Search the archive

WORDPRESS ADMINS

THE EVOLUTION OF NORTH KOREAN ANDROID SPYWARE

SPANISH AIRLINE AIR EUROPA HIT BY CREDIT CARD SYSTEM BREACH

EU REQUESTS FEEDBACK ON NEW SECURITY CERTIFICATION SCHEMA

ZERO

BADBOX, PEACHPIT, AND THE FRAUDULENT DEVICE IN YOUR DELIVERY BOX

The PEACHPIT ad fraud botnet infected hundreds of thousands of Android/iOS devices via 39 apps with over 15 million installs. Part of the China-based BADBOX operation includes backdoored off-brand mobile devices. At its peak, it had 121K Android and 159K iOS bots across 227 countries generating illicit revenue.

PHISHERS SPOOF USPS, 12 OTHER US NATL’ POSTAL SERVICES

There has been an increase in SMS phishing targeting USPS customers to steal personal and financial data. The scams spoof USPS and other postal services with landing pages impersonating their sites. They trick users to input address info and then request additional sensitive details. The attacks highlight the ongoing effectiveness of basic phishing page impersonation tactics. Users should be wary of unsolicited security messages and verify legitimacy before clicking.

GNOME LINUX SYSTEMS EXPOSED TO RCE VIA FILE DOWNLOADS

A memory corruption vulnerability in the cue sheet parsing library libcue can be used for 1-click RCEs on systems running the GNOME desktop environment. This is caused by Tracker Miners, which is included by default in GNOME, automatically indexing all downloaded files to update the search index on GNOME Linux systems. A proof of concept is provided in the article.

HOW AWS PROTECTS CUSTOMERS FROM DDOS EVENTS

A post from the AWS security team on how CloudFront automatically detected and mitigated a new form of DDoS. This DDoS attack is known as an HTTP/2 rapid reset attack. In this attack, an attacker issues multiple requests for streams and then issues a reset for each of those requests. This causes the server to waste resources generating logs even if nothing is returned to the clients.

HOW TO HANDLE SECRETS IN PYTHON

A blog post covering four different patterns for managing secrets in Python code. The post begins with more traditional methods such as utilizing a .env file, a secrets.json file, or environment variables before covering some newer approaches like leveraging a cloud secrets store or KMS.

AN OVERVIEW OF SOFTWARE SUPPLY CHAIN SECURITY

This is a two-part deep-dive into supply chain security and the various aspects involved. Part 1 provides an overview of three phases of the software supply chain: source, build and deployment, and package, and discusses the risks and processes for securing each stage. Part 2 is a comprehensive analysis of 12+ SSC vendors and their core differentiators within the software development lifecycle.

Gutsy comes out of stealth with an eye-watering $51M seed round, bringing a process-centric view to cybersecurity. They are following the steps of Celonis by working with organizations to understand how their different systems are interconnected, the events that are expected, and their outcomes through process mining applied to cybersecurity.

SECURITYONION

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management.

HAVEIBEENSQUATTED?

A website inspired by haveibeenpwned.com to check if a domain has been typosquatted. The tool scans registrars for permutations of given domains.

HTTP/2 RAPID RESET: DECONSTRUCTING THE RECORD-BREAKING ATTACK

Cloudflare mitigated a 201 million RPS DDoS, nearly 3X of the previous record, and generated by only 20K bots. This shows the power of new attack methods as the entire web is about 1-3 billion RPS. This blog aims to highlight the growing DDoS threat for all kinds of networks and dive into the record-breaking attack.

INDUSTRY

A Secureworks study shows that ransomware dwell time - from initial access to deployment - in two-thirds of the cases analyzed had fallen to 24 hours, down from 4.5 days in 2022, and in 10%+ of cases, under 5 hours. This is consistent across variants and groups, highlighting the speed of modern attacks and how hard it is to react, as shorter dwell time doubles the overall extortion with data theft.

The UK’s Information Commissioner’s Office (ICO) has issued a preliminary enforcement notice to Snap over concerns over its My AI chatbot feature. The ICO reports that Snap did not adequately assess the privacy and data protection risks associated with its new generative AI chatbot. Snap will have the opportunity to respond to the ICO’s concerns before action is taken.

GOOGLE EXPANDS BUG BOUNTY PROGRAM WITH CHROME AND CLOUD CTF EVENTS

Google is launching v8CTF, a CTF focused on V8, the JavaScript engine that powers Chrome. kvmCTF is an upcoming CTF focused on Kernel-based Virtual Machine (KVM) that will be released later in the year.

