Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Wiz observed that Kubernetes clusters are being discovered and targeted quickly and noted that container security and other native security features of Kubernetes are frequently underutilized, leading to lateral movement and privilege escalation being increasingly easy after initial access.
The Industrial & Commercial Bank of China’s US branch was hit by a ransomware attack that forced systems to be disconnected from the network. Trades had to be carried out by sending USB sticks via messengers through Manhattan.
Mortgage giant Mr. Cooper confirmed customer data was compromised in a recent cyberattack but it is still investigating specifics. It says that it doesn’t store banking information for payments, and it believes its third-party provider was unaffected. Mr. Cooper plans to notify affected customers by mail in the coming weeks.
Sumo Logic reported that an attacker used stolen credentials to access a Sumo Logic AWS account. It stated that it immediately quarantined the environment, that none of its systems or networks were impacted, and that customer data was encrypted at all times. Sumo Logic is advising customers to rotate their API keys.
A September attack compromised Monero’s Community Wallet and wiped its entire balance. The Monero Community Wallet is used to fund development projects from its members. Monero developer Luigi disclosed the attack on November 2 but has not yet identified the source.
Docker makes many tasks easier for us. It is interesting to consider the surface risk it opens from a security perspective and the possibilities it offers for privilege escalation. This blog dives into the dangers of Docker and how having access to the Docker daemon opens the door to using it as an attack vector.
The blog post details how the author was able to abuse Akamai services to attack F5s and subsequently steal internal data including authorization and session tokens from their customers. It provides detailed explanations of how normal GET requests and malformed POST requests using a smuggling gadget can affect backend servers and potentially poison the response queue or cache.
Aqua Nautilus researchers found flaws in the vulnerability disclosure process for tens of thousands of open-source projects. These flaws allowed vulnerabilities to be harvested before they were patched and announced, potentially enabling attackers to exploit security holes before users were alerted. The research also introduces two additional states in the vulnerability disclosure process: 'Half-Day' and '0.75-Day' Vulnerability.
Sponsored
If you haven’t heard of RYSE yet, you will soon. The story of the smart home COMPANY that started out pitching on Dragons Den and receiving two offers [11] is about to become known nationwide, as their product rolls out in +100 Best Buy stores.
Medusa is a speedy, parallel, and modular login brute-forcer.
LLM-Guard ensures that your interactions with LLMs remain safe and secure by offering sanitization, detection of harmful language, prevention of data leakage, and resistance against prompt injection attacks.
Cover Your Tracks is a tool created by the EFF for testing how well your browser protects you from trackers and fingerprinting.
Researchers observed a malvertising campaign mimicking the legitimate Windows news site WindowsReport.com to distribute malware posing as the popular tool CPU-Z. The campaign leverages trusted site replicas instead of vendor sites and is part of a larger effort also targeting Notepad++, Citrix, and VNC Viewer.
The Predator AI pen testing tool can exploit misconfigurations in 30+ web services, but also has a semi-functional AI chatbot assistant. It is offered for "education" purposes but it could probe defenses or enable attacks. It looks for common flaws like CORS, Git exposure, SQLi, and XSS in a nice convenient package.
In this blog post, Troy Hunt of HaveIBeenPwned examines the recently released LinkedIn data breach. An attacker claims that they breached LinkedIn and have leaked full names, profile data, phone numbers, emails, and other confidential information of users. After analysis, Hunt notes that the data is a combination of scraped and publicly available information and fabricated emails.
US Radiology Specialists, a major private radiology group, was targeted in a ransomware attack in December 2021. The incident resulted in the personal and health information of nearly 200,000 patients, including 92,000 New Yorkers, getting compromised. The group was fined $450,000.
This blog post covers the new vulnerability scoring framework, CVSS 4.0, which was released on November 1, 2023.
Atlassian updated the CVSS score of the recently disclosed CVE-2023-22518 after discovering that an unauthenticated attacker could fully reset Confluence and create an administrator account. This vulnerability is actively being exploited.
The first set of patches addresses 15 vulnerabilities in Android’s Frameworks and Systems. One critical information disclosure vulnerability can lead to local information disclosure with no additional execution privileges needed while the rest of the vulnerabilities are rated as high. The second set of patches addresses vulnerabilities in Arm, MediaTek, and Qualcomm components.
The BlueNoroff hacking group, backed by North Korea, has developed a new macOS malware called ObjCShellz that can open remote shells on compromised devices. BlueNoroff is known for targeting cryptocurrency exchanges and financial organizations.
Veeam has issued patches for four severe security vulnerabilities that could expose users of its Veeam ONE product to remote code execution attacks. The flaws include two critical issues with CVSS severity scores of 9.9 out of 10.
A post from AWS that begins with an introduction to how the shared responsibility model applies to ECS and then launches into some best practices. The topics covered are IAM access to ECS, securing an ECS network, ECS secrets management, securing the ECS task and runtime, ECS logging and monitoring, and ECS security compliance.
Sniffnet is a cross-platform, multi-threaded tool to monitor internet traffic. It supports filtering and can generate graphs and other statistics in real time and output reports of captured data. Sniffnet’s GUI is fully translated into multiple languages.
GitHub has launched a beta version of secret scanning for non-provider patterns like database connection strings for MySQL, Postgres, MongoDB as well as private keys like RSA, SSH, etc.
Fully customizable, offensive security reporting solution designed for pentesters, red teamers, and other security-related people alike.
Two Russian nationals, Aleksandr Derebenetc and Kirill Shipulin, have been charged with conspiring to hack the taxi dispatch system at JFK airport with the help of two US citizens, Daniel Abayev and Peter Leyman. The group hacked the system to move certain taxis to the front of the line in exchange for payment, resulting in large numbers of taxi drivers skipping the line.
