rules to prevent reinfection. The operation did not patch any vulnerabilities - owners are urged to check their equipment for signs of compromise.
Each year, PortSwigger accepts nominations for the top novel web hacking techniques of the year. Users then vote on finalists and panelists choose the winners. This list contains links and summaries for each chosen attack.
GitHub has enabled push protection by default for all public repositories to prevent accidental exposure of secrets such as access tokens and API keys when pushing new code.
Synopsys reported a 54% increase in high-risk vulnerabilities in commercial codebases compared to the year before.
Hugging Face's Safetensors service can be compromised to hijack user models, enabling supply chain attacks via malicious pull requests to other repos masquerading as the conversion bot. Hijacked conversion models allow changes to any repo on the platform.
Tornado Cash enables users to make transactions on the Ethereum network without leaving a trace. However, it was recently discovered that a developer snuck a snippet of malicious code into a governance proposal on January 1st that funneled deposit notes to an attacker-controlled server. The exploit only affects transactions made through an IPFS gateway.
Pharmaceutical giant Cencora, formerly AmerisourceBergen, experienced a cyberattack where data was stolen from its IT systems, potentially including personal information. The company contained the breach and is collaborating with authorities and cybersecurity experts to investigate further. No ransomware groups have claimed responsibility for the breach yet but Cencora has clarified that this isn't related to the Optum Change Healthcare ransomware incident.
This is the official release of version 2.0 of the NIST Cybersecurity Framework (CSF), the first major update since the framework's creation a decade ago. The CSF 2.0 is designed to help all organizations reduce risks, regardless of sector, size, or level of security sophistication.
Part 1 in a 3 part series on attacking Okta. The first part is a thorough introduction to Okta terminology and the Okta environment, covering primitives as well as a focus on authentication methods. It has a slight attacker perspective but could be useful for defenders looking to increase their Okta knowledge as well.
This post discusses a recent customer engagement that entailed responding to an AWS ransomware attack. The attacker deleted several S3 buckets and then left a ransom note (included in the post) and a recovery binary. The post goes through the CloudTrail actions taken by the attackers as well as an analysis of the recovery binary. It concludes by noting that the binary does not make any connections to AWS (or the internet in general) and would not be able to recover the data.
The Python Risk Identification Tool for generative AI (PyRIT) is an open-access automation framework that empowers security professionals and machine learning engineers to proactively find risks in their generative AI systems.
modpot is a modular web application honeypot framework written in Golang. It allows users to deploy simple HTML/JS honeypots that mimic web applications in order to detect requests and form entries that are related to attacks.
Security logging solutions vendor RunReveal introduced pql to offer an open-source alternative to proprietary languages used by major security vendors. The language is designed to easily integrate with existing products supporting SQL, allowing security teams to query logs efficiently. pql aims to become a standard query language for security professionals, providing an alternative to established platforms.
The LockBit ransomware group has relaunched its leak site just a week after a major coordinated takedown by global law enforcement on Feb. 19. The takedown operation seized infrastructure, code, stolen data, keys, and arrested affiliates. LockBit's backup systems remained untouched, enabling the operation to bounce back quickly.
Near was a data broker that specialized in location data. It claimed that it had the location data of 1.6B people across 44 countries. Sen. Ron Wyden requested that the FTC prevent the sale of this data when Near filed for bankruptcy, which they granted. This incident brought many to question who can acquire and license data from data brokers.
The US Commerce Department has blacklisted Sandvine Inc., a computer networking company, for supplying technology to the government of Egypt that enabled web monitoring and censorship, going against US national security and foreign policy interests. Sandvine's deep-packet inspection technology was used for internet surveillance and censorship in Egypt, leading to its ban from acquiring US technology components.
This report deep dives into the top industries and companies preferred by phishers. Amongst all industries, the social media sector accounted for the largest YoY increase in phishing URLs at 110%.
The Office of the National Cyber Director released a report calling on organizations to reduce the use of memory-unsafe languages like C and C++ in favor of memory-safe languages. The report specifically calls out Rust, Python, and Java as safer alternatives.