ACCOUNTS

Google is making passkeys the default option for personal accounts, providing a simpler and more secure way to sign into online accounts. Passkeys use fingerprints, face scans, or PINs and are 40% faster than passwords. Google is encouraging the industry to make the switch to passkeys and eventually make passwords obsolete.

CLOUDFLARE IS FREE OF CAPTCHAS

Cloudflare has been working to replace traditional CAPTCHAs that involve visual or audio puzzles with its modern CAPTCHAs.

SONY CONFIRMS SERVER SECURITY BREACHES THAT EXPOSED EMPLOYEE DATA

Sony Interactive Entertainment has contacted 6,800 current and former employees to warn that their data may have been collected by hackers. Sony launched an investigation last month into a second breach in which hackers acquired 3.14GB of data.

CYBERATTACK

MGM Resorts has confirmed hackers stole an unspecified amount of customers’ personal information during a September cyberattack that will cost the hotel and casino giant an estimated $100 million. MGM has seen no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud yet.

LATERAL MOVEMENT

Microsoft security researchers recently identified a campaign where attackers attempted to move laterally to a cloud environment through a SQL Server instance. In this blog post, Microsoft elaborates on the attack flow and focuses on the main technique that was observed: SQL Server to cloud lateral movement. It also shows how to detect this type of threat and help mitigate such attacks.

FROM BAD TO WORSE: HOW DUAL RANSOMWARE AMPLIFIES CYBER THREATS

Dual Ransomware, a sinister dance of encryption and exfiltration, doesn’t just lock you out: it takes your secrets and threatens to spill them into the boundless abyss of the dark web. Your data, once merely shackled, is now a pawn in a high-stakes game of cyber blackmail and espionage. This blog post goes through the history of dual ransomware, how it works, and real life examples.

MULTI CLOUD WORKLOADS

A tutorial from AWS on how to utilize Secrets Manager in on-prem and multi-cloud workloads utilizing IAM Roles Anywhere. It includes example use cases and works through a sample application.

OPENPUBKEY

OpenPubkey adds user generated cryptographic signatures to OpenID Connect (OIDC) to enable users to sign messages or artifacts under their OpenID identity. Verifiers can check that these signatures are valid and associated with the signing OpenID identity.

CRAWLECTOR

Crawlector (the name is a combination of Crawler & Detector) is a threat-hunting framework designed for scanning websites for malicious objects.

GITHUB IMPROVES SECRETS SCANNING WITH EXPANDED TOKEN VALIDITY

GitHub introduced secrets scanning in early 2023 and since then added validity checks to the secrets scanning feature. It just announced that validity checks have been expanded to include AWS, Google, Microsoft, and Slack tokens.

RANSOMWARE GANG QAKBOT RESURFACES AFTER FEDS’ BOTNET TAKEDOWN

The Qakbot malware gang has been staging cyberattacks with Ransom Knight ransomware and the Remcos backdoor via phishing emails, according to Cisco Talos. Despite authorities seizing the gang's infrastructure and financial assets, key members of the group have likely regrouped and continued committing cybercrimes.

MISCONFIGURATIONS

The ten most common network misconfigurations, the two agencies say, include default software configurations, improper separation of privileges, lack of network segmentation, insufficient network monitoring, poor patch management, bypass of access controls, poor credential hygiene, improper multi-factor authentication (MFA) methods, insufficient access control lists (ACLs) on network shares, and unrestricted code execution.

THE GREAT ZELLE POOL SCAM

An investigation into how scammers utilize Zelle to trick unsuspecting customers into scams. The investigation is told as a story wherein the protagonist was scammed by a Business Email Compromise into sending $31,500 via Zelle.

90S VULNS IN 90S SOFTWARE (EXIM) - IS THE SKY FALLING?

ZDI has gone public with no less than six 0days in the popular mail server Exim. Ranging from ‘potentially world-ending' through to ‘a bit of a damp squib’, these bugs were apparently discovered way back in June 2022 (!) - but they were published last week.

AWS WILL REQUIRE MFA FOR ROOT USER CONSOLE ACCESS

AWS announced that as of mid 2024, users signing into the AWS management console with root user accounts will be required to use MFA. AWS will communicate this to affected customers through multiple channels. There are plans to expand the MFA requirements but no concrete timelines.

WORKERS

The Modernizing the Acquisition of Cybersecurity Experts Act (MACE Act) aims to address shortages in cybersecurity positions by expanding the pool of eligible applicants. Under the legislation, agencies would only be allowed to consider an applicant’s education if it directly reflects the competencies required for the position. The bill will now move to the Senate for consideration.

