Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
VF Corp, the owner of Vans, Supreme, and The North Face, has reported to the SEC that hackers stole the data of 35.5 million customers. VF Corp says that it doesn't retain consumer social security numbers, bank account info, or payment card information and does not have any evidence that attackers stole customers’ passwords. VF Corp has not disclosed what data has been stolen.
This post navigates what the author calls the five eras of cybersecurity. From early ciphers that were secure against manual attacks but vulnerable to computers to the latest era which will see us dismantle much of what we've built over decades to create a more secure, resilient, privacy-focused digital future.
This post aims to set up a hypothetical phishing page for educational purposes to raise cybersecurity awareness. It is not a super sophisticated effort, but it shows the dangers of phishing pages and the social engineering behind them.
A post from DataDog that walks through two different attack scenarios that it has observed. In the first scenario, an attacker enumerated their credentials, established persistence, attempted to move laterally, and finally attempted to run a large EC2 instance in an unused region before being blocked. In the second scenario, the attacker immediately launched crypto mining tasks on ECS Fargate with 25 tasks in 17 regions, showing that this method can be much more effective.
Nightshade is a free tool that lets artists "poison" AI models from training on their work. It is now publicly available after months of development. It subtly alters images to trick AI into misidentifying them, weaponizing machine learning against itself to protect artists' creations.
A password strength app that evaluates and rates your password's robustness, estimates crack time, and provides helpful warnings and suggestions for stronger passwords.
A BurpSuite extension that brings taint tracking to web analysis. FlowMate tracks all parameters sent to a web application and matches their occurrences in the responses.
Huntr researchers recently discovered multiple high-severity vulnerabilities in popular AI/ML solutions like MLflow, ClearML, and Hugging Face. The most critical issues are in MLflow, including a path traversal bug allowing file deletion (CVE-2023-6831) and a data module flaw enabling path manipulation to overwrite files and achieve RCE
The Kansas court system requires at least $2.6 million in additional funds to recover from an October cyberattack that disrupted electronic filings and online records access for weeks.
This excerpt from 'Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency' tells the story of how Sarah Meiklejohn discovered that Bitcoin could be deanonymized. While Meiklejohn was a PhD student at UCSD, she became fascinated by the privacy claims made by users, developers, and even the creator of Bitcoin. Slowly via experimentation, she discovered methods to link together disparate transactions and form chains of payments that are critical to modern-day crypto tracking operations.
In this X thread, a user shares tricks for navigating the SSH Shell, like how to find out how many layers of SSH you're in and how to pass port forwarding connection requests after establishing a connection.
ReversingLabs tracks the landscape of software supply chain security and reports on trends that it has observed. Some key trends in 2023 were the proliferation of protestware, more malicious packages being hosted on repositories, and PyPi overtaking npm for the most malicious packages.
The US Federal Trade Commission (FTC) has reached a settlement with Texas-based data aggregation company InMarket Media, banning it from selling Americans' precise location data.
Sponsored
Want to uplevel your container security strategy? This cheat sheet explores advanced techniques that you can put into action ASAP. Use this cheat sheet as a quick reference to ensure you have the proper benchmarks in place to secure your container environments.
Foxsemicon, a subsidiary of Foxconn, was recently targeted by the ransomware group LockBit. The hackers defaced Foxsemicon's website, claimed to steal 5TB of data, and are threatening to leak sensitive customer/employee info unless their ransom demand is paid.
Trail of Bits is disclosing a vulnerability that it discovered that allows for memory leakage from an optimized GPU region in GPUs from Apple, Qualcomm, AMD, and Imagination. The researchers showed that they could leak 5.5MB per GPU invocation, which translates to 181MB on a 7B llama.cpp model. They demonstrated that this is enough information to reconstruct the LLM response with high accuracy.
CISA and FBI warn that threat actors using Androxghost malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads. The botnet scans for servers vulnerable to specific RCE vulnerabilities and then scans the servers for .env files with cloud credentials. The credentials can then be used to spin up infrastructure to expand the botnet or to send out spam masquerading as the compromised companies.
Visual Studio's Development Tools Environment (DTE) COM library can enable lateral movement by interacting with the OS to execute commands remotely. The class ID of the Visual Studio install needs to be retrieved from the registry first, but it is an interesting path that can be taken.
A post on using Atomic Red Tests to test Falco detection in Kubernetes. The post first walks through deploying Atomic Red Tests and Falco in a Kubernetes cluster. It then walks through running tests, monitoring for detections, and adding custom Falco rules for missed events.
This blog post discusses a lightweight way to detect potential iOS malware by analyzing the Shutdown.log file stored in sysdiag archives. Anomalies and indicators of malware can be detected by extracting and parsing the log file. In the example presented in the post, through analysis of several Pegasus malware infections, it was discovered that the Shutdown.log file contained traces of infection.
Use OpenAI to scan your code for security issues from the CLI. It requires adding your own OpenAI API token. LAST includes options to scan full code, change code, and run in the pipeline.
AppVerifier takes the app's package name and signing certificate hash(es) and compares them to the ones you provided or the ones in the internal database to verify that your apps are genuine.
A tool to scrape SSL certificates from all AWS IP ranges and search for specific keywords.
