Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Atlassian has issued a warning about a critical security vulnerability affecting all versions of Confluence Data Center and Server, which could lead to significant data loss if exploited by an unauthenticated attacker. The vulnerability is an improper authorization issue. Atlassian is not aware of any attacks exploiting this vulnerability but urges customers to take immediate action to protect their installs.
Phylum's automated risk detection platform alerted them to a campaign involving at least 48 different publications on npm. These packages, published by the npm user "hktalent" with a package called rshNpm, contained obfuscated JavaScript designed to initiate a reverse shell on package install. The attack chain is triggered by package installation via an install hook in the package.json.
Malwarebytes detected an incident in which attackers utilized a hacked website to generate dynamic search ads that advertised software containing a Trojan. Dynamic search ads are a feature of Google ads that allows for generating ads based on the content of a webpage. Malwarebytes speculates that the attackers may not have even known that they were creating these malvertising ads.
The Cyber Security Agency of Singapore has released an advisory detailing common misconfigurations in networks. The 13 item list includes common misconfigurations such as weak authentication, unnecessary open ports, and unencrypted data.
This article provides an overview of Blister, a malware loader that loads a payload embedded within it. The authors analyze past payloads dropped by Blister loaders based on 137 unpacked samples from the past year and a half and explore recent developments. The analysis shows that Blister is mostly used in a targeted manner with Mythic agents as its payload of choice. The article provides YARA rules and scripts to help analyze the Mythic agent and the packer observed with it.
age is an encryption tool, format, and go library. It features small, explicit keys, no config options, and UNIX-style composability. age supports many common encryption tool features such as passphrases, recipients, and SSH keys.
A gag tool showcasing that Ghidra will automatically detect and render image and audio files embedded in a binary.
AWS has announced a new independent sovereign cloud in Europe. The sovereign cloud is designed for public sector organizations in highly regulated industries that require a distinct cloud that is located solely in the EU. AWS has committed to maintaining the same level of service as the main cloud and providing high availability capabilities through distinct and geographically distant regions and availability zones in the European Sovereign Cloud.
Researchers at Infoblox have been tracking a three year old link shortening service that caters to threat actors. Prior to May 2023, the shortening service primarily used .info domains, but it has now migrated to primarily using .US domains. The .US top-level domain (TLD) is meant to be managed and verified by the National Telecommunications and Information Administration, but researchers have speculated that this management has been outsourced, leading to the TLD hosting many phishing websites.
North Korean state-sponsored hackers have targeted blockchain engineers of an unnamed crypto exchange platform via Discord using macOS malware named KANDYKORN. Security researchers have linked the activity, which began in April 2023, to the Lazarus Group. The attackers lured victims by impersonating blockchain engineers on a public Discord server. The malware is a full-featured memory resident RAT with built-in capabilities to enumerate files, run additional malware, exfiltrate data, terminate processes, and run arbitrary commands.
A security researcher experienced a series of pop-up windows that made it nearly impossible to use his iPhone while traveling by train in the Netherlands. The culprit, it turned out, was using a Flipper Zero device to send Bluetooth pairing requests to all iPhones within radio range. This slim, lightweight device has been available since 2020, but in recent months, it has become much more visible.
InfoSecMap is a searchable database of different events and meetups related to information security.
Aerospace company Boeing has confirmed that it is investigating a cyberattack that affected its parts and distribution business. This comes after LockBit ransomware claimed that it had breached the company's network and stolen data. Boeing has stated that the incident did not affect flight safety, and it is collaborating with law enforcement and regulatory agencies.
An alliance of 40 countries will sign a pledge to stop paying ransoms demanded by cybercriminal groups during the third annual International Counter-Ransomware Initiative summit in Washington, D.C. The initiative is in response to record ransomware risks worldwide, with the U.S. being the target of approximately 46% of these incidents. The summit will also focus on strategies to block the funds used by ransomware groups to finance their operations.
Sponsored
Rampant cloud usage requires an advanced security playbook. Wiz put together these AWS security best practices [5] from leading cloud security orgs.
Lockbit ransomware group has listed Boeing on its victims list. Stolen Boeing data could have big repercussions as the company works for military clients who want their information to be confidential. Boeing is currently assessing this claim.
Atlassian disclosed a 9.1 severity CVE in Confluence Data Center and Server. It described the vulnerability as an improper authorization vulnerability that could lead to significant data loss if exploited by an unauthenticated attacker. Users of Confluence Data and Server are advised to update as quickly as possible. Confluence Cloud users are unaffected.
CCleaner’s parent company announced that it experienced a data breach related to MOVEit. Attackers compromised customer names, contact information, and purchase details. The Cl0p ransomware gang has not yet added details to its website about this attack.
This multi-part blog is a walkthrough on how to set up a phishing simulation campaign for education purposes. The first post covers configuring DNS, VPS, and TLS, installing Postfix, and SMTP service integration.
An article from Push Security exploring different Phishing techniques that can be used for initial access in Slack. The article covers common attacks, methods to cleanup after attacks, and the potential impacts.
This post showcases how to detect browser credential extraction, weed out false positives, and improve resilience against this threat by enabling process creation and file access auditing. Tools such as Lazagne and HackerBrowserData are open source and provide customizability to advanced attackers, whereas tools such as Nirsoft’s WebBrowserPassView are closed source and cannot be modified easily.
Darktrace has released a new solution based on AI. The new solution provides visibility of cloud architectures, real-time cloud-native threat detection and response, and prioritized recommendations and actions to help security teams manage misconfigurations and strengthen compliance.