ThyssenKrupp's Automotive division in Saarland suffered a cyber attack, leading to the shutdown of IT systems.
U-Haul has reported a cyberattack where 67,000 customers in the United States and Canada had their personal data compromised, including names, dates of birth, and driver's license numbers. No financial information was taken. The attack targeted the U-Haul Dealer and Team Members system used for reservations and customer records.
A serious vulnerability (CVE-2024-23204) in Apple Shortcuts allows attackers to access sensitive data without user permission. Attackers exploiting the vulnerability can access and transmit sensitive data, posing a risk to user privacy and security. Apple has addressed the issue with updates to iOS and macOS. It is urging users to install the patches promptly to safeguard their information.
Prescription orders in the US are being delayed as pharmacies are experiencing a "nation-state" cyber attack. The attack is believed to coming from a foreign government. It is targeting major pharmacy chains, including Walgreens, Rite Aid, and CVS Health. The attack has disrupted the pharmacies' prescription-filling systems, causing delays across the country.
This list covers the top cybersecurity trends that Gartner sees coming in 2024. 2024 will be the year that gen AI-driven security products finally emerge. 2025 will see those tools delivering real risk-management outcomes.
AWS Nitro Enclaves are a Trusted Execution Environment that is offered for running sensitive workloads by AWS. It is somewhat lacking in documentation. This post offers a look at what Nitro Enclaves are and how images and attestation work. The post also includes a TL;DR checklist at the top.
Truffle Security performed a scraping project to generate a list of Amazon Account IDs that are used by Thinkst to generate AWS canaries. The Truffle Security team identified about a half dozen Account IDs which can be used to identify if an AWS Key ID is a canary token. The capability has been added to the open-source TruffleHog tool.
Sponsored
Last chance to join the webinar this Wednesday, February 28! SINGLE PANE OF GLASS (SPOG) has long been derided as vendor-speak. But is it actually useful in describing the way enterprises manage vulnerabilities in sprawling IT environments [11]? Join Scott Kuffer, Founder of Nucleus Security, and Peter Wolski, Head of Cyber and
and effective vulnerability management programs. Register here, free
A compiled checklist of 300+ tips for protecting digital security and privacy in 2024.
VAmPI is a vulnerable API made with Flask. It includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. VAmPI was created to evaluate the efficiency of tools used to detect security issues in APIs.
The Living Off the Pipeline project is an inventory of how development tools commonly run in CI/CD pipelines can be leveraged to achieve code execution by running on untrusted code changes or via workflow injection.
An M&M vending machine at a university was secretly using facial recognition-enabled collecting data without consent. The machines could estimate age/gender. The university has confirmed that it will disable the tech and that it plans to remove the machines, though the timeline is unclear.
Redis servers are under attack by new malware that deploys rootkits and cryptominers. The attackers are disabling Redis protections and loopback policies to open doors for the Migo malware payload and fetching XMRig miners from GitHub.
The FTC has ordered Avast to pay $16.5 million and banned it from selling users’ web browsing data or licensing it for advertising purposes. Avast collected a staggering amount of personal data amounting to more than 8 petabytes between the years of 2014 to 2020 while marketing its products as protecting users from browser tracking.
An AI threat security diagram and guide from OWASP around AI security threats.
Reddit and Google have reached a deal to allow Google to scrape Reddit posts to train AI models. Google will also provide Reddit with tools to improve its internal search.
Crooks stole almost $10 million from Jeff "Jihoz" Zirlin, co-founder of the video game Axie Infinity, and the Ronin Network.
American Vision Partners faces a class action lawsuit over a data breach that impacted 2.35 million patients. The unauthorized access resulted in patients' personal info, medical data, SSNs, and insurance details being stolen. A law firm specializing in data breach-related class action lawsuits is urging affected patients to get in touch as it may file a lawsuit against AMV’s parent company.
Approximately 100 organizations have had their SSH credentials stolen using a recently released open source pentesting tool with worm-like capabilities. The tool is completely self-replicating and self-propagating — and completely fileless. In many ways, SSH-Snake is actually a worm: it replicates itself and spreads itself from one system to another as far as it can.