Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Access Now, in collaboration with Citizen Lab and other organizations, conducted a forensic analysis of iPhones belonging to members of Jordan-based civil society. It confirmed that nine individuals were targeted and/or infected with Pegasus spyware, including journalists, lawyers, and members of civil society.
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to disconnect Ivanti Connect Secure or Ivanti Policy Secure devices from their networks due to reports of Chinese hackers targeting these devices for espionage operations. It has issued instructions for updating and bringing the devices back online.
Joseph Garrison was sentenced to 18 months for a credential-stuffing attack on DraftKings. He stole $600K total from around 1,600 accounts by adding new payment methods.
VentureBeat has published an analysis and spreadsheet of the best companies hiring for cybersecurity in 2024 based on LinkedIn postings and GlassDoor rankings. Kaspersky Lab, ServiceNow, and Cisco Systems lead the rankings.
Mastodon, a decentralized social network, has fixed a vulnerability that could be exploited by threat actors to impersonate and take over any account.
With ThreatSpike Red, you can pentest your applications, identify your vulnerabilities and carry out full-scale red team exercises all year round [5]. All led by an expert team of certified testers.
Sponsored
The penetration testing market has lacked innovation for too long. ThreatSpike Red is here to disrupt it by offering unlimited offensive
Snyk found four "Leaky Vessels" vulnerabilities in core container components that allow container escape to access host OSes. This could let attackers steal sensitive data and further attacks. Users should urgently check for security updates from container vendors and upgrade engines/tools once fixes are available.
Schneider Electric suffered a data breach after a Cactus ransomware attack hit its Sustainability Business division. The hackers claim to have stolen terabytes of data. The attack impacted the Resource Advisor cloud platform, causing outages.
A new glibc vulnerability that could lead to local privilege escalation in Debian, Ubuntu, and Fedora systems has been discovered. The vulnerability is a heap-based buffer overflow in glibc’s __vsyslog__internal() function, which is used by syslog and vsyslog. Researchers also uncovered three other vulnerabilities in this function and another one in glibc’s qsort() function.
A threat actor known as WS has uploaded 9 malicious Python packages to the PyPI index. The packages contain base64 encoded PE files that drop and execute the WhiteSnake malware onto an infected device. The WhiteSnake malware is an InfoStealer that contains Anti-VM mechanisms. It utilizes Tor to communicate with a C2 server.
This post from Trail of Bits contains 30 new freely available Semgrep rules that it created for Ansible, Java, Kotlin, shell scripts, and Docker Compose. It also contains a detailed discussion of the pros and cons of Generic mode as a means of searching without syntax awareness, as well as an overview of the advantages of using YAML mode for scanning YAML files.
This article is the second part of a series analyzing a C2 agent. In this part, the author focuses on the static analysis of the binary to understand its workings, determine if it corresponds to a C2 agent, and identify indicators of compromise. They use tools like PEStudio and dnSpy to analyze the binary and determine that it is a C2 agent binary.
PeCoReT is a Pentest Collaboration and Reporting Tool designed to be a fully open-source collaboration platform tailored for pentest projects.
Aim Security is a GenAI security platform designed to protect generative AI apps from prompting attacks and prevent malicious/non-compliant outputs with a focus on safeguarding privacy and stopping data leaks.
Mobile Security Framework (MobSF) is an automated mobile application security testing platform for Android, iOS, and Windows Mobile devices. The framework includes static analyzers as well as dynamic analyzers. MobSF also includes REST APIs and CLI tools to integrate into CI/CD pipelines.
Ripple co-founder Chris Larsen disclosed hackers stole around $112M in XRP crypto from his personal wallets on Tuesday. He caught the unauthorized access quickly, freezing affected accounts and notifying exchanges and law enforcement.
A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server.
The U.S. government has disrupted a botnet that was used by state-sponsored hackers from the People's Republic of China (PRC) to conceal hacking activities targeting critical infrastructure organizations in the United States and other countries. The operation removed the malware from the routers and severed their connection to the botnet.
Johnson Controls International (JCI) spent $27 million remediating a September 2023 ransomware attack on its systems.
Europcar has announced that a data breach that alleges to have leaked its customer data is fake. Troy Hunt concurs with this and says that the sample data doesn’t make sense.
A Chicago man and his co-conspirators have been charged with running the nation’s largest SIM swap scheme yet. They stole over $400M in cryptocurrency by targeting over 50 victims in more than a dozen states.
The Akamai Security Intelligence Response Team (SIRT) has discovered vulnerabilities in multiple Hitron DVR device models that are actively being exploited. The vulnerabilities allow an authenticated attacker to achieve OS command injection using default credentials. Hitron Systems has released new firmware versions to address the vulnerabilities and advises users to upgrade to firmware version ≥ 4.03.
