Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The data breach disclosed recently by Comcast’s Xfinity impacted nearly 36 million individuals, the company told US authorities. Hackers gained access to customer usernames and hashed passwords as well as names, dates of birth, contact information, secret questions and answers, and the last four digits of social security numbers in some cases.
Microsoft has warned that Iranian cyber-espionage group APT33 is using new backdoor malware called FalseFont to target defense contractors worldwide. FalseFont provides remote access to compromised systems and file transfer to its command-and-control (C2) servers. Microsoft has advised network defenders to reset credentials for accounts targeted in password spray attacks and reset any remote access options like RDP.
In this blog post, the researchers describe a detailed analysis of the Menorah Malware, originally discovered by Trend Micro in August and used by APT34. The malware creates a mutex to ensure only one copy runs at a time and extracts the hostname and username to compute a hash that identifies the infected machine. It can perform commands such as creating new processes, listing files and subdirectories, exfiltrating files, and downloading files using a hard-coded C2 server.
Chrome has implemented new mitigations to make it more difficult to exploit the v8 JavaScript engine. The "V8 Sandbox" project was developed as a way to isolate and protect v8. This document discusses Liftoff, v8's WebAssembly compiler, and highlights some interesting opcodes generated by Liftoff.
This blog post provides a pathway to getting started in code review. The post suggests starting out with small vulnerable code snippets before moving on to CVE patches and then finally full libraries. It was written in 2021 and therefore does not make any mention of AI assistants like ChatGPT or Copilot.
A static analysis security vulnerability scanner for Ruby on Rails applications.
Dynamic instrumentation toolkit for developers, reverse engineers, and security researchers.
FARA, or Faux YARA, is a simple repository that contains a set of purposefully erroneous Yara rules. This is intended to be used for training for security analysis and for even Yara veterans to keep their skills up.
In this blog post, the researchers delve into an analysis of the web injection utilized in the recent malware campaign, its evasive techniques, code flow, targets, and the methods employed to achieve them.
This report uncovers a stealthy cross-platform Go malware stealer dubbed JaskaGO, which evades many antivirus solutions. JaskaGO poses a severe Windows & macOS threat as its extensive C2 command set enables advanced system persistence and data exfiltration. The focus of this stealer is sensitive user info like browser logins and crypto wallets.
Post URLs on X use the format https://twitter.com/[account_name]/status/[status_id]. The account_name is not validated. Security researchers have reported that crypto scammers have been making use of this “feature” to post crypto scams and fake giveaways while making the URL appear to be from legitimate accounts such as Binance.
Google has released an update for Google Chrome, patching a new zero-day high vulnerability CVE-2023-7024 that has already been seen exploited in the wild. It is recommended to update ASAP.
A collection of the top-rated talks from SANS Summits in 2023. The talks cover a broad range of topics in the industry.
The FTC has banned Rite Aid from using AI facial recognition software in its stores for 5 years due to a lack of comprehensive safeguards. The FTC alleges that Rite Aid’s technology falsely tagged customers, with a bias against women and people of color.
A digital break-in has disrupted VF Corp's operations and its ability to fulfill orders, according to the apparel and footwear giant. The threat actor disrupted the company's business operations by encrypting IT systems and stealing data, including personal data. VF Corp aims to reduce disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers.
Delta Dental of California and its affiliates are warning patients that it suffered a data breach due to MOVEit attacks. The nearly 7 million affected customers had their names, financial information, and social security numbers exposed. This is the third largest MOVEit data breach thus far.
A group of researchers have discovered a novel attack against SSH connections that can downgrade the security of the connection by truncating negotiation messages. The attack requires the attacker to have established a man-in-the-middle position and the SSH connection to be secured with either ChaCha20-Poly1305 or CBC with Encrypt-then-MAC. The researchers have released a scanner to determine if servers are vulnerable.
This blog explores a few advanced KQL (Kusto Query Language) queries designed to identify and track known patterns, files, and other Indicators of Compromise (IOCs) commonly associated with the Cactus ransomware.
Application Security Posture Management is a new Gartner category that refers to tools that provide everything needed to scan for and remediate vulnerabilities in an application. Broadly speaking, an ASPM should be able to track the lifecycle of a vulnerability, suggest where in the code the vulnerability can be fixed, provide a robust set of scanners, and allow for workflow creation. ASPMs typically include a subset of the following scanners: SDLC, SCA, SAST, IaC, container scanning, secret scanning, DAST, and CSPM.
NKAbuse is a new Go-based malware that utilizes NKN technology for stealthy communication. NKN is a new, decentralized protocol that leverages blockchain technology. NKAbuse can function as a RAT or a DDOS botnet with communication that is difficult to track.
Xeol’s focus is to secure software throughout its lifecycle, beginning at the code repository all the way through delivery to customers. Using an agentless system and basing themselves on SBOMs, Xeol manages enterprises' end-of-life software when publishers no longer provide security patches and brings visibility to them.
The free and open-source security platform SecHub has a central API for testing software with different security tools. It supports many free, open-source, and proprietary security tools.
AtlasLdr is a reflective x64 loader that uses dynamic indirect syscalls that can be used to avoid detection by Endpoint Detection and Response(EDR) systems.
