Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Hyundai India has fixed a bug that exposed customer data, including names, addresses, emails, phone numbers, and vehicle details. The flaw leaked data through WhatsApp links shared after vehicles were serviced. The links were automated without human involvement. Hyundai said systems get periodic reviews and updates and that it strives to safeguard data.
GitLab has released updates for two critical vulnerabilities, including CVE-2023-7028 for account takeover without user interaction by resetting passwords via unverified emails. CVE-2023-7028 has a 10.0 CVSS score. GitLab has released patches to address the critical flaws.
Bitdefender Labs discovered that the Bosch BCC100 thermostat is vulnerable to cyber attacks that allow attackers to manipulate settings and install malware on the device. The vulnerability was discovered on August 29, 2023, and Bitdefender responsibly disclosed the flaw on January 11, 2024.
Open-source intelligence (OSINT) involves collecting and analyzing publicly available information. It is used by security pros, hackers, and intelligence agencies to uncover sensitive details. OSINT complements operational security (OPSEC). Organizations use it to find exposed data that could help attackers. This list goes into what are some top OSINT tools for analyzing public data, identifying security risks, and improving practices.
SentinelOne researchers have reported a new hacking toolkit called Fbot. The tool features credential harvesting techniques, AWS account hijacking tools, and functions to enable attacks against PayPal and other SaaS accounts. It utilizes a Lithuanian fashion retailer to validate PayPal credentials.
This blog post provides an overview of available data sources and methods for detecting initial access to Microsoft 365 environments. It covers how the Unified Audit Log and Azure AD logs can be utilized for detection. It then covers techniques and queries for detecting the following attack methods: password spraying, illicit consent grants, device code phishing, MFA fatigue, MFA enumeration, and adversary in the middle.
Venera is a tool for automating customized tests and attacks against many kinds of protocols. It relies on a scripting engine based on the Lua scripting language that makes it possible to create modules for all types of checks and exploits.
EZGHSA is a command-line tool for summarizing and filtering vulnerability alerts on GitHub repositories.
Jason Haddix has published his personal GPT for offensive security. It is meant to act as a peer to aid ethical hackers with up-to-date research and methodology.
The Medusa ransomware group has increased attacks after launching a dark web leak site in February 2023 to publish data from victims refusing to comply with demands. The group's multi-extortion strategy offers victims options like extensions or data deletion for a price. Medusa emerged in 2022 and targets diverse sectors, impacting 74 organizations in 2023. Its attacks exploit internet-facing vulnerabilities and hijack accounts, often using initial access brokers for network access.
Researchers have identified attacks exploiting Apache Hadoop and Flink misconfigurations to deploy crypto miners. The malware uses packers and rootkits to hide, delete contents, and modify configs for evasion. Hadoop attacks abuse a YARN ResourceManager misconfiguration, allowing remote code execution via crafted requests and Flink attacks similarly to achieve unauthenticated remote code execution by targeting a misconfiguration.
The Finnish National Cybersecurity Center has warned of increased activity of the Akira ransomware in December, with six out of seven ransomware incidents reported last month being attributed to the ransomware. The ransomware has been wiping backups, which amplifies the damage of the attack and puts more pressure on victims to pay the ransom.
The chair of the FCC has formally requested that automakers provide plans to prevent abusive partners from using car features that collect location data to stalk partners.
The ACLU recently discovered a typo in a geofence warrant that led to the collection of personal information of users in a two-mile span of San Francisco. The ACLU is using this issue to put a spotlight on the overly wide reach of geofence warrants.
A 29-year-old Ukrainian national has been arrested for running a sophisticated cryptojacking scheme that earned them over $2 million in illicit profits.
The SEC's official X account was hacked and made to tweet a false claim that the bitcoin ETF was approved. This highlights cyber risks the agency has long warned companies about. SEC chair Gary Gensler prioritizes cybersecurity, mandating disclosures and punishing misleading claims. The hack was caused by an individual hijacking the SEC's phone number via a third party. X said the SEC account lacked two-factor authentication.
Real estate giant Fidelity National Financial (FNF) has confirmed hackers stole 1.3 million customer records in a November cyberattack. FNF said unauthorized third parties accessed systems, deployed malware, and exfiltrated data. The company notified affected customers, applicable state attorneys general, and regulators. The stolen data appears to be sensitive as FNF is providing credit monitoring to impacted customers.
Framework Computer disclosed a data breach caused by an employee of its accounting service provider being phished. The accountant shared a spreadsheet containing full names, email addresses, and outstanding balances of employees with unpaid balances to an attacker impersonating the CEO of Framework. Affected customers have been notified.
This post contains a deep dive into a remote code execution vulnerability in the SnakeYAML library. The post begins with describing how !! fields work in YAML and how the deserialization vulnerability allows for instantiating Java classes. It then goes through the process of developing an exploit against the vulnerability to eventually achieve remote code execution.
An in-depth analysis of the SilverRAT malware. The article includes an analysis of how SilverRAT operates, the code builder platform and options that are sold with it, and the admin panel that is used for C2 operations. It concludes with OSINT to delve into the developers’ backgrounds and IOCs for the malware.
In this blog post, ElcomSoft discusses using its Elcomsoft iOS Forensic Toolkit along with other analysis tools like Cellebrite Physical Analyzer. The post provides instructions for opening and analyzing data extracted using Elcomsoft iOS Forensic Toolkit in Cellebrite Physical Analyzer. Elcomsoft is also examining compatibility with other top-tier tools and is open to partnerships and collaborations.
