Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
IceKube is an open-source tool that creates graph databases of resource configurations and relationships in Kubernetes clusters. It can analyze these relationships and identify potential attacks by combining them to query for routes using one or more of the 25 attack techniques it currently implements.
This post goes through how Microsoft Access can be used to perform a remote attack. It is done by using the "linking to remote SQL Server tables" feature, enabling attackers to leak the Windows user’s NTLM tokens to any attacker-controlled server. The attack can be launched as long as the victim opens an .accdb or .mdb file.
Europol has arrested five individuals who have been accused of a string of ransomware attacks affecting more than 1,800 victims worldwide. The police also seized cryptocurrency assets, including almost four million hryvnias (around $110,000), and other alleged evidence of illegal activities.
Over the weekend, Iranian hacker group Cyber Av3ngers hacked the Municipal Water Authority of Aliquippa in Pennsylvania and took control of one of its booster stations. However, the attack did not impact the operations at the facility, the water supply, or the drinking water.
This report surveyed 537 people about AI code completion tools and their use for secure development and found that 96% of teams use AI coding tools and over half said that AI coding tools commonly generate insecure code suggestions.
The US and UK cybersecurity agencies CISA and NCSC have published security-focused guidance for the developers of systems that leverage AI, promoting the implementation of secure-by-design principles in AI/ML development.
Plex has rolled out a new feature called Discover Together. It is enabled by default and allows friends and those with access to the Plex server to view anything that a user watched or rated. Many Plex users are enraged by this update and feel that it violates the principles of self-hosting.
Sponsored
The fall report by G2 ranked the top vendors in the MFT space, placing MOVEit at the top and above established MFT vendors [5]. Grab a (free) copy of the G2 Grid infographic [5] to learn about key customer challenges and the leading vendors in the MFT industry.
Fortune 500 insurance giant Fidelity National Financial disclosed a cyberattack that shut down systems and disrupted title insurance and mortgage transaction services. The intruder accessed systems and acquired credentials. The financial and operational impact of the attack is still under investigation.
The National Cyber Security Centre (NCSC) and Korea’s National Intelligence Service (NIS) issued a joint warning that North Korea-linked Lazarus hacking group is exploiting a zero-day vulnerability in the MagicLine4NX certificate management and signing software to carry out supply-chain attacks.
Researchers at Akamai's Security Intelligence Response Team (SIRT) discovered that threat actors are using zero-day vulnerabilities in certain routers and network video recorder devices to build a Mirai-based distributed denial-of-service (DDoS) botnet called InfectedSlurs. The vulnerabilities can be exploited if the device manufacturer's default admin credentials have not been changed. Patches are expected next month.
What is the process of writing an exploit and getting it published as a metasploit module? This post outlines the process for transforming an authenticated Remote Code Execution (RCE) vulnerability in PRTG into a Metasploit exploit. It focuses on the development of the exploit itself rather than the steps for exploiting the RCE.
A post from Pulse Security that examines ways that a compromised pipeline running on a GitLab shared runner can be used to escape from its isolation, compromise the shared runner, and then compromise any other jobs on that runner. The post specifically focuses on the docker-in-docker executor on GitLab, but many of the techniques described can be generalized.
Burp Collaborator is a paid feature in Burp Suite that can be used as a listener domain for attacks like exfiltrating data via XSS. This post provides a tutorial on how to create a free version of Burp Collaborator using Cloudflare Workers to run on the edge and Discord to receive the messages. The worker code is provided.
Athena OS is an Arch Linux-based distro focused on Cybersecurity. Learn, practice, and enjoy with any hacking tool.
InQL is a robust open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
AWS Kill Switch is a Lambda function that can be used to delete a compromised IAM role or apply a heavily restrictive Service Control Policy to a compromised AWS account.
Aqua researchers found exposed Kubernetes secrets in public repos for hundreds of orgs/projects, including SAP & blockchain firms, posing severe supply chain attack potential. Secrets enable access to sensitive SDLC environments. This blog examines inherent Kubernetes secrets management risks, cases of critical data now exposed, and potential downstream impact enabling attacks.
Researchers tested Windows Hello fingerprint sensors on Dell, Lenovo, and Surface laptops - all with Match-on-Chip. They achieved auth bypass on all of the laptops using software/hardware sensor attacks requiring physical access. This post is an interesting read into how the researchers thought of possible ways to attack and ended up managing to get through the laptops.
This post presents a method to obtain the full ARN of an AWS IAM user or role from the AWS Unique ID. The method involves adding the Unique ID as a principal in an S3 bucket policy. If the IAM user or role still exists, AWS will provide the full ARN in the policy after saving it.
Hack The Box announced its 5th annual University CTF amidst a 4M cyber talent shortage, aiming to equip students with the latest skills and a $68K prize pool.
A collection of Black Friday deals on InfoSec-related products and services.
