Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Since August 2023, members of the Huntr bug bounty platform for AI and ML have uncovered over a dozen vulnerabilities exposing AI/ML models to system takeover and sensitive information theft. Some of the tools count with hundreds of thousands or millions of downloads per month, such as H2O-3, MLflow, and Ray. These issues potentially impact the entire AI/ML supply chain.
The Rust programming language employs a number of features that lead to vastly more complex binary analysis as compared to C/C++ code. Checkpoint presents a guided tour of various Rust features and how to reverse engineer the assembly code that the rustc compiler generates in debug mode. The post uses IDA for its disassembler.
Users have found that Nothing Chats, which is a Sunbird-based iMessage app on Android, sends all media attachments to Sentry with links to those attachments in plain text. It also sends and stores unencrypted data in Firebase.
Samsung reported that a third-party application used by the company was breached, exposing the data of customers who used the Samsung UK online store between July 2019 and June 2020.
The Federal Communications Commission (FCC) has introduced new rules to protect consumers from SIM-swapping attacks and port-out fraud.
Google TAG discovered an exploit in the Zimbra email server 0-day (CVE-2023-37580) in the wild. It was used by 4 groups to steal emails, credentials, and tokens even after a public fix was released. This post-disclosure activity shows that delays leave orgs vulnerable. It urges rapid patching and updates to protect against ongoing exploits of known bugs.
Royal Mail’s parent company has revealed the infrastructure cost associated with the LockBit attack in January will cost the business £10 million ($12.4 million). The total costs related to the attack are likely to be higher, but no figures have been shared.
The is_user_admin function of the WP Fastest Cache plugin extracts the username from cookies to check if a user is an admin. However, the username is not sanitized and thereby can lead to SQL injection. A patched version of the plugin has been released. WPScan will be releasing its proof-of-concept exploit on November 27, 2023.
This blog post series offers a gentle introduction to Rego, the policy language from the creators of the Open Policy Agent (OPA) engine. The series goes over basic Rego concepts and how to get started with OPA, intermediate Rego syntax, and types of values and rules.
The FBI and Cybersecurity and Infrastructure Security Agency (CISA) have released an advisory about Scattered Spider, a hacking collective that collaborates with ALPHV/BlackCat ransomware. Scattered Spider uses social engineering tactics and phishing to gain initial network access. It is a network of individuals with different threat actors participating in each attack.
Amazon ECS allows for the use of EC2 instances as a container host to increase user control over the ECS environment. This tutorial from AWS walks through the process of setting up an EC2 Image Builder pipeline that begins with an Amazon ECS Optimized AMI and then applies the CIS Docker host benchmarks to the AMI. It then goes through how to use a Lambda step function to update the ECS fleet with the new AMI. The walkthrough includes a CloudFormation stack to deploy the infrastructure automatically.
Aikido is an all-in-one solution that brings together multiple aspects of application security in one platform, including SAST, DAST, SCA, and CSPM.
AI Exploits is a collection of exploits and scanning templates for responsibly disclosed vulnerabilities affecting machine learning tools. Each tool has subfolders that contain metasploit modules, nuclei, or CSRF templates.
Turbo Intruder is a Burp Suite extension that allows for sending large numbers of HTTP requests and analyzing the results. It takes a Python script and thus allows for highly configurable payloads and analysis. Turbo Intruder can also be used to enable high-speed Intruder usage on Burp Community edition.
Thomas Kennedy McCormick, aka ‘Fubar’, a 30-year-old from Cambridge, Massachusetts, has been sentenced to 18 years in prison for his role in running Darkode. Investigators said Fubar was involved in the distribution of malware, hacking websites, as well as the theft and sale of personally identifiable information, payment cards, and bank account credentials.
Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code repository for the Python programming language. Nearly 3,000 projects contained at least one unique secret. Many secrets were leaked more than once, bringing the total number of exposed secrets to almost 57,000.