A researcher simulated using large language models (LLMs) like ChatGPT to craft personalized spearphishing emails targeting UK Parliament members. His paper reveals LLMs can iterate malicious emails to successfully trick victims at a fraction of a cent per message. The researcher's findings usher in an era of weaponized LLMs posing immense new cyberthreats.
Threat actors exploit public services to conceal command and control infrastructure amongst legitimate traffic. Blending malicious actions through services like GitHub hinders threat detection and allows inexpensive, reliable control of breached systems. This post navigates how malicious actors are using this technology to frustrate incident response and security teams.
The FBI has reportedly seized the ALPHV Blackcat ransomware gang's dark web leak site as part of a coordinated, international effort. The FBI also released a decryption tool that has allowed more than 500 victims to restore their systems. ALPHV and the FBI have gone back and forth seizing and “unseizing” the site since the publication of this article.
The Vulnerability Impact Scoring System, or VISS, is a customizable framework that provides a web-based user interface and algorithms to help organizations assess and prioritize vulnerabilities based on actual demonstrated exploitation rather than theoretical impact.
The Xtreme firmware for Flipper Zero had previously included a BLE spam attack that could DOS an iPhone by causing non-stop Bluetooth popups to overwhelm a device. Apple has added protections to prevent the DOS attack with its latest iOS update.
This blog post talks about how North Korea uses open source package managers and the GitHub platform to orchestrate supply chain attacks.
MongoDB reported that its corporate systems were breached in a cyberattack, resulting in the exposure of customer data. The breach was detected by the company on December 13th and investigations are underway. MongoDB believes that customer data stored in MongoDB Atlas was not accessed, but the attackers had unauthorized access to its systems for some time before being discovered.
Russian-backed hackers have been exploiting a critical vulnerability in JetBrains’ TeamCity servers since September, infiltrating the servers via authorization bypass and arbitrary code execution. The threat actor, CozyBear, has affected more than 30,000 JetBrains customers, compromising dozens of companies and more than a hundred devices in the United States, Europe, Asia, and Australia. JetBrains recommends updating on-premises servers to version 2023.05.4 or later to prevent exploitation.
A new botnet called KV-botnet is targeting firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR for covert data transfer by advanced persistent threat actors, including the China-linked threat actor Volt Typhoon. The botnet consists of two activity clusters, KY and JDY, which work together to access high-profile victims and establish covert infrastructure.
A group of researchers have developed a tool called Fuzzomatic that automatically fuzzes Rust projects using AI. The tool attempts to find sample usage to generate a fuzz target by checking the project’s README, any source files under an examples directory, unit tests, benchmarks, or public functions in the project. The researchers tested their tool on 37 of the top 50 starred GitHub projects written in Rust and found new bugs in 14 of them.
This post shares a dataset of Cobalt Strike Beacon payloads and their extracted configurations going back to November 2021. Analysis of the dataset shows that 88.97% of payloads leverage the CreateThread API call for process injection. Nearly 62.81% of the samples in the dataset have the default sleep time of 60,000 milliseconds.
Microsoft has created a downloadable guide called "Navigating the Maze of Incident Response" that focuses on the key factors of people and process in effective incident response. The guide helps organizations structure their incident response teams and define roles and responsibilities, including the need for non-technical support from leadership and other parts of the business.
Sponsored
Join cybersecurity experts in this live webinar as they uncover how
to prioritize threats and shape strategies for risk acceptance. Throughout the webinar, they will discuss how to use Vulnerability Threat Intelligence to gauge the true impact of vulnerabilities, shift from patch prioritization to an informed strategy, and preemptively tackle zero-day vulnerabilities and other imminent cyber threats.
SessionProbe is a multi-threaded tool to check which URLs from a list of URLs that a session token can access. The tool is designed to be used with Burp Suite.
A Python script to analyze CloudTrail data of a given AWS account and generate a summary of recently active IAM principals, API calls they made, and regions that they were active in. The summary is written to a JSON file and can be optionally visualized as a PNG file.
Kunai is a Rust-based threat-hunting project that aims to bring various monitoring tasks, ranging from security monitoring to Threat Hunting, to Linux-based systems.
Most modern Smart TVs are sold with Automatic Content Recognition enabled by default. This technology is used to collect data on everything you view and store it in a proprietary database for ad targeting. This article contains steps to disable Automatic Content Recognition on Roku, Samsung, and LG Smart TVs.
This article discusses what to do after receiving an unprompted MFA OTP code. Assume that the credentials for the site have been compromised and reset passwords for affected sites. Do not click any links in such messages and go directly to the site's URL.
The Cybersecurity and Infrastructure Security Agency (CISA) has released the draft Secure Cloud Business Applications (SCuBA) Google Workspace (GWS) Secure Configuration Baselines for public comment. The draft baselines provide minimum viable security configurations for various GWS services. CISA is encouraging federal agencies and other organizations to adopt these baselines, tailored to their needs, and provide feedback.
KrebsOnSecurity first reported on a data breach affecting Target perpetrated by a cybercriminal known as Rescator in 2013. This retrospective details the research that KrebsOnSecurity has compiled over the past 10 years on uncovering the identity of Rescator.
AWS Service Control Policies have strict character limits that include whitespace. However, Terraform does not automatically minimize whitespace, which could lead to character count issues.
China's Ministry of Industry and Information Technology (MIIT) has introduced a color-coded action plan to address data security incidents in the country.