Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The US government disrupted a botnet used by Russia's GRU military intelligence unit for phishing, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets.
The Department of Defense notified 20,600 individuals that their information was breached after an unsecured cloud email server was discovered to be spilling sensitive emails to the open internet. This happened between February 3 and February 20, 2023, and the notification was sent out on February 1, 2024.
A ransomware attack encrypted the database of the Hipocrate healthcare management system used by over 100 Romanian hospitals. 25 facilities have been confirmed impacted while another 75 are offline as a precaution. The massive incident took HIS servers down, encrypting files and databases.
An AI Acceptable Use Policy (AUP) establishes guidelines on the proper deployment of generative AI to mitigate risks. This post navigates how to create one with real examples. Developing an AI AUP forces risk leaders to define controls and frameworks to oversee emerging generative AI given its potential negative impacts if utilized without oversight.
Mercari discusses the considerations that went into the design of its passkey implementation. The company chose to adopt passkeys to try to create a phishing-resistant environment. Complications encountered included issues preventing attackers from registering passkeys, problems syncing passkeys, and UX difficulties around using passkeys.
Sponsored
DNS is an often-overlooked aspect of network security, despite being the 1st step of almost every malicious attack. Control D [12] makes DNS an easy problem. Block unwanted content, spoof your location, and browse faster. The best part? It’s all done from a modern UX and architecture [12]. No apps to install 🎉
KTrust aims to secure Kubernetes workloads with a continuous threat exposure management platform that provides risk prioritization, breach and attack simulation, and ransomware protection capabilities.
MSAK is a tool written in Python to help discover and test exposed standard and custom services of ModBus Servers/Slaves over Serial or TCP/IP connections.
Awesome GraphQL Security is a curated list of GraphQL Security frameworks, software, libraries, and resources. The list is divided into offensive, neutral, and defensive tools.
Microsoft’s threat intelligence team has captured evidence of foreign government-backed hacking teams interacting with OpenAI’s ChatGPT to automate malicious vulnerability research, target reconnaissance, and create malware.
Maxim Dounin, a core developer of Nginx, has left the project and created his own fork called freenginx after a dispute over the assignment of CVEs.
The US Department of Justice announced that a court-authorized operation has dismantled a botnet of hundreds of Ubiquiti Edge OS routers controlled by Russian cyber spies. The group, known as APT28 or Fancy Bear, was using the hijacked routers as a global espionage platform.
lolcerts is a repository of code signing certificates known to have been leaked or stolen and then abused by threat actors.
A new wifi auth vulnerability has been discovered. It allows an adversary to skip messages 2 and 3 of the 4-way handshake, enabling them to complete the authentication process without knowing the network’s password.
Sponsored
Hyperproof’s fifth annual benchmark survey is here [5]! Over 1,000 GRC professionals [5] from the US and the UK were asked about their pain points, budgets, staffing, and risk management practices.
Payments outfits Viamedis and Almerys both experienced breaches of their systems in late January leading to the theft of data belonging to more than 33 million customers. Affected data on customers and their families includes dates of birth, marital status, social security numbers, and insurance information.
Bank of America is sending notification letters to 57,000 customers to inform them that their personal information was stolen in a data breach at third-party services provider Infosys McCamish System. Losses related to the incident were estimated at $30 million.
A state in India required travelers to obtain a COVID-19 e-pass mandatory. Researchers recently discovered that this data was stored in an open S3 bucket. The leaked data includes names, passport numbers, gender information, mobile numbers, email addresses, travel details, and vehicle numbers.
This post is part of a series that dives into RedLine stealer. RedLine Stealer is a malware available on underground forums for sale as a standalone at $100/$150, depending on the version, or on a subscription basis at $100/month. This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information.
This blog post explores how attackers can hijack AWS Lex Chabots with a “sleeper phrase” that returns the Lambda function’s role credentials. The post goes through the process of debugging to find the relevant intent file to update and the correct formatting to have Lex return the message properly.
aws:ResourceAccount, as well as various other global conditions, can be used with the StringLike operand to enumerate account IDs, tags, and other metadata across most AWS APIs. The post includes a tool to automate the process.
