Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Sponsored
DNS is an often-overlooked aspect of network security, despite being the 1st step of almost every malicious attack. Control D [13] makes DNS an easy problem to solve. Block malicious domains, unwanted content and browse faster on all devices. The best part? It’s so easy your grandma can (probably) use it [13]. Available for personal use and teams of all sizes.
Above is an invisible network sniffer for finding vulnerabilities in network equipment. It is based entirely on network traffic analysis, so it does not make any noise on the air. Above is completely based on the Scapy library.
SecObserve is an open source vulnerability management system for software development teams that supports a variety of open source vulnerability scanners. It integrates easily into CI/CD pipelines.
Notation is a CLI project for adding signatures as standard items in the OCI registry ecosystem and building a set of tools around signing and verifying the signatures.
Researchers earned over $1.3 million hacking Teslas, EV chargers, and infotainment systems at Pwn2Own Automotive. Synacktiv won $450K for Tesla hacks. Day 1 saw $700K awarded, including $60K EV charger and $40K infotainment bounties. The 3-day event revealed 49 new auto vulnerabilities.
A post that provides a deep dive into the concept of Least Privilege as applied to AWS IAM. After providing some background and worked examples on how to determine the effective policy of an AWS principal, the post elaborates on why striving for Least Privilege may not be sufficient or productive in all cases.
A post from the Google Security team on creating large-scale security changes. It begins by detailing some scalability issues in the team’s attempt to roll out Strict CSPs. The post then delves into the tooling and metrics that were required to collect data and implement changes that scale better to the immense number of services that Google operates.
A critical vulnerability in Jenkins' built-in command line interface (CLI) allows attackers to obtain cryptographic keys that can be used to execute arbitrary code remotely. Update ASAP.
Cloud Threat Landscape is a comprehensive threat intel database of cloud security incidents, threat actors, tools, and techniques.
More than 5,000 GitLab servers have not been patched for a critical vulnerability that allows attackers to hijack the password reset process.
HP Enterprise reported to the SEC that its cloud-based email system was breached and emails belonging to employees were accessed. The attackers are believed to be Russia’s Cozy Bear/Midnight Blizzard, which was also responsible for the recent Microsoft breach. HPE is still investigating the scope of the breach but reported that no operations were interrupted.
A massive data leak, known as the Mother of all Breaches (MOAB), has exposed over 26 billion records from numerous previous breaches. It has data from platforms like LinkedIn, Twitter, Weibo, and Tencent. The leaked dataset contains a staggering 12 terabytes of information and is likely the largest ever discovered. While it mainly consists of information from past data breaches, it is believed to also contain new data that has not been published before.
A financially motivated threat actor is targeting Mexican banks and cryptocurrency trading entities with a modified version of the AllaKore RAT. The RAT payload allows the threat actors to send stolen banking credentials and authentication information to a command-and-control server for financial fraud. Based on the large number of Mexico Starlink IPs used in the campaign and the addition of Spanish-language instructions to the modified RAT payload, the threat actor is believed to be based in Latin America.
Orca has discovered a new vulnerability, dubbed Sys:All, which impacts an estimated 250,000 GKE clusters. Orca researchers said that the vulnerability stems from a misunderstanding whereby users believe that the system:authenticated group in GKE includes only verified and deterministic identities as opposed to any Google authenticated account. This means that any Google user can obtain an OAuth bearer token and utilize it to authenticate to the GKE cluster and obtain any overly permissive permissions granted to the system:authenticated group.
Microsoft has released more information about the nation-state attack on its corporate infrastructure as well as guidance on how to respond to such attacks. The threat actor employed techniques such as password spray attacks, malicious use of OAuth applications, collection via Exchange Web Services, and the use of residential proxy infrastructure to obfuscate their activity. Microsoft also offers detection and hunting guidance for identifying similar attack tactics and techniques.
Arctic Wolf Labs has discovered a new loader called "CherryLoader" that is written in Go and has been used in recent intrusions. This loader allows threat actors to swap exploits without recompiling code. Arctic Wolf has provided technical analysis and indicators of compromise related to CherryLoader.
Galah is an LLM-powered web honeypot that is able to mimic various applications and respond to HTTP requests. It is compatible with OpenAI and utilizes a cache to reduce API costs.
pfuzz is a web fuzzer that outputs requests to stdout in the httpipe format instead of sending them. It is inspired by tools such as ffuf.
SSH-Snake is a tool designed to perform automatic network traversal using SSH private keys found on a system. SSH-Snake is self-replicating, self-propagating, and fileless. The repository links to a blog post that provides further details on how the tool works.
France’s privacy watchdog CNIL has fined Amazon €32 million due to invasive employee surveillance that it argues violates GDPR. Amazon utilizes its barcode scanning system to track interruptions of as little as one minute and requires employees to justify any breaks. Amazon says that it may appeal the ruling.