Vulnerable Docker services are being targeted to deploy XMRig cryptocurrency miner and 9Hits Viewer software, marking the first case of 9Hits being used maliciously. The threat actors aim to diversify their money-making strategies by compromising Docker hosts via Shodan scans and running headless Chrome instances to generate web traffic credits.
This blog post discusses nine vulnerabilities that have been discovered in the IPv6 network protocol stack of EDK II, TianoCore's open source reference implementation of UEFI. The vulnerabilities affect various vendors that use EDK II's NetworkPkg module, including Arm, Insyde Software, American Megatrends Inc., Phoenix Technologies Inc., and Microsoft Corporation.
Google's Threat Analysis Group discusses the COLDRIVER Threat group from Russia and its increasing attacks on western officials using malware. The group primarily focuses on credential phishing against high-profile individuals in NGOs, former intelligence and military officers, and NATO governments. It employs impersonation accounts to establish rapport with targets and increase the success of its phishing campaigns.
The Naz.API credential stuffing list contains 70 million unique email addresses and old passwords - it was found on a hacking forum.
This retrospective on the Cybersecurity Market in 2023 notes that although overall funding was down, the largest acquisition in cybersecurity history also took place last year.
After a couple of months of being down, Tweetfeed is back with Indicators of Compromise (IOCs) shared by the infosec community at X.
Sponsored
In this recorded talk: speakers Kayne McGladrey, Field CISO at Hyperproof [5], and Dr. Rebecca Wynn, Global Chief Security Strategist and CISO at Click Solutions group, discuss: → Valid business use cases for generative AI tools like ChatGPT.
Most internet-facing SonicWall firewalls are unpatched for two high-severity vulnerabilities, allowing remote DoS and potentially RCE without authentication. CVE-2022-22274 and CVE-2023-0656 stem from code reuse issues. Patches were released in 2022 and 2023, but over 178,000 devices remain vulnerable. Exploitation can repeatedly crash devices, disrupting operations.
A security researcher discovered an unprotected database belonging to a school security company, Raptor Technologies. The 827GB database contains four million records that include student health information, court protection orders, school layouts, school security information, and background checks. Raptor Technologies has secured the database and reports that it has no evidence that the database was accessed by anyone else.
Trend Micro reports that a Windows Defender SmartScreen vulnerability that was patched in the November 2023 Patch Tuesday is being actively exploited in a campaign to drop the Phemedrone malware. The campaign involves using a specially crafted internet shortcut file to bypass SmartScreen, download a control panel item file from the attacker’s C2, and execute the loader, which establishes persistence and runs the malware. The Phemedrone info-stealer targets browsers, crypto wallets, Discord credentials, files, FTP connection info, system info, Steam, and Telegram.
This blog post goes through what LLM attacks are and shares examples of how to execute them. Web LLM attacks can retrieve protected data, trigger harmful actions via APIs like SQL injection, and attack systems querying the model. It resembles exploiting SSRF vulnerabilities - abusing a server-side system to attack components not directly accessible.
This blog post walks through how to create a stealthy arbitrary code execution attack on macOS. The author does this by seeking execution from memory without documented functions using just RtlMoveMemory and DispCallFunc to minimize traces.
The Sysdig Threat Research Team discovered a payload that utilizes the onbeforetoggle HTML attribute to bypass the AWS WAF’s Managed Rules’ protection. This post details how they built a fuzzer to fuzz for XSS payloads against the AWS WAF and details the bypass that they discovered. The vulnerability was patched by AWS after it was reported.
A tool that helps to identify client-side prototype polluting libraries.
seCureLI is a tool that scans your local repo for secrets before you commit code to a remote repository, installs linters based on the code of your project to support security and coding best practices, and configures all the hooks needed so you don’t have to.
SOPS is an editor of encrypted files that has a wide range of supported formats and can encrypt using AWS, GCP, Azure, Vault, age, and PGP. SOPS exposes both an editor and a decryptor package.
The now inactive Inferno Drainer scam created over 16,000 malicious domains from 2022-2023 to phish cryptocurrency wallet credentials using high-quality phishing pages spoofing Web3 protocols. It scammed over 137,000 victims and stole $87 million. Inferno Drainer offered its scam-as-a-service malware to affiliates for 20% of earnings. It spoofed 100+ crypto brands via phishing sites on the 16,000+ domains.
Mandiant posts about the CLINKSINK Drainer Campaign that was executed after its X account was hacked. Mandiant notes that hundreds of thousands of dollars worth of Solana cryptocurrency assets have been stolen in recent CLINKSINK drainer campaigns. These campaigns involve the use of social media and chat applications to distribute cryptocurrency-themed phishing pages, which trick victims into connecting their wallets and approving fraudulent transactions.
The European Central Bank is planning to conduct its first cyber resilience stress tests on 109 supervised banks to assess their ability to respond to and recover from a cyber attack. The tests will simulate a scenario where a cyber attack disrupts the banks' daily operations, and the banks will be evaluated on their response and recovery measures.
Cloudflare published its DDoS Threat Report for Q4 2023, which observed a 61,839% increase in DDoS attacks targeting environmental services in 2023. The most targeted industries were cryptocurrency, gaming and gambling, and telecommunications.
AWS Accounts has announced that users will no longer be able to add security challenge questions to accounts that don’t already utilize them.
HelloFresh, a recipe kit delivery service, has been fined £140,000 by the UK's Information Commissioner's Office (ICO) for sending 80 million spam messages to customers without proper consent.