LYCA MOBILE SERVICES SIGNIFICANTLY DISRUPTED BY CYBERATTACK

Lyca Mobile has confirmed that its services were significantly disrupted in recent days due to a cyberattack. The attack impacted services in all markets, except for the US, Australia, Tunisia, and Ukraine and the company is still trying to find out if it has resulted in a data breach.

GLIBC’S LD.SO

Qualys discovered a glibc dynamic loader vulnerability that enables a local privilege escalation that grants full root privileges on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13. It is recommended to update as soon as possible as it is a critical vulnerability.

HIGH SEVERITY VULNERABILITY FOUND IN LIBCURL AND CURL

The maintainer of the curl project posted an update that a security issue is “probably the worst security problem found in curl in a long time.” The patched version will be released on October 11 along with details of the CVEs.

THE EVOLUTIONARY TALE OF A PERSISTENT PYTHON THREAT

The Checkmarx Software Supply Chain Security team has been tracking a threat actor that has been publishing malicious Python packages since April. The team has broken down the ways that the threat actor has gradually evolved their techniques from using plaintext payloads, to encrypting malicious functionality, and finally layers of obfuscation and evasion.

BYPASSING BING CHAT’S GUARDRAILS TO SOLVE CAPTCHAS

Bing Chat is a public implementation of the GPT-4 LLM and includes guardrails to prevent certain forms of malicious usage. One user demonstrated that Bing Chat successfully detected that it was being asked to solve a CAPTCHA and refused when it was just prompted with a picture of the text. However, the same user showed that if they edited the CAPTCHA onto a picture of a locket and presented a context of it belonging to their dead grandmother, Bing Chat would transcribe the CAPTCHA.

ANALYZING & PATCHING A DLL REVERSE SHELL

The document describes the process of analyzing and patching a DLL reverse shell. The author starts by conducting initial triage with VirusTotal and Shodan and follows up with analyzing the files to find the IP address and patching to a local VM to get the shell to the host.

GEM SECURITY RAISES $23M FOR ITS CLOUD SECURITY PLATFORM

Cloud detection and response company Gem Security has raised a $23 million Series A round led by GGV Capital with participation from IBM Ventures and Silicon Valley CISO Investments. This comes after its February $11 million seed round led by Team8, which also participated in this new round.

KUBEHOUND

Kubehound is a tool from DataDog that is inspired by the popular Active Directory tool BloodHound. KubeHound can build graphs of Kubernetes clusters and visualize common attack paths. This article contains a tutorial with some example use cases and queries.

CENTER AND SERVER

Atlassian has released fixes to contain an actively exploited critical zero-day flaw impacting publicly accessible Confluence Data Center and Server instances. The vulnerability, tracked as CVE-2023-22515, is remotely exploitable and allows external attackers to create unauthorized Confluence administrator accounts and access Confluence servers.

ABOUT IT

Malwarebytes has released a new report that underscores how the online behaviors of consumers are often at odds with ensuring safety and privacy. Seventy percent of surveyed respondents experienced some kind of cybersecurity threat such as online scams and viruses or malware and roughly one tenth have experienced serious personal violations like stalkerware/spyware and ransomware.

FILES (LNK) AND VIRTUAL HARD DISK FILES (VHD)

This blog post discusses the importance of investigating file types that are often overlooked in threat actor campaigns. It dives into the world of Shell Link files (LNK) and Virtual Hard Disk files (VHD) and explains how Rapid7 is releasing a new feature in Velociraptor that can parse LNK files.

STATE OF DEVOPS REPORT 2023

Google brings back their yearly state of DevOps report where they go into depth of the maturity of companies in their adoption of DevOps. Some of the key takeaways this year include the importance of company culture, collaboration, documentation, and being customer-centric.

GOOGLE AND YAHOO WILL CRACK DOWN ON SPAM

Yahoo announced that bulk senders will now need to implement more robust email authentication as well as comply with unsubscribe requests within two days. Google posted a similar announcement stating that bulk senders (>5000 messages per day) must implement more robust authentication, comply with unsubscribe requests within two days, and comply with a spam rate threshold.

SAFE, SECURE, ANONYMOUS, AND OTHER MISLEADING CLAIMS

This article deconstructs the idea of online anonymity. It argues that even anonymous services tend to collect personally identifiable information that’s just waiting for a breach to expose it.

RANSOMWARE GROUP CLAIMS IT’S COMPROMISED ALL OF SONY’S SYSTEMS