Sponsored
Download this checklist by SecureFrame [12] for step-by-step guidance on how you can effectively implement AI while addressing concerns related to transparency, privacy, and security. This resource includes:
Seal is a supply chain security tool that differentiates itself by providing patches to vulnerable packages instead of pushing for updates to the packages.
Domain Protect helps to prevent subdomain takeover. It uses serverless functions in AWS or GCP to continually scan an organization’s DNS records. When vulnerable subdomains are found, Domain Protect sends alerts via Slack or email and optionally creates cloud resources to take over subdomains.
Kubeconform is a Kubernetes manifest validation tool. It can be run locally or integrated into a CI/CD pipeline. Kubeconform borrows heavily from Kubeval, but it has better performance and support for custom resources.
CISA and the OpenSSF Securing Software Repositories Working Group have published a new framework for securing package repositories. Principles for Package Repository Security is a framework aimed at establishing a set of foundational rules for package managers and further harden open-source software ecosystems.
Commando Cat is a novel infostealer malware campaign that targets unsecured Docker API endpoints. The attack begins by launching the malicious Docker container and then escaping to the host. The malware then installs several backdoors and a credential stealer. It removes any other crypto miners and black holes in the Docker registry to prevent competition. This post includes IoCs and Yara rules.
Avast has made the Rhysida decryptor publicly available. It has been available to victims of the Rhysida ransomware since August 2023. This document provides instructions on how to use the decryptor, including parameters that affect the encryption and decryption process, and explains the option to back up encrypted files before decryption.
The U.S. Department of State has announced monetary rewards of up to $10 million for information about individuals holding key positions within the Hive ransomware operation.
A PhD student at MIT posted a photo on X alleging to have discovered a kernel exploit in the Apple Vision Pro on launch day.
A serial burglar in Edina, Minnesota is suspected of using a Wi-Fi jammer to disable connected security cameras before committing burglaries.
A fake clone of LastPass called LassPass was listed on the Apple App Store. Malicious clones like this rarely make it through Apple’s review process. Apple has confirmed that it has since been removed.
Netcraft has spotted a new phishing campaign that uses compromised SendGrid accounts to phish for new accounts by emailing users that their account had a payment error or other similar issues. The email is sent from a SendGrid account and uses SendGrid’s tracking links to mask the destination. Users are directed to a JsPen link that obfuscates a script tag which loads a JS file from Azure Front Door that is an obfuscated clone of the SendGrid login page.
The support website for Juniper Networks, a networking equipment vendor, was exposing sensitive customer information including device details, warranty status, service contracts, and serial numbers. The data exposure was the result of a recent upgrade to the support portal. Juniper has since fixed the problem and stated that no identifiable or personal customer data was exposed.
This article focuses on overlooked authentication and authorization mechanisms in mobile app front ends.
A blog post from Cycode detailing a supply chain vulnerability that it discovered in Bazel. The post begins with an overview of GitHub Custom Actions and then details how Cycode leveraged a custom action in Bazel to achieve remote code execution. The Bazel project included a custom action that passed the user-controlled issue body directly to a bash shell in the GitHub runner which was vulnerable to command injection.
A post from Checkmarx on a technique that it discovered to intercept messages from malicious Telegram bots that attackers utilize for info-stealing operations. Checkmarx's team extracted the bot details from a malicious package. They then utilized the /getUpdates endpoint to retrieve details of a specific message or all messages by looping through message IDs. The post also details two methods for redirecting messages when an attacker utilizes a webhook.
This app is a tool for analyzing Bluetooth (BLE) environments. It scans for BLE devices in the background, notifying you if the device you are looking for is near you or if some unknown device has been following you for a long time.
StunCheck is a set of tools for scanning, testing, and exploiting STUN and TURN servers.
Jira-Lens is a fast and customizable Python-based vulnerability scanner for Jira. Jira-Lens performs 25+ checks for vulnerabilities against target Jira servers.
RustDoor is a new backdoor that has been targeting Apple macOS since November 2023, masquerading as a Visual Studio update. It has Intel and Arm versions and unknown initial access. RustDoor is being actively developed. It can gather/upload files and system info to its C2 server.