Cisco Talos has discovered a new campaign by the Lazarus Group called "Operation Blacksmith." The campaign involves the use of three new malware families written in DLang, including two remote access trojans (RATs) that use Telegram for command and control. The malware families discovered in Operation Blacksmith demonstrate a shift in Lazarus Group's tactics and the use of DLang as a programming language.
2023.12.13·blog.talosintelligence.com·10 min read·TLDR InfoSec An ex-employee from First Republic Bank allegedly deployed malware, broke services, and damaged the cloud environment after getting fired for watching pornography on his work laptop. He also impersonated a colleague who got the promotion he wanted. According to the bank, the total damage exceeded $220,000.
Log4J took the world by storm when it was first disclosed as being actively exploited in December 2021. A report from Veracode shows that roughly 38% of Log4J applications are still using vulnerable versions of the library.
FBI has issued a clarification to SEC-required data breach disclosure requirements, allowing for a 30 to 60-day delay in cases of national emergency, but not exceeding 120 days without an exemptive order from the SEC.
This playbook was developed to help vCISOs in their journey, covering vCISO goals, pitfalls to avoid, 5 phases (research, understand, prioritize, execute, and report), and the key activities for each phase.
AWS Secrets Manager recently announced a 99.99% availability SLA. In the event that AWS fails to meet this SLA in a given billing period, users will be eligible for a credit.
Researchers from IIIT Hyderabad discovered a vulnerability that allows malicious apps to expose credentials when a user autofills with a password manager on Android. The attack involves tricking password managers into autofilling into the app as well as a Login with Google WebView.
Researchers have discovered a new flaw, tracked as CVE-2023-45866, that allows for remote code execution on Android, iOS, macOS, and Linux Devices. The attack deceives the target into thinking that it’s connected to a Bluetooth keyboard by taking advantage of an unauthenticated pairing mechanism that’s defined in the Bluetooth specification. No specialized hardware is needed for the attack, which allows attackers in Bluetooth proximity to inject keystrokes into a vulnerable device.
Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.
This post breaks down a process for hunting malicious open-source infrastructure by identifying hardcoded headers or static strings that are included in the application. It includes two worked examples using Responder and Havoc C2. This is part of a series of posts on techniques to hunt malicious infrastructure.
2023.12.11·michaelkoczwara.medium.com·3 min read·TLDR InfoSec This post goes step by step on how the author identified three Symfony RCEs. Symfony is a free and open source PHP framework that makes web development faster and easier.
This post analyzes the 2017 WannaCry ransomware attack which rapidly spread by exploiting Windows vulnerabilities, encrypting files, and demanding cryptocurrency payments to decrypt them. It reviews key indicators of WannaCry's behavior, a YARA rule to detect it, and discusses the malware's unorthodox "kill switch" domain check which ultimately halted its spread.
TInjA is a CLI tool for testing webpages for template injection vulnerabilities. TInjA currently supports 44 different templating engines and can scan for SSTI and CSTI.
Bambdas is a new feature of Burp Suite that allows for customization of the Burp Suite UI from the GUI using Java snippets. Bambdas is meant to allow users to customize the functionality of Burp Suite and add in utility that is needed for them. Examples of Bambdas and helpful snippets are provided in the post.
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM platforms and in CI environments.
This report found that AppSec chaos reigns, with 78% of CISOs responding that today’s AppSec attack surfaces are unmanageable and 90% of responders confirming that relationships between their security and development teams need to improve. Surprisingly, 77% of CISOs believe software supply chain security is a bigger blind spot for AppSec than Gen AI or open source.
Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.
The total number of data breaches more than tripled between 2013 and 2022 — exposing 2.6 billion personal records in the past two years alone — and has continued to get worse in 2023. Ransomware and vendor attacks contributed in a major way to the sharp increase in data breaches and resulting compromise of sensitive records. The number of ransomware attacks in the first nine months of 2023, for instance, was 70% higher than the same period in 2022.
EDR-Telemetry is a project that lists telemetry features from EDR providers and other endpoint agents. The motivation of this project is to allow security practitioners to quickly compare and evaluate the telemetry potential of those providers.
The Australian and New Zealand Nissan Corporation and Financial Services has advised that its systems were subject to a cyber incident. Nissan is working to investigate the extent of the incident and whether any personal information has been accessed.
Hacktivists hacked a small water utility in the Erris area of Ireland and interrupted the water supply for two days. The cyber attack impacted 180 homeowners and the Eurotronics water pumping system. The attackers defaced the user interface of the water-pumping system.