An in-depth look at the three young cybercriminals behind the Mirai botnet. While none of the cybercriminals involved fit the mold of traditional cybercriminals, they successfully took down large swaths of the internet.
Rhysida - a ransomware-as-a-service - that has compromised organizations in education, manufacturing, and information technology, has been released by the CISA, FBI, and MS-ISAC as an advisory.
Following a lack of direct response from MeridianLink, AlphV, who has claimed to have breached Meridian Link, filed a complaint to the SEC alleging that MeridianLink did not disclose a breach of customer data. MeridianLink claims that no production data was accessed.
A report from Datadog analyzing the security posture data from a sample of thousands of organizations using AWS, Azure, or Google Cloud found that many cloud workloads are excessively privileged. Specifically, long-lived credentials, MFA for cloud access, and IMDSv2 are not sufficiently enforced.
$100M was transferred from a crypto wallet belonging to the Poloniex exchange. Blockchain security firm CertiK suggests that the incident was likely the result of a compromised private key. Poloniex is committed to reimbursing customers and has offered a 5% bug bounty to the hacker upon return of the funds.
The private key material of cryptographic keys can be leaked due to naturally occurring errors in SSH connections. Researchers were able to reconstruct private key material using lattice-based cryptography by comparing faulty signatures generated as part of the connection setup with successful signatures. The attack only affects RSA keys and can be mitigated by error correction in many common implementations of SSH.
Researchers have discovered a new exploit in AMD’s SEV protection. SEV is designed to protect against malicious hypervisors by encrypting VM data and protecting against its modification. This attack exploits the ability to modify cache lines to a previous state which can allow for manipulating authentication variables or return addresses.
This article talks about the new tools introduced by OpenAI on DevDay and how they can be used to exfiltrate data and files, as well as perform backdoor insertion using the Code Interpreter. Attackers may be able to access personal files and manipulate code through malicious prompts on websites, posing a threat to large populations.
Developers have been targeted by malicious Python packages disguised as legitimate obfuscation tools, with the most recent package being "pyobfgood". The package has a destructive payload, "BlazeStealer", that retrieves an additional malicious script from an external source, enabling a Discord bot that gives attackers complete control over the victim's computer.
This post provides an overview of Terraform and some common security best practices. It covers auditing terraform manifest files (using scanning tools), managing credentials and secrets, and creating and using modules.
AWS has launched a new feature that allows for blocking of all or new public sharing of EBS snapshots. EBS snapshots could be heavily sensitive as they contain the full content of EBS disks. The setting must be applied per region and per account.
A project for syncing users from AWS IAM Identity Center to an Amazon RDS cluster. The project creates an Eventbridge rule that watches for new users in IAM Identity Center that belong to a configured group and then runs a Lambda function to create a new user in the RDS cluster. The user will then be able to login to the database with their IAM credentials.
CVE Half Day Watcher is a tool for viewing vulnerabilities in the public domain where the fix hasn't been released yet. This tool intends to highlight the risk of early exposure of Common Vulnerabilities and Exposures (CVEs) in the public domain.
The Australian Cyber Security Centre (ACSC) and the Cybersecurity and Infrastructure Security Agency (CISA) have jointly launched Business Continuity in a Box, a tool designed to help organizations quickly and securely set up critical business functions during or after a cyber attack.
This article talks about the various approaches to Post-Quantum Cryptography (PQC). PQC algorithms have been specially designed to ensure information is kept safe in the future. There are currently four main types of PQC algorithms: lattice-based, code-based, multivariate polynomial, and hash-based. The article talks about how lattice-based cryptography is straightforward but adds complexity.
Intel has patched CVE-2023-23583, also called a 'Redundant Prefix Issue' or 'Reptar' by teams within Google that also independently discovered it. CVE-2023-23583 can be exploited by attackers to escalate privileges, gain access to sensitive information, or trigger a denial of service state.
