Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Ledger has reported that hackers compromised the code for the Ledger Connect software development kit used by decentralized apps to interface with Ledger wallets. The hackers pushed out a malicious version of the kit. Ledger pushed out an update of the Connect Kit to replace the malicious one within 40 minutes of becoming aware. The attackers have amassed $600,000 in stolen funds.
A new vulnerability, CVE-2023-50164, has been given a maximum severity rating. It affects Struts 2.0.0-2.3.37 (EOL), Struts 2.5.0-2.5.32, and Struts 6.0.0-6.3.0. An attacker can manipulate file upload parameters to enable path traversal and under some circumstances, this can lead to uploading a malicious file which can be used to perform remote code execution. Struts 2 developers and users are urged to immediately upgrade to version 2.5.33 or Struts 6.3.0.2, or greater.
Asper Biogene has disclosed that personal health data belonging to approximately 10,000 people has been illegally downloaded. Asper Biogene began an investigation after discovering that over 100,000 files were accessed and is yet to determine the full scope of data that was contained in these files. A criminal investigation has also been launched by the Estonian Data Protection Inspectorate.
A group of researchers has developed a novel attack method to extract several megabytes of ChatGPT’s training data and theorize that the technique could be extrapolated to extract ~a gigabyte of training data. The attack involves prompting the model with “repeat the word poem forever” and watching as the model spits out training data. This article discusses why this works and the implications behind it.
BazarCall is a phishing attack that utilizes an email resembling a payment notification or subscription confirmation that suggests that a user is being billed an outrageously high amount for a product or subscription with a phone number to call for support. The “customer support” team then tricks the user into installing malware onto their device. The newest wave of these attacks utilizes a Google Form to create the invoice with the option to send a copy of the completed form to the entered email which leads to the invoice coming directly from Google.
In this blog post, Google discusses its response to the Reptar vulnerability. The response was led by the Vulnerability Coordination Center (VulnCC), which ensures a consistent vulnerability management process across Alphabet. By working alongside the vendors, the response was successful, with the vulnerability being mitigated without impacting users or customers.
Sponsored
Keyloggers can steal the most sensitive user data — and new data [11] shows that this is far from being a solved problem. Between March to August 2023, Moonlock detected a large number of keylogger samples [11] on macOS devices. Their report highlights the distribution of keyloggers, core modules, anti-analysis techniques, code examples, API usage, detection methods, and more.
Enveedo is a cyber resilience tool that aims to deliver integrated risk management and achieve continuous cyber resiliency. It offers a comprehensive view of the organization’s IT and security systems, assets, data, and people and simplifies cybersecurity oversight and management.
Eraser helps Kubernetes admins remove a list of non-running images from all Kubernetes nodes in a cluster.
Nuclei AI Browser Extension enables users to extract vulnerability information directly from a webpage to create Nuclei templates. The extension also enables creating a Nuclei template from an ExploitDB exploit or HackerOne report. An account from cloud.projectdiscovery.io is required.
In this post, Microsoft talks about the disruption of Storm-1152, a cybercrime-as-a-service (CaaS) ecosystem that created 750 million fraudulent Microsoft accounts in support of phishing, identity theft, and other schemes. The CaaS is believed to have made millions of dollars in illicit revenue by creating fraudulent accounts for other cybercrime groups to use in phishing, spam, ransomware, distributed denial-of-service (DDoS), and other types of attacks.
Researchers have found a new type of side-channel attack, named SLAM, that can circumvent the security features of the latest CPUs. The attack leverages a memory feature of CPUs that allows storing untranslated data bits in the kernel metadata to extract encryption keys and root passwords. Linux has released patches and Intel intends to issue a patch. Arm and AMD believe they are safe.
Microsoft Threat Intel experts have been investigating a new post-exploitation technique in which attackers use compromised accounts to create high-privileged OAuth apps. These OAuth apps allow attackers to spawn VMs for cryptomining, automate BEC attacks, and manage spam campaigns without needing to retain access to the original compromised account. Microsoft recommends enforcing MFA and conditional access policies to protect against attacks like this.