This is a collection of public breach reports along with Tactics, Techniques, and Procedures (TTPs) of threat actors
Sponsored
The expansion of attack surfaces in a post-pandemic work environment, shrinking team sizes and budgets, and the rise of generative AI are fueling an urgent need for businesses to improve — and prove — their security posture. Vanta’s State of Trust 2023 Report [5] surveyed 2,500 business and IT leaders across key geos to find out which global trends are worth paying attention to. Read now [5] to discover:
Canada’s government has confirmed a breach on two of its third-party service providers after 1.5TB of data was leaked by ransomware group LockBit. Some of the data dates back to 1999. The leak impacts anyone who was relocated while using public services. Potentially impacted individuals are being offered credit monitoring services and the option to be reissued valid passports that might have been compromised.
Healthcare engagement platform Welltok confirmed hackers stole 1.6M+ people's data by exploiting MOVEit. It reported that names, dates of birth, addresses, social security numbers, and other sensitive data were leaked
The Ddostf botnet is targeting MySQL servers for use in its DDOS-as-a-Service platform. The botnet is gaining access by brute-forcing weak admin credentials and then installing User Defined Functions to act as a C2 server for use in the botnet.
This is a simple step-by-step learning guide on how to hack WPA-protected Wi-Fi.
This post from Target Australia details the decisions and migrations that it made to improve scalability and security in its EKS clusters. Target Australia moved from manually security-hardening Amazon Linux AMIs to using BottleRocket OS-based AMIs and adopted Karpenter (running on Fargate) to replace Cluster Autoscaler to replace AutoScaling Group-based compute with EC2-based compute for its clusters.
This article discusses transitive access via service accounts in GCP that could allow users to access services as Service Accounts, gaining access to all the IAM resources tied to those accounts. It details the IAM permissions that allow for this, detection methods like using Google Policy Analyzer, and how to identify these service accounts using Google APIs.
Lasso aims to take over LLM security by detecting and monitoring LLM data flow in real time and alerting for possible breaches of policy, enabling organizations to safely deploy LLMs in production environments.
Logging Made Easy (LME) is a free and open logging and protective monitoring solution serving all organizations.
HackTheBox has announced the launch of a new set of labs called Sherlock that focuses on DFIR skills. 15 Sherlock labs will be available for free to all users before the labs are split into 8 free labs and the rest being premium.
The ransomware strain known as Play is being offered to other threat actors as a service. Adlumin has identified and stopped PlayCrypt attacks that had nearly identical tactics, techniques, and procedures (TTPs), hinting at people buying these attacks as a service, allowing anyone with a wallet to do a ransomware attack.
Google has released new Titan security keys that support passkeys for passwordless authentication. The new keys are available in USB A or C, support FIDO2, are NFC compatible, and can store up to 250 passkeys.
YouTube has announced that it will be requiring creators to add labels to realistic content that features AI in the coming months. Creators who consistently fail to add these labels may be suspended from the YouTube Partner Program. Music labels and distributors will be able to request the removal of AI-generated content that mimics artists' voices.
Microsoft has paid out $63 million in rewards to security researchers participating in its bug bounty programs throughout the last 10 years. Of the $63 million awarded since 2013, $60 million of that was allocated in the last five years.
Morgan Stanley has agreed to a $6.5 million settlement over the insecure disposal of hardware containing unencrypted personal information.
A repository containing open source and freely usable Threat Intel feeds that can be used without any additional requirements.
Toyota Financial Services Europe & Africa this week confirmed being targeted in a cyberattack that appears to have been conducted by Medusa. Medusa has a listing on Toyota Financial Services on its Tor-based leak website and is threatening to distribute stolen data unless an $8 million ransom is paid within 10 days.
An EFF researcher's child was given a Dragon Touch Android tablet as a gift. Upon investigation, the researcher discovered the Corejava and Adups malwares as well as the KIDOZ App, which reports extensive data back to kidoz.net. Amazon and Google have begun investigations into the product and Walmart has removed it from its online store.
Threat actors are using manipulated search results and Google ads using Google's Dynamic Search Ads to trick users into downloading malware instead of legitimate software such as WinSCP. The malicious ads redirect users to a compromised WordPress website, which in turn takes them to an attacker-controlled phishing site.
Biometric security has become a crucial layer in personal and enterprise security systems. It utilizes unique biological or behavioral identifiers to authenticate individuals. This article provides an overview of biometric security, including its definition, types, benefits, and applications.
This series aims to demystify AI Security and its intersection with other fields like cyber security and national security. It is designed to be accessible to people from any background. The first post focuses on AI Security basics. There are 8 more posts available and 1 more to be released.
This post from NCCGroup explains how it utilizes typos in HTTP server responses to develop unique fingerprints to identify malicious servers. NCCGroup’s team sampled 800,000 HTTP responses from Censys scan data and applied a spell-checking model to detect any anomalous activity. The researchers concluded that while typos are useful to group and identify anomalous behavior, they aren’t sufficient alone to detect malicious behavior. Typo-detection should be used as part of a larger framework.
EMBA is designed as the central firmware analysis tool for penetration testers and product security teams. It supports the complete security analysis process starting with firmware extraction, doing static analysis and dynamic analysis via emulation, and generating a web report.
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple User Interface.
Kubescape is an open source Kubernetes security platform built on top of Open Policy Agent. Kubescape can be used to scan clusters, YAML files, or Helm charts. In the recently released V3.0.0, scanning is extended to images and can be triggered by a Kubernetes operator.