Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Law firm Orrick has disclosed a 2023 breach impacting over 600,000 individuals. Attackers accessed a file with client data between February 28 and March 13. Orrick found no further unauthorized activity after detecting the incident on March 13. Notification letters were sent starting June 2023. Exposed personal information included names, SSNs, passport numbers, and financial account details.
This article describes how Telco Orange Spain experienced an outage due to a BGP hijack that resulted in a 50% drop in traffic from Orange Spain customers. The threat actor gained access to Orange's RIPE account, which manages internet IP addresses. The account had weak security measures, such as no two-step authentication and a lack of password policy.
Hackers breached the Flight Information Display System and Baggage Handling System at Beirut International Airport Rafic Hariri in Lebanon. The cyber attack disrupted the baggage inspection system, forcing personnel to use police dogs to complete the inspection procedures. No threat actor has claimed responsibility for the attack.
This article shares a collection of scripts and tools that helps anyone get started with vulnerability assessments and penetration testing with an optimized workflow. The setup identifies open ports, missing headers, weak crypto, hidden files, subdomains, and more, requiring only the target domain name. It runs on any Docker-compatible OS.
A post from GitHub explaining how it tamed its disparate vulnerability remediation processes with the creation of a Security Findings tool. The tool features a dynamic UI that can aggregate findings from various sources and display them at various levels to suit developer experience. The post also discusses the changing requirements that led to folding security exceptions into the tool.
This blog post discusses preventative measures that can be taken to ensure secure defaults in AWS. The post includes tools to prevent public exposure of resources, prevent some risky behaviors, and enforce security measures. This is part of a series and assumes that SCPs from a previous post have been applied.
Sponsored
Nucleus [11] integrates with your existing security tools to aggregate, normalize, prioritize, correlate and act on all of the vulnerability data in your enterprise [11].
A reconnaissance tool for capturing and displaying SSIDs from a device's Preferred Network List.
ShellSweep is a tool that detects potential web shells in servers. The tool includes three utilities that work together (ShellScan, ShellCSV, and ShellSweep) to provide a comprehensive defense against web shells. The article suggests using the tools alongside regular audits.
A VSCode extension that allows users to generate live graphs of Terraform resources as they write Terraform code.
A threat actor recently sold the Zeppelin ransomware source code for just $500, potentially reviving the Russian ransomware, which has been used in the past in attacks on critical US infrastructure. Zeppelin is a VegaLocker derivative written in Delphi. The CISA and FBI released IoCs on Zeppelin TTPs in 2022. This cheap sale may signal a ransomware-as-a-service revival.
Bitwarden's Windows Hello implementation had an unexpected consequence - allowing remote theft of credentials without knowing the password or requiring biometric authentication. The issue enabled accessing Bitwarden vaults on compromised workstations without end-user interaction. It has since been fixed in v2023.4.0.
AWS launched a new feature of EKS called Cluster Access Management to simplify granting and managing access to EKS clusters. This new feature broadly allows managing access to an EKS cluster via the AWS API. This allows for mapping AWS identities to pre-defined AWS-managed Kubernetes permissions, mapping AWS identities to Kubernetes groups, and gaining visibility into shadow admins.
This post dives into the newly released CVEs of 2023. We ended 2023 with 28,902 published CVEs, up over 15% from the 25,081 CVEs published in 2022.
Merck has settled a dispute with insurers over a $1.4 billion claim related to the NotPetya malware incident that disrupted its operations worldwide in 2017.
Keybase suffered an outage as the New Year started that was caused by a root CA expiring. Users must manually update their apps to restore functionality.
A data breach at HealthEC impacted 4.5 million customers. The stolen files contained personal information such as names, addresses, dates of birth, Social Security numbers, taxpayer identification numbers, medical information, health insurance information, and billing and claims information. All impacted users have been informed.
Transformative Healthcare is informing more than 900,000 individuals that their personal information was stolen in a data breach at now-defunct subsidiary Fallon Ambulance Service. The files contained names, addresses, Social Security numbers, COVID-19 testing and vaccination information, medical information, and information provided to Fallon in connection with employment. Fallon notified impacted individuals about the breach in December 2023.
The Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies of two recently identified vulnerabilities that have been exploited. The vulnerabilities include a Google Chrome flaw and a bug in the open-source Perl library "Spreadsheet::ParseExcel" for reading information in Excel files. The vulnerabilities expose systems to potential remote code execution and data theft.
A critical Google exploit was discovered in October 2023 that enabled persistent access after password resets. A threat actor reverse-engineered this into Lumma Infostealer, protecting it with blackboxing. The exploit spread rapidly among malware groups. CloudSEK identified its root as an undocumented Google Oauth endpoint "MultiLogin". This report examines the exploit's discovery, evolution, and cybersecurity implications.
NIST updated CVE-2023-50164 for a new path traversal vulnerability in struts-core. It is reminiscent of the 2017 Equifax breach stemming from an unpatched Struts issue. This post discusses the vulnerability, provides a proof-of-concept exploit, and outlines remediation steps.