The Malaysian police managed to dismantle the BulletProftLink Phishing-as-a-service company in collaboration with the FBI and the Australian Federal Police. As of April 2023, BulletProftLink was estimated to have 8,138 subscribers with 327 phishing page templates.
This cheat sheet provides essential commands for use in CTFs, THM boxes, and cybersecurity.
Malicious actors exploited Ethereum's Create2 function to bypass wallet security alerts and steal $60 million worth of cryptocurrency from 99,000 people in six months.
Sponsored
Compliance doesn’t start a week before an audit. GRC teams need to juggle multiple frameworks and increasingly complex tech stacks year round… without losing their minds. Hyperproof [5] lets you centralize your compliance and risk management [5] so you can efficiently manage any number of compliance frameworks and risks in one place.Automate repetitive tasks, prioritize compliance risk [5], scale your workflows, and never fear an audit again. With support for 70+ frameworks [5] as well as custom frameworks and local regulations, Hyperproof can take any compliance challenge off your plate.
Lace Tempest, a threat actor known for distributing the Cl0p ransomware, has been exploiting a zero-day flaw in SysAid IT support software. Tracked as CVE-2023-47246, this is a path traversal vulnerability that allows for code execution in on-premise installations. SysAid has released a patch for the flaw in version 23.3.36 of the software.
Singapore’s Marina Bay Sands luxury resort revealed that 665,000 of its customers were impacted by a recent data breach on Tuesday. Personal information such as name, email address, and phone numbers were affected but no credit card data was compromised.
The State of Maine is the latest entity to disclose a significant impact from the cyberattack targeting a zero-day in Progress Software’s MOVEit file transfer tool earlier this year. The Maine Department of Health and Human Services and the Maine Department of Education were the most affected organizations.
This article explains the inner workings of Cobalt Strike's "make_token" command, which allows users to impersonate other users through their credentials with the goal of enumerating or moving laterally to remote systems.
This post examines SecuriDropper, the first widely distributed Android dropper bypassing Android 13's Restricted Settings defense. Droppers separate attack execution from payload install, which is offered for Malware as a Service (MaaS). SecuriDropper shows that actors are quickly adapting to platform protections, highlighting the ongoing cat-and-mouse game around Android malware distribution.
Shortcut files (.lnk files) might look innocent, but they can cause devastating damage. This post dives into how shortcut files can be exploited for ransomware and more, compromising your computer and the data within it.
Secretive is a macOS app for storing and managing SSH keys in the Secure Enclave. It allows for requiring TouchId or Apple Watch authentication as a 2FA for accessing SSH keys and can send notifications whenever a key is accessed.
Cavelo provides organizations with the necessary means to scan their environments for data that might be at risk in the event of a breach, including personally identifiable information (PII) and financial information.
aws-ml-opt-out is a terraform module to opt out of any AWS AI/ML data collection. Unless explicitly opted out, any data fed through AWS’ AI/ML offerings can be used by AWS. This terraform module adds a Service Control Policy (SCP) to opt out of all data collection at the organization level.
Ransomware group LockBit leaked ~50GB of data allegedly stolen from Boeing after Boeing refused to pay. The full release of this data includes system backups and compressed archives. Citrix logs suggest a potential CitrixBleed breach vector. Boeing won't verify data or comment on incident specifics, underscoring disclosure challenges after attacks.
Altitude is a free tool created by Jigsaw and Tech Against Terrorism to give smaller platforms the ability to detect and remove terrorism content on their network. Many groups have moved to smaller platforms as larger platforms have dedicated tools to remove content from groups like ISIS. Altitude seeks to aid these platforms in identifying and contextualizing terrorism content.
Spammers are using Google Forms quizzes to deliver email scams. They are creating a new quiz in Google Forms, using the victim’s email address to respond to the quiz, and then abusing the “Release Scores” feature to deliver their spam.
This post compares the three major standards — NIST, SOC 2, and ISO 27001 — and breaks them down in an easy-to-consume manner.