Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Australian telco Tangerine suffered a data breach that resulted in 230,000 customers' personal information being exposed. The exposed information included full names, dates of birth, mobile numbers, postal addresses, email addresses, and Tangerine account numbers. Tangerine's CEO stated that the breach was caused by leaked credentials to a legacy customer database belonging to a contractor.
A team of researchers has released a set of attacks called VoltSchemer that take advantage of hardware security flaws in wireless charging standards. Attackers can use finely tuned voltage fluctuations within wireless chargers to create interferences in the regular data exchange between the charger and smartphone. The researchers demonstrated that these interferences can be used to overheat a phone, bypass Qi safety standards, and even inject voice commands.
Hackbots are automated systems that use AI in a meaningful way to find vulnerabilities. This post covers a PoC of several hackbots, including some that are commercially sold. Hackbots could become integral tools in testing software for vulnerabilities before release or as part of an internal bug bounty program.
The team at Neodyme has found a method to reveal hidden GitHub commits. The GitHub PushEvent API can be used to retrieve the hashes of commits that have been hidden using a force push. The commit can then be retrieved via the discovered hash. Neodyme has released a tool for discovering secrets via this method.
Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data. It is useful for both offensive and defensive security testing.
Infisical is an open-source secret management platform that can be used by teams to centralize their secrets, like API keys, database credentials, and configurations.
Awesome Pentest Cheat Sheets is a collection of cheat sheets for use in pentesting. The cheat sheets are divided by phase, platform, purpose, tools, and other categories.
A new version of the Lucifer botnet is currently targeting Apache Hadoop and Apache Druid deployments. Researchers from Aqua Nautilus, who have been monitoring the campaign, have counted more than 3,000 unique attacks targeting its Apache Hadoop, Apache Druid, and Apache Flink honeypots in just the last month alone.
The high-risk ConnectWise flaw is an authentication bypass vulnerability that allows attackers to remotely steal confidential data from vulnerable servers or deploy malicious code such as malware. ConnectWise's SaaS customers were patched within 48 hours, but 8,800 ConnectWise servers remain vulnerable to exploitation.
A suspected North Korea-linked malware sample, believed to be KONNI, was discovered targeting the Russian Ministry of Foreign Affairs. It was found bundled into a backdoored version of Statistika KZU, a Russian language software installer intended for internal use within the Russian Ministry of Foreign Affairs for relaying annual report files from consular posts.
Apple is integrating a new post-quantum cryptographic protocol called PQ3 into iMessage to protect against future attacks from quantum computers.
Rob Joyce, the director of the NSA, has announced plans to step down at the end of March. Joyce has led the NSA since 2021 and served in the NSA for a total of 34 years.
The U.S. Federal Trade Commission (FTC) imposed a $16.5 million fine on Avast for selling users' browsing data to advertisers despite claiming its products would prevent online tracking.
Sponsored
The 7th annual Cloud-Native Security and Usage Report [6] identifies how customers globally are developing, using, and securing cloud-native applications and environments. The report is based on data from thousands of global accounts and millions of containers [5] scanned by Sysdig’s CNAPP [7]. Among other findings, the data reveals:
ENEA, a Sweden-based telecom security firm, claims that it has reproduced a previously unknown hack disclosed by the NSO Group that uses an "MMS Fingerprint" attack. This term is new to the industry and was not present anywhere online except in the court case. The attack reveals the target device and OS version through an MMS sent to the device without user interaction, engagement, or message opening.
Enforcers from the US and UK disrupted a ransomware group they say has targeted more than 2,000 victims and taken over $120 million in ransom payments. The NCA and FBI have come up with decryption strategies that they believe could help hundreds of victims globally regain access to systems that were attacked by LockBit.
Over 28,000 internet-facing Microsoft Exchange servers are vulnerable to a recent zero-day that enables pass-the-hash attacks. 68,000 additional servers are possibly vulnerable, totaling up to 97,000 possibly exploitable instances. The 9.8 CVSS privilege escalation flaw stems from Exchange 2019 lacking default NTLM relay protections.
This blog presents a succinct overview of the top 3 cybersecurity threats facing individuals and organizations alike, empowering readers to bolster their defenses and safeguard against potential attacks.
A helpful breakdown of the various AWS cryptography services. The services are divided into client-side services, which run in a client’s application, and cryptography services that AWS manages, such as KMS. The post includes a summary of each option that breaks down when you might or might not use it.
This post breaks down the different types of remediation platforms. The space is divided into remediation platforms, data platforms, and workflow builders. An emerging category of Code Fixer platforms proposes fixes for vulnerabilities.
Sponsored
How about a SIEM that saves you $$$, offers real-time log & threat detection, while also monitoring your entire infrastructure (AD, inventory, performance, network monitoring and more)? Make the switch to EventSentry [15]. Compliance & validation scripts enhance your security baseline and help you be proactive. Start your 30-day
Reconic is a network scanning and discovery tool designed to empower cybersecurity professionals and bug hunters in mapping, analyzing, and securing digital infrastructures.
