Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Raspberry Robin operators are utilizing fresh 1-day exploits for privilege escalation, suggesting the team has access to exploit sellers or in-house development. The rapidly evolving QNAP malware acts as an initial access vector for payloads like ransomware.
BGPWatch is a comprehensive platform built by APNIC for detecting and diagnosing hijacking incidents in BGP routing. It allows users to browse, view, and search for hijack events in real time, providing detailed information about each event. BGPWatch offers routing path analysis and subscription services for operators to monitor via email.
$89 billion was invested across approximately 6,400 deals in Q4 2023, the lowest figure in the past five years.
Google has agreed to pay $350 million to settle a shareholder lawsuit related to a 2018 Google+ bug exposing private data associated with as many as 500,000 accounts.
The National Cyber Security Centre has provided an overview of the threats involved in scanning QR codes and prescriptive guidance for evaluating QR code safety.
Livall fixed a flaw allowing real-time location tracking of its connected helmets. The skiing and biking helmets featured group chats and location sharing via apps. Accessing a group only required an easy-to-guess numeric ID. Anyone was able to listen in and track locations.
A CISA reveals that the Chinese threat actor Volt Typhoon has maintained footholds in critical infrastructure for at least five years. The report doesn’t mention any specific companies but mentions the rail, aviation, mass transit, highway, maritime, pipeline, water, and sewage industries.
The maintainers of Shim have released a new version to fix 6 security vulnerabilities, including one critical flaw that could allow for remote code execution. Shim is used as a first-stage bootloader in many Linux distros for UEFI systems. The vulnerability stems from Shim’s HTTP boot support trusting attacker-controlled values when parsing an HTTP response.
This article covers how to identify file IoCs and create YARA rules to detect malicious activity using tools like yarGen and Arya for generation and testing. Developing YARA skills is critical for security roles to detect and mitigate threats. YARA allows creating customized rules matching an organization's needs to classify malware based on signatures.
This post presents an attack chain that could allow an AWS Administrator to override a KMS key policy that was restricted to only a specific identity. In this attack scenario, one admin can lock down a KMS key to their specific use, but another admin can bypass these restrictions by deleting the first admin’s IAM user, changing the contact on the AWS account, and then opening a ticket with AWS support to recover the key. As no identity will be able to access the key, AWS support will then contact the new phone number to verify the request and facilitate the reset. The post ends with some potential mitigations.
Meterpreter and its helper PEs are easily detected by antivirus programs due to their age and widespread use. This can be overcome by leveraging WebAssembly, a low-level assembly-like language that can be run in web browsers and written in multiple backend languages. This article provides code examples in Rust and explains how to compile Rust to Wasm.
Ansible role to apply a security baseline. Systemd edition.
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon processes via Engines, recon data correlation, and organization. It supports continuous monitoring and is backed by a database. reNgine has a simple yet intuitive User Interface.
electroniz3r is a tool that can take over macOS Electron apps’ TCC permissions and inject code into them.
Apple was likely defrauded of a total of $2.6M in gift cards/hardware by hackers Noah Roskin-Frazee and Keith Latteri via an Apple contractor. Though unnamed in the case, the victim matches Apple's description and location. The duo allegedly stole and resold items, cashing in on the theft from Apple and its customer support contractor.
The FCC has officially banned robocalls using AI-generated voices, deeming them "artificial" and illegal under existing laws like the Telephone Consumer Protection Act. While fake AI celebrity calls will likely still plague phones, this makes it clear that such scams violate robocall prohibitions.
A new report by biometric firm iProov shows that deepfake "face swap" attacks have increased by 704% from the first to the second half of 2023. Fraudsters are using off-the-shelf tools to create manipulated images and videos, making it easier to create convincing deepfakes. These deepfakes can trick remote identity verification systems into believing that the subject's "liveness" is real.
The vulnerability (CVSS 9.8 out of 10) affects all TeamCity On-Premises versions from 2017.1 through 2023.11.2 and allows for unauthenticated attacks.
HackTricks stole content from others and may have included stolen content in its course. This thread contains screenshots with examples of the stolen content.
Fortinet's FortiSIEM has two new critical RCE vulnerabilities (CVE-2024-23108 and CVE-2024-23109) that allow remote code execution by unauthenticated attackers. Though details are limited, they seem similar to an older OS command injection issue in FortiSIEM fixed in October 2022. The flaws enable the execution of unauthorized commands via crafted API requests. Update ASAP.
Verizon filed a data breach notification after a company employee obtained a file of 63,206 employees’ personal data. The data includes social security numbers, gender, union affiliation, date of birth, and compensation information. Verizon stated that it has no evidence that the data was used maliciously or shared outside of Verizon.
An employee at a multinational financial firm fell for a social engineer attack that led them to remit $200 million Hong Kong dollars. The employee was suspicious when they originally received the communication from the UK-based CFO but was convinced after a call with the CFO and several colleagues, who all turned out to be deepfakes.