This blog post describes the steps to setup an enterprise-grade Wifi network with WPA3 Enterprise 192-bit and Radius server for authentication. The post mentions that this is more than anyone needs for a home network, but it's fun to learn how to set up a secure Wifi infrastructure. It walks through creating a Certificate Authority, Radius server, and configuring access points to set up a secure network using WPA3 Enterprise.
Cybersecurity is a critical field in today's digital world. This repository aims to provide a centralized location for a wealth of knowledge and study materials. Whether you're just starting your journey in cybersecurity or an experienced professional, you'll find valuable resources here.
A quick way to make a Ubuntu server a bit more secure by hardening the image/VM when it’s running.
ngrok Collaborator Link is a free Burp Collaborator alternative built on ngrok.
The hacked Mandiant account was initially used to masquerade as one belonging to Phantom, a company that offers a wallet for storing cryptocurrency. Posts on X encouraged people to visit a malicious website to see if their wallet was one of 250,000 that were eligible for an award of tokens. Mandiant has since regained control of the account and is investigating the incident.
Cybernews researchers discovered two BMW subdomains that were vulnerable to a SAP redirect vulnerability. The vulnerability allows attackers to redirect users to a malicious website or inject arbitrary content into a legitimate website. BMW was immediately notified and the vulnerability was fixed.
LastPass has announced that it will begin requiring all users to use 12-digit master password minimums. This has been the default setting since 2018 but could be bypassed until now. LastPass will also compare master passwords against a database of leaked credentials and surface a pop-up in case of a match.
Japanese game developer Ateam accidentally exposed the personal information of nearly one million people due to an insecurely configured Google Drive instance that was accessible to anyone with the link since March 2017.
AWS has published a guide for its security services like GuardDuty and Inspector with detailed information on what to do before enabling a security service and how to tune it afterwards.
EasyPark Group, Europe’s largest parking application operator, has disclosed a data breach impacting customer information. Data stolen by hackers includes name, phone number, physical address, email address, and partial IBAN or credit/debit card numbers.
Mortgage servicing firm LoanCare has started informing more than 1.3 million individuals about a data breach impacting their personal information. The attackers have exfiltrated data from FNF’s systems, including personal information such as names, addresses, Social Security numbers, and loan numbers.
Researchers have unveiled new findings surrounding an attack that backdoored iPhones belonging to Kaspersky employees. Operation Triangulation exploited 4 zero days including an undocumented hardware feature which allowed for an unprecedented level of access. The malware was delivered via an iMessage text that kicked off an incredibly complex kill chain that begins with a zero-day in Apple’s TrueType font implementation and includes several other complex techniques.
This blog post explains the class of vulnerabilities known as parser mismatch vulnerabilities. These are caused by two systems parsing data differently. This class of vulnerabilities includes vulnerabilities such as HTTP Request Smuggling and URL parsing vulnerabilities. Examples are included in the post.
This post walks through five different CodeQL queries that can be used to catch potentially serious bugs in the OpenSSL libcrypto API that can cause memory leaks, authentication bypasses, and other cryptographic issues. It encourages developers and code reviewers to use tools like CodeQL to build and share queries to secure their code.
The God Mode Security Rules Repository is dedicated to hosting “god mode” rules that can detect as many threats as possible with minimal false positives. It currently contains a YARA rule with a Sigma rule in progress.
This suite of tools helps decrypt data encrypted by the Black Basta group.
Store and retrieve encrypted secrets with PowerShell on Windows, Linux, or macOS and also from KeePass 2 databases on Windows.
Google has agreed to settle a lawsuit filed in June 2020 that alleged that the company misled users by tracking their surfing activity who thought that their internet use remained private when using the "incognito" or "private" mode on web browsers. The class-action lawsuit sought at least $5 billion in damages. The settlement terms were not disclosed.
An attacker with access to a Kubernetes cluster can chain two vulnerabilities in Google Kubernetes Engine (GKE) to escalate privileges and take over the cluster. The recently identified vulnerabilities in FluentBit and ASM can be exploited as part of the second stage of an attack, provided that the attacker has achieved remote code execution in the FluentBit container or that they can break out of another container.
In an effort to combat stalking, Apple modified its location privacy system for AirTags by reducing the frequency of key rotations to allow for better identification of malicious AirTags at a sacrifice of privacy. Researchers have devised a cryptographic scheme that blends secret sharing and error correction coding to better preserve user privacy while also allowing for anti-stalking detection. The group of researchers has proposed their scheme to a consortium of Apple, Google, and other companies working on this issue.
Nissan has confirmed that an unauthorized third party illegally accessed some of the company’s network systems. Akira has taken credit for the attack, claiming to have stolen 100 GB of data, including corporate files and personal information belonging to employees.
A guide from TryHackMe on preparing for security engineer interviews. The guide includes helpful general interview tips as well as sample technical questions and scenarios with answers.
NASA has released its Space Security Best Practices Guide, aimed at enhancing the cybersecurity efforts of both public and private sector space activities.
An unprotected database belonging to Real Estate Wealth Network was accessible from the internet for an unknown period. The unprotected database was 1.16 terabytes in size, containing more than 1.5 billion records. Britney Spears, Floyd Mayweather, Dave Chappelle, Elon Musk, Dolly Parton, Mark Wahlberg, Nancy Pelosi, and others have been affected.