Magika is a novel AI-powered file type detection tool that relies on recent advancements in deep learning to provide accurate file type detection. Under the hood, Magika employs a custom, highly optimized Keras model that only weighs about 1MB that enables precise file identification within milliseconds, even when running on a single CPU.
Living Off the False Positive (LoFP) is a new autogenerated collection sourced from popular rule sets. The data is categorized along with ATT&CK techniques, rule source, and data source. This repository can be used by red teams to blend in with false positives or blue teams to assess weak spots across their detections.
The Bricks WordPress theme has a critical RCE flaw (CVE-2024-25600, 9.8 CVSS) that is actively being exploited. It impacts Bricks v1.9.6 and below, allowing PHP code execution by unauthenticated attackers.
Google has announced a new initiative aimed at fostering the use of artificial intelligence in cybersecurity. Google believes that AI is pivotal for digital security as it has the potential to provide defenders with a definitive advantage over attackers and upend the Defender’s Dilemma.
Signal has released the ability for users to sign up with usernames as a method of hiding their phone numbers. It has also hidden phone numbers by default, allowing users to connect without sharing phone numbers, and added controls to control phone number privacy.
Developed by the OWASP Top 10 for LLM Applications team, this checklist is a valuable resource for leaders in technology, cybersecurity, privacy, compliance, and legal to strategize and secure their AI initiatives effectively.
Users on Mastodon reported experiencing a massive spam attack in which newly registered accounts were used to spam users in Japanese.
A collection of SOC Interview Questions maintained by LetsDefend for job seekers to practice.
Sponsored
Security compliance can be complicated. This free SOC 2 compliance kit simplifies the process with key assets you'll need to get your report.
ExpressVPN disabled split tunneling on Windows clients to fix a bug introduced in May 2022 which caused DNS requests to bypass its servers. This bug exposed domain visits to ISPs when using split tunneling with app-specific VPN routing. Though traffic stayed encrypted, the DNS leak defeated privacy protections.
U.S. Internet’s 'Securence' email-providing division had a publicly exposed webpage that listed every email of its 6,500 clients. The CEO of the company stated that the exposure was caused by a mistake in an Ansible playbook controlling the nginx config. U.S. Internet has not commented on how long this misconfiguration was in place or why appropriate controls were not in place to detect or prevent the misconfiguration.
Proofpoint researchers have identified an ongoing malicious campaign targeting Microsoft Azure environments that has compromised hundreds of user accounts, including accounts from senior executives, through credential phishing and account takeover techniques. The attackers' operational infrastructure includes proxies and data hosting services. The threat is not currently attributed to any known threat actor.
LLMs can autonomously hack websites when paired with tools enabling system interaction. Despite safety efforts, LLMs weaponized without human guidance can compromise vulnerable websites through automated browsing and planning. Weaponized LLMs can break into buggy web apps without knowledge of vulnerabilities, showing that they can hack without oversight.
CharmingCypress is an Iranian-backed threat actor that engages in spear-phishing campaigns to gather information on political opponents. It engages in unique campaigns that involve long email exchanges before sending malicious links, and in some cases, even creating a malicious VPN and fake webinar application. IOCs are included in the article.
This post provides an in-depth analysis of the ISFB first loader malware variant. It details the process of analyzing the malware, from using tools like "pestudio" to identifying potential packing to examining memory allocations and process injections. The post offers insights into the complexity and evasion techniques utilized by the ISFB variant through a detailed exploration of the malware's code and behavior.
Gapcast accurately detects router clients to analyze, capture, and inject packets.
Discover with ProSecFuzz hidden files and directories on a web server.
The HTTP Garden is a set of HTTP servers and proxies configured to be composable. It has scripts for interacting with them in a way that makes finding vulnerabilities easier.
Vyacheslav Penchukov, a leader of the Zeus/IcedID malware groups, has pleaded guilty to cybercrime charges. He was first arrested in 2022 after his involvement in a major theft using Zeus and now faces 40 years in prison. His prosecution is a win against infamous malware operations.
Wyze suffered another security lapse that allowed some users to briefly view feeds from strangers' cameras in their app's Events tab. At least 12 such cases were reported. The flaw follows a previous incident that enabled unauthorized live access to Wyze devices.
A (very) deep dive into one Infrastructure Engineer’s decision-making process at a startup. The post is divided by topic and includes an endorse or reject verdict for each decision with accompanying reasoning. The topics include choice of cloud platform, security products to adopt, and SaaS applications.
Some highlights of the report include the finding that 54% of major code changes get a full security review and that 34% of organizations review over 75% of code changes.
A letter from the EFF to the UN outlining issues with the draft UN Cybercrime Treaty that could lead to prosecution of good faith security researchers.