Part 2 of a deep dive from KrebsOnSecurity on unmasking the SWAT USA reshipping service. Krebs traces the operator of SWAT USA from his nickname to another nickname on the Verified forums. This username is then tracked via a password sent in a DM to four email addresses that use that password. A Russian individual is pinpointed through one of these emails.
Google Play Protect has launched a new feature that enables real-time analysis of an app’s code and blocks installation if it is determined to be malicious. Play Protect will recommend a scan for any never before seen app, including sideloaded apps. The authors of this article tested the feature with 30 different apps ranging from stalkerware to spyware to fake apps and loan scams and found that, while most were caught by the scan, the fake apps and some of the loan scams were allowed.
A fraudulent version of the Ledger Live app for cryptocurrency management was discovered in the Microsoft Store, resulting in users losing at least $768,000 worth of cryptocurrency assets. The fake app, named Ledger Live Web3, had been present in the Microsoft Store since October 19. The fraudster was able to transfer over $768,000 from victims before Microsoft removed the app.
Aqua Security has discovered that the Kinsing threat actor has shifted tactics in a new experimental campaign targeting cloud environments. The threat actor manually exploited the Looney Tunables vulnerability in GNU libc’s ld.so, marking the first known instance of such an exploit. This vulnerability was reported in October. Any unpatched systems should be patched urgently.
The UK government may introduce legislation requiring tech companies to inform them in advance of new security technologies and possibly disable them when necessary. The proposed Investigatory Powers (Amendment) Bill would update the "notices regime" to provide advance access to technical details of security measures employed by major tech companies, enabling access to user data and monitoring nefarious activity.
Okta is warning nearly 5,000 current and former employees that their personal information was exposed via Rightway Healthcare, a third-party healthcare vendor used by Okta. The exposed data includes full names, social security numbers, and medical plan numbers of affected employees.
Ace Hardware, a hardware store retailer-owned cooperative with 5,700 shops across the United States, China, Panama, and the UAE, suffered a cyberattack that has affected over 1,200 devices and is preventing stores and customers from placing orders. The company is working to restore 196 servers and has engaged with IT experts to help them restore the impacted systems.
The Socks5Systemz proxy botnet has infected 10,000 systems worldwide, turning them into traffic-forwarding proxies for malicious or anonymous traffic. The botnet has been operating since at least 2016 but has recently gained attention. The malware is distributed through phishing, exploit kits, malvertising, and trojanized executables.
The Wiki-Slack Attack is a social engineering attack that redirects business professionals to attacker-controlled websites using Wikipedia and Slack. Browser-based attacks, such as the Wiki-Slack Attack, are becoming the primary infection vector for ransomware. This article provides security recommendations to protect against browser-based attacks and increase cyber resilience.
This article discusses the use of Large Language Models (LLMs) to enhance the capabilities of threat intelligence analysts. It explains what prompt engineering is and provides an example of an ideally crafted prompt. The article also explores the practical applications of LLMs, including few-shot prompting and retrieval augmented generation (RAG) as well as embeddings.
File Integrity Monitoring is limited in the modern age as files containing things like access keys, API keys, and secrets are frequently used. Osquery on macOS can hook into the es_process_file_events table to allow users to define a set of sensitive files to monitor for any accesses or changes. This post contains a tutorial for enabling and configuring Osquery.
A new CTF from Wiz that focuses on an Amazon EKS cluster. The challenge contains 5 challenges with common EKS misconfigurations. A certificate is available upon completion.
Google Play Store has introduced an "Independent security review" badge for Android apps that have undergone a Mobile Application Security Assessment (MASA) audit. The badge is initially being launched for VPN apps due to the sensitive nature of the user data they handle. The MASA audit allows developers to have their apps independently validated against global security standards, providing more transparency and enabling users to make informed choices before downloading.
Rclone is a command line program to manage files on cloud storage. It supports over 70 different cloud storage products, including S3-compatible object stores. Rclone can be used to replicate many different common Unix tools such as cp, rsync, mv, mount, and ls across different cloud storage providers or file systems.
Part one of a series by the EFF on passkeys. A passkey is composed of 100-1400 bytes of random data stored on your computer in a safe location. They can be registered with a browser for a website and used to sign in. Passkeys can build in 2FA support which can increase security and convenience.
The Pixel 8/8 Pro are the first phones to enable ARM's MTE, a security feature that detects memory corruption at first occurrence. It's only available on Pixel as a developer option but can be configured for all apps. This article describes how to enable it on Android phones.
Apple's 'Find My' network could be abused by attackers to transmit sensitive information captured by keyloggers installed in keyboards. Researchers have created a PoC hardware device to highlight the risk to the public by integrating a Bluetooth transmitter into a USB keyboard. They demonstrated that it is possible to relay passwords and sensitive data typed on the keyboard through the 'Find My' network.
James Bethoty recaps some of the best vendors in various categories that he met with during the Global OWASP Conference. Categories range from buzzword of the year to best API security and best overall.
Discord will switch to temporary file links for all users by the end of the year to prevent attackers from using its CDN to host and distribute malware. All links to files uploaded to Discord servers will expire after 24 hours after the change rolls out. The new links will come with three parameters that will add expiration timestamps and unique signatures that will remain valid until the links expire, preventing the use of Discord's CDN for permanent file hosting.
This author attended the POC2023 conference and presented on Chrome exploit chains. He discovered a new WASM bypass method for the V8 sandbox. The author notes that the vulnerabilities were exploited through trial and error.
Researchers at VMware Carbon Black have discovered that 34 Windows Driver Model (WDM) and Windows Driver Frameworks (WDF) drivers are vulnerable to exploitation by non-privileged actors who could gain full control of the devices and execute arbitrary code. The technique has been employed by various adversaries, including the North Korea-linked Lazarus Group.