The Blackwood hacking group has been using advanced malware called NSPX30 to conduct cyberespionage attacks against companies and individuals since at least 2018. The group's activities align with Chinese state interests. Its targets are located in China, Japan, and the United Kingdom. Blackwood has been delivering the malware through the update mechanisms of legitimate software, including WPS Office, Tencent QQ, and Sogou Pinyin.
A recent robocall in New Hampshire marks the first instance of AI-generated audio disinformation targeting American voters. The proliferation of AI systems and the relative ease with which a person can be mimicked using deepfake technology means that the New Hampshire robocall is probably indicative of what is to come over the course of the 2024 election.
Two malicious npm modules, warbeast2000 and kodiak2k, were found to have garnered over 1500 downloads on npm before being removed. The malicious packages ran a post-install script that searched for SSH keys and then uploaded them to a GitHub repository.
This website tracks cybersecurity incidents reported in an entity’s 8-K. Users can subscribe for alerts.
The SEC confirmed that the recent X hack was the result of a "SIM swap" attack - scammers tricked cellphone provider staff into giving them control of the account’s registered phone number.
Subway is investigating a potential data breach after the LockBit ransomware gang claimed it hacked the company's systems and stole hundreds of gigabytes of data, including financial information and employee salaries. The hackers threatened to sell the data to competitors if Subway did not pay a ransom to protect it.
A researcher discovered a password dump containing nearly 71 million unique credentials for various sites circulating on the internet. This password dump is unique from many other multisite dumps because it contains nearly 25 million credentials that have never been leaked before. The credentials were collected by a stealer malware running on compromised machines.
Apple has released a fix for a WebKit confusion issue. The vulnerability can result in remote code execution when processing malicious web content. This article contains a full list of affected devices.
This post describes how to find vulnerabilities in applications. It explains a method for hunting CSRFs, a familiar vulnerability for most people to start with.
AI Sleeper Agents are AI agents that behave normally until a certain trigger occurs and their behavior changes. Researchers created AI Sleeper Agents and then applied standard safety training methods that are used by GPTs like ChatGPT and Claude. They observed that the models still responded to the sleeper triggers and were able to adapt their behavior even after going through all the safety training.
The Cactus ransomware has been targeting victims across various industries and putting pressure on them by releasing personal information. The malware uses standard C++ constructs and Windows scheduled tasks for persistence. This analysis provides information on the build of the malware, its program flow, its setup process, and the techniques it uses to inhibit system recovery.
Sponsored
Automation shouldn’t stop at generating and prioritizing tickets. Join this Nucleus Security webinar [11] to learn how you can use automation to drive efficiency in every part of your vulnerability management (VM) program — assigning ownership, ticketing, data management, reporting, audit trails, and prioritization. Register here
Stalker is an Attack Surface Management (ASM) tool with a big focus on extendability. It streamlines and automates reconnaissance operations while giving you the flexibility to expand its functionalities. Its web interface enables easy data access and sharing with all stakeholders.
This script is designed to help expedite web application assessment by automating some of the assessment steps (e.g., running nmap, sublist3r, metasploit, etc.)
LAST (Latio Application Security Tester) uses OpenAI to scan code for security issues from the command line. The tool can be configured to scan all code, only changes, or run in a pipeline.
HP claims blocking third-party ink cartridges prevents viruses. CEO Enrique Lores said viruses could "go to the printer" via cartridges, justifying HP's controversial Dynamic Security system. While hacked cartridges sound concerning, the actual security risk appears low, casting doubt on HP's virus justification.
CISA Director Jen Easterly was the target of a swatting incident on Dec 30. She described it as "harrowing," noting the rise in harassment and threats against public officials.
A post in which Ross Haleliuk, best-selling author of the recently released Cyber for Builders, draws parallels between the development of the quality assurance industry and penetration testing. Haleliuk observes that both QA and pentesting followed a similar trajectory, going from companies not doing them at all before outsourcing the functions, and then finally bringing them back in-house. He predicts that just as software development and testing have become linked, securing and testing software security will become the standard.
Over 39K attacks on Atlassian Confluence Data Centre deployment attempting to make use of CVE-2023-22527.
A website that keeps a list of known AI agents. The list can be used for information or to block unwanted scrapers.
An exposed API in the project management tool Trello allows the linking of private email addresses with Trello accounts, resulting in the creation of millions of data profiles containing public and private information.
Sponsored
As a security leader in 2024, you need to find a way to address existing exposure without slowing down business growth [7]. Yet, identifying which risks to proactively remediate is becoming harder than ever before. What's the best path forward?
Microsoft has warned that some of its corporate email accounts were breached and data was stolen by a Russian state-sponsored hacking group known as Midnight Blizzard. The attack was detected on January 12th and was conducted by Russian threat actors known as Nobelium, or APT29. The hackers gained access to a test account and used it to access a small percentage of Microsoft's corporate email accounts for over a month.
Three UK councils - Canterbury, Dover, and Thanet - have taken some public systems offline due to a cybersecurity incident under investigation. The authorities are working with the National Cyber Security Centre to understand the impact, which has disrupted online services for hundreds of thousands of residents.