Ars Technica and Vimeo were used to covertly serve malware via a novel attack hiding in image/video links. Payloads were disguised as Base64-encoded random strings. The first-stage infected devices and then fetched the strings, decoding them to install second-stage malware.
AI is transforming cybersecurity with machine learning to adapt to evolving threats. This post dives into how AI has been evolving over the last two decades, from spam filters to predictive analytics. This rise has democratized AI, empowering more sophisticated attacks. While AI is indispensable for modern cyber protection, its dual-use nature poses risks.
The Mandiant FLARE team has released a new version of FLOSS that contains specialized algorithms for extracting strings from Go and Rust binaries. These languages use structs to determine string length as opposed to null-terminated strings which leads to strings.exe struggling to extract strings. This post includes details of how strings are stored in the languages and how FLOSS detects them.
A post from Red Canary that looks at Kubernetes security through the 4C security model with a particular focus on Container and Cluster threat models. The Container section focuses on issues such as malicious containers and on-the-fly containers. The Cluster section focuses on common misconfigurations and contains remediation advice.
Sponsored
Single Pane of Glass (SPOG) has long been derided as vendor-speak. But is it actually useful in describing the way enterprises manage vulnerabilities in sprawling IT environments [11]? In this upcoming webinar, Scott Kuffer, Co-Founder and COO of Nucleus Security [11] and a special expert guest, will discuss what a SPOG actually is, and offer actionable tips for elevating your vulnerability management
Agentless vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, and Network devices.
Tomcter is a Python tool developed to brute force Apache Tomcat manager logins with default credentials. Tomcter also works with proxychains.
APIDetector is a multithreaded tool for testing exposed Swagger endpoints in various subdomains. It is customizable and can test http or https endpoints. APIDetector features false-positive detection capabilities.
A blog post from TryHackMe that suggests ways to gain experience in cybersecurity. The suggestions include work placements, volunteering, CTF events, networking, home labs, bug bounties, and open source projects.
The saga continues between OpenAI and the Italian Data Protection Authority (DPA). The DPA concluded that available evidence pointed to the existence of breaches of the provisions contained in the EU GDPR.
This article discusses the release of two new versions of the Cloned Website Canarytoken, which alerts users when an attacker is using an Adversary-in-the-Middle attack against their sites.
This report highlights how ransomware is becoming more dangerous year over year.
GitLab has released an update fixing a critical security vulnerability. Update ASAP.
South Korea’s National Intelligence Service has warned that North Korean hackers have begun utilizing generative AI, leading to fears that these tools will be utilized to influence elections and spread misinformation.
Sponsored
Using aggregated usage data, Snowflake has identified security technology leaders [5] who are delivering next-generation applications and data sharing capabilities to enterprise security teams. Get the report to learn:
Anthropic disclosed a data breach after a contractor accidentally sent customer info to a third party. The breach impacted names and account balances. It was caused by human error, not a system breach per Anthropic. The news came right before the FTC announced its investigation into Anthropic's partnerships with Amazon and Google. Anthropic says the incidents are unrelated.
Akira ransomware group claims it breached Lush and secured 110GB of data. It is threatening to publish the data since negotiations have apparently failed. Passport scans were likely accessed, as well as financial, accounting, tax, project, and client docs. This incident demonstrates that Akira is a dangerous and flexible new threat that is able to hit major corporations.
Security researchers have discovered a new Golang-based malware loader called CherryLoader that mimics the icon and name of the CherryTree note-taking app to deceive users into installing it. Once installed, it drops either the JuicyPotatoNG or PrintSpoofer exploit and then runs a batch script to establish persistence. This article contains indicators of compromise.
This post dives into how the author went from wanting to work in infosec to deciding to pause and rethink what they actually wanted to do. You don't need to be an expert to enjoy learning about security. Working in security full-time isn't as exciting as it sounds. You can still explore security concepts without making a career out of it.
Hackers blur the lines between heroes and villains in the digital landscape. Though some are outlaws, others pioneer new possibilities. This post looks at the various types of hackers and their motives. Famous hackers have shaped the digital world through both ethical and illegal means. Hackers fundamentally think differently and use tools in unintended ways that can build up or tear down.
The Escape team underwent a project to spider 189.5M URLs to search for API keys and discovered 18,000 secrets, which included $20M in vulnerable Stripe tokens. This post covers how the team built a custom web spider using Golang and fasthttp along with the data analysis and verification pipeline. The process was deployed on a k8s cluster that could scale to 150 concurrent worker instances. The data collection took over 69 hours.