Sponsored
Get a single picture of compliance, manage risk, and improve your security posture with the leader in compliance automation [5]:
A popular parental control app for Android, KidSecurity, provides parents with the ability to set app limits, track their children, and listen to sounds around their children. Researchers discovered an ElasticSearch instance belonging to the app that had no authentication configured. This led to the exposure of private information including phone numbers, email addresses, and portions of credit cards.
Researchers from Jamf have discovered that an attacker could run a trojan on a compromised iPhone running iOS 16 to hook into Lockdown mode and bypass its security mechanisms. This post-exploitation technique could allow an attacker to continue persisting on a compromised device while providing users with a false sense of security. Jamf notes that Lockdown mode was moved to the kernel level in iOS 17 which would prevent their attack.
Atlassian has released fixes for four different vulnerabilities in various products that each could be utilized to achieve RCE. The flaws include a vulnerability in a third-party deserialization library, a template injection flaw in Confluence, an Assets Discovery flaw that could allow RCE on any machines with the agent installed, and a flaw that could allow for RCE via WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper.
Amazon GuardDuty has launched a new feature for runtime monitoring on ECS clusters. Runtime Monitoring for ECS checks hundreds of threat vectors to produce 30 different finding categories that can be sent to EventBridge, Security Hub, or Detective. Runtime Monitoring is supported on Fargate and on EC2-based clusters.
This blog post focuses on writing a one-click malicious webpage that exploits CVE-2023-43641, an out-of-bounds array access vulnerability in libcue that allows attackers to overwrite the memory of a process. It explains the challenges of bypassing mitigations such as no-execute memory, ASLR, and stack canaries. The post provides insights into ASLR, heap layout, and the development of an exploit targeting libcue in tracker-extract.
This gist demonstrates a variant of unicode XSS using character combinations. It also demonstrates how such an attack works and provides the root cause, as well as suggesting approaches for detecting unicode normalization, and flagging such occurrences to be manually inspected.
Sponsored
Vulnerability Threat Intelligence (VTI) helps pinpoint vulnerabilities, shape strategies for risk acceptance, and respond to zero-day threats. Join this session for actionable VTI strategies [12]! SPEAKERS: Patrick Garrity, Nucleus Security | Caleb Hoch, Google | Jacob Semrau, Mandiant
apk.sh makes reverse engineering Android apps easier. It automates some repetitive tasks like pulling, decoding, rebuilding, and patching an APK.
Decompiler Explorer allows you to see decompile output for various decompilers like angr, binary-ninja, and Ghidra. There's a hosted website at dogbolt.org that serves as a frontend but it retains any uploaded binaries.
ADOKit is a modular toolkit that helps build attacks against Azure DevOps Services using their REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance.
This thread discusses how the original iPod was reverse engineered using a specially crafted HTML webpage to run Rockbox.
Google announced that its new text classification system, RETVec, has been integrated into Gmail’s spam filters. RETVec is designed to combat adversarial text attacks such as those which utilize homoglyphs to bypass detection. It has been open sourced and can be run locally on lower-powered devices.
Slowmist, a blockchain security company, conducted an analysis of the North Korean hacking group Lazarus' tactics in Telegram. They found that the hackers employ various tactics, such as convincing project teams to download malicious scripts or inserting malicious links on event pages. Users should take immediate action in case of malware infection and to protect accounts.
Apple has confirmed that unidentified Governments have been using push notifications to surveil users.
Genetic testing provider 23andMe has updated its Terms of Use to make it more difficult for customers to sue the company in response to multiple lawsuits following a data breach.
After years of testing, Meta has announced that it will be rolling out default end-to-end encryption for all users on Messenger. Meta reports that the rollout took so long as many features of Messenger had to be completely rebuilt to work with end-to-end encryption.
Sponsored
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a cybersecurity advisory in response to the exploitation of CVE-2023-26360 by unidentified threat actors at a Federal Civilian Executive Branch (FCEB) agency. At least two public-facing servers were compromised between June and July 2023. The advisory provides network defenders with tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and methods to detect and protect against similar exploitation.
Google has released the December 2023 Android security updates, which address 85 vulnerabilities, including a critical zero-click remote code execution (RCE) bug. The RCE bug, tracked as CVE-2023-40088, was found in Android's System component and can be exploited without additional privileges.
A new variant of the P2Pinfect malware has been discovered specifically targeting embedded devices based on 32-bit MIPS processors. The malware attempts to brute force SSH access to these devices, making it highly likely that routers and IoT devices will be infected.
The Microsoft Cybersecurity Reference Architectures (MCRA) are shared as part of the Security Adoption Framework. This post describes how Microsoft's cybersecurity capabilities integrate with their own and third party platforms. The resource includes information on antipatterns, best practices, and threat trends, among other topics. It also includes detailed technical diagrams for various aspects of cybersecurity.