Cloudflare released a tool to sanitize HAR files in response to the (latest) Okta breach of customer HAR files. Users can upload a HAR file and client-side logic will sanitize any sensitive credentials.
iMessage Contact Key Verification uses Key Transparency to verify the identity of the person that a user is corresponding with and notifies users if the conversation may be eavesdropped on. Users can also choose to verify a Contact Verification Code in person or via FaceTime. This feature is aimed at journalists, government officials, or others who have high privacy requirements.
This post details an active cryptojacking campaign abusing exposed AWS credentials on GitHub. The actor creates EC2 miners within minutes of secrets being posted leveraging cloud automation for scale. It goes into detail on how the actor implemented honeypots to monitor and reveals 474 miner instances between August and October.
Researchers are calling attention to the Wiki-Slack attack, a new technique that uses modified Wikipedia pages and relies on a formatting error when the page is rendered in Slack. To mount the attack, a threat actor would first need to select a Wikipedia article that might be of interest to an intended target, modify it to add a legitimate footnote at the end of the first paragraph, and then share the article in Slack, leading them to an attacker-controlled website where browser-based malware lays in wait.
The document from CitizenLab discusses the vulnerabilities of mobile networks and how they can be exploited by surveillance actors to track users' locations. These vulnerabilities are most often tied to the signaling messages sent between telecommunications networks which expose phones to different modes of location disclosure.
The Zero Day Initiative’s Pwn2Own Toronto 2023 hacking competition concluded with two new zero-day exploits, bringing the total demonstrated vulnerabilities to 58. Over the course of four days, participants successfully exploited routers, printers, smart speakers, NAS products, surveillance systems, and mobile phones, earning more than $1 million in rewards.
A malvertising campaign has been discovered that promotes fake versions of PyCharm through Google search results. A compromised website specializing in wedding planning has been infected with malware to serve bogus links to the software. Victims who click on the ad are led to a hacked web page with a link to download the application, which installs over a dozen different pieces of malware instead.
The SEC has charged SolarWinds with defrauding investors by concealing cybersecurity defense issues. The SEC alleges that the CISO of SolarWinds was aware of major security issues in the product but concealed that information. SolarWinds maintains that the action is unfounded.
Three new vulnerabilities related to the NGINX ingress component in Kubernetes (CVE-2023-5043, CVE-2023-5044, and CVE-2022-4886) were reported on October 27th. These vulnerabilities allow attackers who can control the configuration of the Ingress object to steal secret credentials from the cluster, including credentials for the Kubernetes API server with very high privileges.
Apple introduced a feature in iOS 14 that claimed to display a unique, private MAC address for each SSID an iPhone connected to. Two security researchers discovered that this feature doesn’t work on iOS 17.1. They then tested all versions of the feature since it was released and learned that it had never worked. The researchers discovered that the iPhone would send the private MAC address in the source field in multicast messages upon joining a network but the real MAC address would still be sent in a different field.
Citrix warns all admins of Netscaler ADC and Gateway appliances to immediately secure their systems from an actively exploited vulnerability dubbed Citrix Bleed (CVE-2023-4966). The 9.4 vulnerability allows unauthenticated attackers to launch a low complexity attack to remotely disclose session tokens and hijack authenticated sessions with no user interaction. This article includes commands to kill all sessions and details of the patched versions.
This little blog post walks through how you can turn a simple script that moves folders or files into a privilege escalation on a Mac.
This blog post goes into depth into how you can exploit an OAuth callback URL to create a zero-click account takeover.
This study looked at the behavior of human defenders against two different attack strategies, Beeline and Meander, and how it affected the emergence of defense strategies. The results showed that although human defenders initially had more difficulty stopping the Beeline adversary, they were able to learn to stop it by taking advantage of their attack strategy.
Postleaks is a tool to search for exposed secrets in public Postman collections.
MalwareBytes has launched a new product, Identity Theft Protection, that is meant to help secure digital identities and defend against identity and online threats. It does this through identity monitoring and alerting, credit monitoring, breach analysis, and identity recovery tools.
Gsec is a web security scanner based on custom vulnerability scanners and Nuclei. It can do passive scans (DNS enumeration, subdomain generation) and aggressive scans (http code, web crawler, http traversal scan, and more).
The StripedFly malware was first discovered by Kaspersky researchers in 2017 and was initially believed to be a cryptocurrency miner. Researchers discovered that the miner was actually a cover for a highly sophisticated spy platform. The malware uses a custom TOR client to transmit communication and siphoned data between infected systems and the attackers' command and control server and has a ransomware component that has infected a small subset of victims.
Amazon has released a notice that most Amazon RDS and Aurora SSL/TLS certificates will expire in 2024. After rotating the rds-ca-2019 CA certificates, the new CA certificates will expire in either 40 or 100 years. This article contains a tutorial on how to identify and rotate affected instances.
Researchers at Censored Planet and Google’s Jigsaw have been tracking internet blackouts by governments, which impacted 35 countries across 187+ instances in 2022. Outages lasting hours to weeks cut access to vital information for work and family. This post outlines how the researchers built the analysis dashboard and data pipelines to understand the impact of these blackouts.
After Okta’s recent breach, its shares slumped more than 11% - reducing its market cap by more than $2 billion.
Many organizations' expanding attack surfaces, from digital transformation and hybrid work, drive cyber risk, with threats rapidly evolving. Quantifying security solution efficacy through metrics like catch rate is challenging with the variables involved. This piece examines what catch rate indicates about financial risk mitigation.
A study of how generative AI chatbot “hallucinations”, or false information generated by AI chatbots, are harming search results. The study focuses on an example in which a researcher wrote a blog post that was meant to test how an LLM could be tricked into generating a summary using a fictional article. The researcher discovered that their fictional article was highlighted in Bing search results even after they added explicit text in the blog post to try and dissuade the Bing search results.