BBOT (Bighuge BLS OSINT Tool) is a modular, recursive OSINT framework that can execute the entire OSINT workflow in a single command.
Betterscan contains many tools for Code, Cloud, secrets, dependencies, software composition analysis, Supply Chain Risks, and precise Graph-based SAST analysis for Code and AI/OpenAI GPT.
Damn Vulnerable LLM Agent is a deliberately vulnerable ReAct LLM Agent built with Langchain. Users can utilize it to learn and experiment with prompt injection attacks.
Akamai uncovered a new crypto mining campaign active in 2023 spreading via SSH using a custom Mirai botnet called NoaBot. NoaBot has wormable self-spreading capabilities and an SSH key backdoor. It drops a modified XMRig miner with an obfuscated config and custom mining pool. Evidence links it to 2023's P2PInfect worm, but immature names complicate attribution.
According to cybersecurity firm Forescout, last year's cyberattack against Danish critical infrastructure, which was believed to be conducted by Sandworm, was likely not the work of the Russian hacking group. Forescout's research indicates that the two waves of attacks were unrelated and that Sandworm probably did not have anything to do with it.
A Californian man who lost $100,000 in a SIM-swapping attack has obtained permission from a federal judge to serve and sue the unknown owner of a crypto wallet via delivery of bitcoin to the wallet. This is the first-ever ruling of its kind and may provide new avenues for victims of crypto theft to retrieve funds.
Microsoft is testing the USB4 Version 2.0 specification, which supports transfer speeds of up to 80 Gbps over USB Type-C cables, in Windows 11.
Security firm Mandiant revealed that it did not have two-factor authentication (2FA) enabled on its hacked X account, leaving the account vulnerable to brute-force password attacks.
Threat actors posing as cybersecurity researchers are contacting victims of the Royal and Akira ransomware gangs, offering to delete files the groups have stolen for a fee.
Sponsored
If you think compliance is going to be any easier in 2024, think again. New regulation and tighter enforcement [5] are likely to increase the resources you’ll need to spend on manual compliance tasks — unless you invest in automation. Drata [5] is trusted by thousands of security and compliance teams (e.g. at Postman, Lemonade, and Vercel). Drata gives you a single picture of compliance [5] so you can manage risk and improve your security posture.
LoanDepot shut down certain systems to implement measures to secure its business operations, bring systems back online, and respond to a recent ransomware attack. The unauthorized third-party activity included access to certain company systems and the encryption of data. Its impact still has to be estimated.
A new CI/CD attack that utilizes self-hosted GitHub runners to achieve arbitrary code execution has been reported. The default setup instructions for self-hosted GitHub runners features persistent runners and only requires approval for the attacker’s first request. Attackers can exploit the bug to poison images for major companies and even GitHub itself.
Researchers have discovered 23 vulnerabilities in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B, a network-connected wrench used in factories to assemble sensitive instruments and devices. Exploitation of these vulnerabilities could allow hackers to install malware that disables entire fleets of the devices or causes them to tighten fastenings too loosely or tightly.
This post is an analysis of the McAfee-reported iOS apps spreading via Korean phishing sites to steal user data. Unable to find the malicious iOS .ipa on malware sites, the author conducted his own investigation starting from the phishing links to download and analyze the apps.
Phishing attacks against Microsoft 365 are rising due to its wide use and MFA bypass techniques like AiTM phishing. This post explains how to detect AiTM phishing on Microsoft Login pages.
This post presents a cost-minimization approach that utilizes Cognito Identity Pools to control authentication and authorization directly from a front-end app. The crux of the solution involves an IAM policy that utilizes DynamoDB Leading Keys to handle user separation. The post includes sample IAM roles and policies, a worked demo, and a list of advantages and disadvantages of this approach.
Galah is a web honeypot tool powered by LLM (currently only the OpenAI API). Leveraging LLMs, it processes incoming HTTP requests and dynamically crafts realistic responses on the fly to engage attackers.
Eraser helps Kubernetes admins remove a list of non-running images from all Kubernetes nodes in a cluster.
Asset inventory of over 800 public bug bounty programs.
NIST has published a guidance describing the various types of attacks that can be used to target artificial intelligence systems, warning AI developers and users that there is currently no foolproof method for protecting such systems. The agency has encouraged the community to attempt to find better defenses. The report covers both predictive and generative AI.
A post on the curl project’s struggle with researchers’ use of LLMs in their bug bounty program. The curl team receives a myriad of submissions that are generated at least in part by LLMs. These are often high-quality reports with fictional vulnerabilities. The post includes a few examples that show why these reports take more time to triage even if there is no real finding.
The Chinese Bureau of Justice has announced that it worked with a forensics firm to crack Apple’s anonymous AirDrops to track the use and spread of “inappropriate speech.” The firm reported that it was able to analyze iPhone logs for hashed values of senders' mobile numbers and emails, which it then cracked with a rainbow table.
The number of funding rounds increased from 303 in 2022 to 346 in 2023. Companies raised a total of $8.7 billion in 2023, compared to $14.5 billion in 2022, which represents a 40% drop.
X users who have shown interest in cryptocurrencies are reporting that their feeds are full of malicious crypto ads that lead to crypto drainers, fake airdrops, and other scams. MalwareHunterTeam and ScamSniffer have started tracking the volume of scams, and users have started leaving community notes on ads warning users about scams.
Portswigger has begun accepting nominations for its “Top 10 Web Hacking Techniques of 2023” roundup. The announcement includes a list of preliminary nominations that feature interesting web hacking techniques.