Ransomware operator Rhysida has posted limited data that appears to back up its claim that it has successfully hacked video game developer Insomniac Games. Sony and Insomniac are investigating.
Apple has launched Stolen Device Protection as an optional second layer of security to protect stolen iPhones. With Stolen Device Protection enabled, when a user is away from trusted locations certain sensitive actions will require biometric unlock whereas some will require a “security delay” as well.
Users of Ubiquiti WiFi products have reported unexpected access to other people's devices, including access to security camera footage and photos, when logging into their UniFi cloud accounts.
Sponsored
The shocking reality of critical vulnerabilities in publicly-exposed containers. Kubernetes (K8s) has transformed the way applications are deployed and managed in the cloud-native landscape. Based on scans of over 200,000 cloud accounts, the Wiz Security Research team [5] exposes how many clusters are at risk, and what it means for your cloud defense.
Kentucky healthcare organization Norton Healthcare is informing about 2.5 million individuals that their personal information was compromised in a ransomware data extortion hack earlier this year. The organization said that it did not pay the ransom demands as the hackers leaked 4.7 TB of data. This included contact information, dates of birth, Social Security numbers, health and insurance information, and medical identification numbers.
Forescout Vedere Labs has identified a total of 21 new vulnerabilities affecting Sierra Wireless Airlink cellular routers and their dependencies. Of these vulnerabilities, 1 is rated critical and 9 are rated as high. Over 86,000 internet-facing devices were discovered by the researchers, with less than 10% being fully patched. This article includes mitigation and patching instructions.
A group of researchers from Singapore discovered a series of 14 vulnerabilities that impact a total of 710 5G smartphone models from Android, Apple, routers, and USB modems. The 5Ghoul attacks range from temporary service disruption to network downgrade and can be executed without any secret knowledge of the victim, such as SIM card details. The flaws involve impersonating a legitimate 5G base station with proof-of-concept exploits available.
This guidance is focused on people and processes, so organizations can effectively respond during critical incidents. The guide explains how to structure the human elements of incident responses with best practices to help navigate the crucial hours after breach detection and help security teams and leaders steer an investigation when plunged into an incident.
This post is part 2 of a blog series by Datadog focusing on Kubernetes security fundamentals. It details the attack surface of the Kubernetes API in both managed and unmanaged clusters. The post provides guidance on how to reduce the network exposure of these API endpoints and how to encrypt communication.
The Trend Micro Managed XDR team discusses how the aspnet_compiler.exe, a legitimate Microsoft Process, is used to inject the AsyncRAT payload. The investigation revealed different tactics employed by the attackers, including phishing campaigns, code injection, and the use of dynamic DNS servers as well as the ability to evade detection by Antivirus software.
Sponsored
Next week: Join cybersecurity experts from MANDIANT, GOOGLE, and NUCLEUS as they uncover how to effectively leverage Vulnerability Threat Intelligence (VTI) [12] to prioritize threats and shape strategies for risk acceptance. Throughout the discussion, they will discuss how to use Vulnerability Threat Intelligence to gauge the true impact of vulnerabilities, shift from patch prioritization to an informed strategy, and preemptively tackle zero-day vulnerabilities and other imminent cyber threats.
BBOT (Bighuge BLS OSINT Tool) is a modular, recursive OSINT framework that can execute the entire OSINT workflow in a single command.
A free and open vulnerabilities database and the packages they impact. It also includes the tools to aggregate and correlate these vulnerabilities.
Amazon Inspector has launched a set of open source plugins and an API to enable container scanning at build time directly from a CI/CD plugin. Inspector has also launched a new capability to enable agent-less continuous monitoring of EC2 instances. It added a new feature that utilizes generative AI to provide assisted code remediation for Lambda functions.