This post evaluates the risks of a leaked Stripe API key. It proposes 5 attack paths: disclosing PII, generating promo codes, changing prices, defacing websites, and making unauthorized wire transfers. The post ends with some best practices for protecting Stripe API keys.
This blog post talks about utilizing the control and security stack mappings created by the Center for Threat-Informed Defense (Center). These mappings, like NIST 800-53 Control Mappings and Security Stack Mappings for Google Cloud Platform and Amazon Web Services, enable defenders to connect threat information to actionable guidance, making it easier to detect and mitigate threats. Center is also working on expanding its collection of mappings and making them more accessible.
This framework generates fuzz targets for real-world C/C++ projects with various Large Language Models and benchmarks them via the OSS-Fuzz platform.
Secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters and security researchers.
ThievingFox is a collection of post-exploitation tools for harvesting credentials from various password managers and Windows utilities. Each module utilizes a different method of injection into a process to harvest credentials.
ResumeLooters have used SQL injection and XSS since early 2023 to hit Asia-Pacific recruitment/retail sites, stealing 500K+ user records from 65 sites. The group focuses on India, Taiwan, Thailand, and Vietnam, leveraging penetration testing tools like sqlmap. It injects XSS scripts into job sites to display phishing forms and steal admin creds.
Google announced a grant of $1 million to the Rust Foundation to improve interoperability between legacy C++ codebases and Rust. Google said that Rust has proactively prevented hundreds of vulnerabilities from affecting the Android operating system. Google will also begin to publish audits of some of the crates used in open source Google projects.
This analysis of the vulnerabilities from CISA's Known Exploited Vulnerabilities (KEVs) attempts to analyze whether the current efforts in the information security industry match the current threat vectors being abused. The analysis provides recommendations for vendors, developers, defenders, and researchers to address these vulnerabilities.
Dozens of countries including France, the UK, and the US, along with tech giants such as Google, Meta, and Microsoft, have signed a joint agreement to combat the use of commercial spyware in ways that violate human rights.
This report dives into how commercial surveillance vendors are enabling the proliferation of dangerous hacking tools.
Caesars canceled DEFCON 32’s contract, so DEFCON will be moving to the Las Vegas Convention Center.
Sponsored
As enterprises race to adopt AI, CISOs and other cybersecurity leaders have a critical role to play. AI implementations have to be compliant and secure for business to reap the full productivity gains they expect to see. Download this checklist by SecureFrame [5] for step-by-step guidance on how you can effectively implement AI while addressing concerns related to transparency, privacy, and security.
Cloudflare has provided an update on a breach from October 2023 when a threat actor accessed its internal systems using stolen Okta credentials. Not rotating the compromised tokens post-Okta breach enabled access to Cloudflare’s Atlassian suite. No Cloudflare customer data or systems were impacted by this event.
Clorox disclosed that a 2023 cyber attack has already cost it $49M. The company estimates that the attack will cost another $50-60M in FY24. There are still no details about the attack but it is suspected that it was a ransomware attack.
AnyDesk reported that it suffered a cyberattack in which threat actors breached production systems. The attackers stole source code and code signing keys. AnyDesk has released a new version with new code signing keys and has reset the web portal passwords of all users.
This post enumerates methods for escalating privileges on EC2 instances to root/System by modifying the instance’s user data. An attacker can create a new user data script if an instance has the ec2:ModifyInstanceAttribute permissions, replace the old user data with it, and restart the instance. The post covers a method that can be used if the EC2 instance pulls user data scripts or artifacts from S3 and has permissions to modify those buckets.
This post provides a deep dive into an incident that Invictus responded to. The threat actor was unique in that it utilized a new method of persistence in which it set up a cross-account role. The post divides the threat actor's activities into three primary phases of attack and delves into the motives and impact of each one.
This article covers the sequence of events that led to the Microsoft breach disclosed on January 25, 2024. The article contains diagrams that describe the flow of events as well as information about the breached systems. It also provides detailed instructions for identifying and investigating these applications using the Azure portal.
Chalk captures metadata at build time. It can add a small 'chalk mark' (metadata) to any artifacts so they can be identified in production. Chalk can also extract chalk marks and collect additional metadata about the operating environment when it does this. It can be used to create software security supply chain compliance reports automatically.
Prompt Security safeguards every interaction with GenAI in its organization, such as internal AI tools and commercial products with AI features, by checking each prompt and model response to protect against exposure of sensitive data, block harmful content, and prevent other GenAI-specific attacks.
Objection is a runtime mobile exploration toolkit powered by Frida that helps assess the security posture of mobile applications without a jailbroken device. It can be used to interact with the container file system, for SSL unpinning, and for memory dumping and patching.
The HeadCrab malware that targets Redis databases has been updated with new evasion techniques like fileless loading nearly a year after it was first disclosed. The crypto-mining campaign now has over 2,300 infected servers, which shows the threat actor is adapting to stay under the radar. HeadCrab 2.0 uses advanced techniques for stealth and persistence, demonstrating the attacker's sophistication as it aims to secretly mine cryptocurrency.