Cisco Talos has discovered a new campaign by the Lazarus Group called "Operation Blacksmith." The campaign involves the use of three new malware families written in DLang, including two remote access trojans (RATs) that use Telegram for command and control. The malware families discovered in Operation Blacksmith demonstrate a shift in Lazarus Group's tactics and the use of DLang as a programming language.
An ex-employee from First Republic Bank allegedly deployed malware, broke services, and damaged the cloud environment after getting fired for watching pornography on his work laptop. He also impersonated a colleague who got the promotion he wanted. According to the bank, the total damage exceeded $220,000.
Log4J took the world by storm when it was first disclosed as being actively exploited in December 2021. A report from Veracode shows that roughly 38% of Log4J applications are still using vulnerable versions of the library.
FBI has issued a clarification to SEC-required data breach disclosure requirements, allowing for a 30 to 60-day delay in cases of national emergency, but not exceeding 120 days without an exemptive order from the SEC.
This playbook was developed to help vCISOs in their journey, covering vCISO goals, pitfalls to avoid, 5 phases (research, understand, prioritize, execute, and report), and the key activities for each phase.
AWS Secrets Manager recently announced a 99.99% availability SLA. In the event that AWS fails to meet this SLA in a given billing period, users will be eligible for a credit.
Researchers from IIIT Hyderabad discovered a vulnerability that allows malicious apps to expose credentials when a user autofills with a password manager on Android. The attack involves tricking password managers into autofilling into the app as well as a Login with Google WebView.
Researchers have discovered a new flaw, tracked as CVE-2023-45866, that allows for remote code execution on Android, iOS, macOS, and Linux Devices. The attack deceives the target into thinking that it’s connected to a Bluetooth keyboard by taking advantage of an unauthenticated pairing mechanism that’s defined in the Bluetooth specification. No specialized hardware is needed for the attack, which allows attackers in Bluetooth proximity to inject keystrokes into a vulnerable device.
Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.
This post breaks down a process for hunting malicious open-source infrastructure by identifying hardcoded headers or static strings that are included in the application. It includes two worked examples using Responder and Havoc C2. This is part of a series of posts on techniques to hunt malicious infrastructure.
This post goes step by step on how the author identified three Symfony RCEs. Symfony is a free and open source PHP framework that makes web development faster and easier.
This post analyzes the 2017 WannaCry ransomware attack which rapidly spread by exploiting Windows vulnerabilities, encrypting files, and demanding cryptocurrency payments to decrypt them. It reviews key indicators of WannaCry's behavior, a YARA rule to detect it, and discusses the malware's unorthodox "kill switch" domain check which ultimately halted its spread.
TInjA is a CLI tool for testing webpages for template injection vulnerabilities. TInjA currently supports 44 different templating engines and can scan for SSTI and CSTI.
Bambdas is a new feature of Burp Suite that allows for customization of the Burp Suite UI from the GUI using Java snippets. Bambdas is meant to allow users to customize the functionality of Burp Suite and add in utility that is needed for them. Examples of Bambdas and helpful snippets are provided in the post.
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM platforms and in CI environments.
This report found that AppSec chaos reigns, with 78% of CISOs responding that today’s AppSec attack surfaces are unmanageable and 90% of responders confirming that relationships between their security and development teams need to improve. Surprisingly, 77% of CISOs believe software supply chain security is a bigger blind spot for AppSec than Gen AI or open source.
Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.
The total number of data breaches more than tripled between 2013 and 2022 — exposing 2.6 billion personal records in the past two years alone — and has continued to get worse in 2023. Ransomware and vendor attacks contributed in a major way to the sharp increase in data breaches and resulting compromise of sensitive records. The number of ransomware attacks in the first nine months of 2023, for instance, was 70% higher than the same period in 2022.
EDR-Telemetry is a project that lists telemetry features from EDR providers and other endpoint agents. The motivation of this project is to allow security practitioners to quickly compare and evaluate the telemetry potential of those providers.