Search the archive

MOTEL ONE DISCLOSES RANSOMWARE ATTACK IMPACTING CUSTOMER DATA

MEETING THE FEDRAMP FIPS 140–2 REQUIREMENT ON AWS

EXPLOITING THE IPHONE 4, PART 1

LIGHTING THE EXFILTRATION INFRASTRUCTURE OF A LOCKBIT AFFILIATE

CERBERUS

Cerberus is a static analysis tool that attempts to retrieve Go and Rust symbol names. Cerberus does this by locating which libraries are used, downloading and building them, and then hashing the functions and comparing them to the provided binary.

CERTGRAPH

CertGraph constructs and crawls the graph of a domain’s SSL certificates. It does this by treating each domain as a node and each certificate alternative node as an edge to another domain node. The tool was created for enumeration via SSL certificates.

INTEGRATIONS

AMAZON CLOUDFRONT ANNOUNCES SECURITY RECOMMENDATIONS

THE US IS OPENLY STOCKPILING DIRT ON ALL ITS CITIZENS

MALICIOUS PACKAGES HIDDEN IN NPM

2023 STATE OF API SECURITY REPORT: GLOBAL FINDINGS [PDF DOWNLOAD]

GOOGLE TO BOLSTER PHISHING AND MALWARE DELIVERY DEFENSES IN 2024

REVISITING THE BIG PICTURE: MACRO-LEVEL ATT&CK UPDATES FOR 2023

MILLIONS OF EXIM MAIL SERVERS EXPOSED TO ZERO-DAY RCE ATTACKS

A zero-day vulnerability in all versions of Exim mail transfer agent allows unauthenticated attackers to gain remote code execution on Internet-exposed servers. The vulnerability is due to an Out-of-bounds Write weakness found in the SMTP service, which can lead to software crashes or corruption of data following successful exploitation.

JOHNSON CONTROLS INTERNATIONAL DISRUPTED BY MAJOR CYBERATTACK

Johnson Controls International this week reported in a filing with the US Securities and Exchange Commission that it had suffered a cyberattack that caused disruptions to its internal IT infrastructure. The attack was perpetrated by cybergang Dark Angels, who posted a ransom letter claiming the attack. It was done with ransomware that encrypted Johnson Controls’ VMware ESXi machines.

CRITICAL VULNERABILITIES IN WS_FTP SERVER

Progress Software posted a security advisory for several vulnerabilities affecting WS_FTP Server, a secure file transfer solution. Rapid7 has observed that these vulnerabilities are being actively exploited and provided details of the attack chains it has been seeing.

DEPENDENCY-TRACK

This article teaches readers how to store and analyze Software Bill of Materials with OWASP Dependency-Track to identify security vulnerabilities in open-source components. It covers how Dependency-Track can be deployed in a production environment and summarizes the pros and cons of the platform.

NOSQL INJECTION EXPLOITATION TECHNIQUES & LABS

NoSQL injection is a vulnerability where hackers can interfere with queries to NoSQL databases. This can let them bypass authentication, steal or edit data, cause denial of service, or execute server code. NoSQL databases do not use SQL, instead favoring non-relational data formats that open up for injection risks through the lack of standards. This blog dives into the different NoSQL injection techniques and provides labs for readers to try to exploit them.

AUTOMATE LAMBDA CODE SIGNING WITH AWS CODECATALYST AND AWS SIGNER

Code Signing helps ensure the trust and security of deployed code using cryptographic signatures. This post from AWS walks through the process of configuring a CodeCatalyst CI/CD pipeline that uses AWS Signer to automatically sign deployed code.

ENCRYPTED CLIENT HELLO - THE LAST PUZZLE PIECE TO PRIVACY

Cloudflare has announced a new proposed standard called Encrypted Client Hello (ECH) that masks Server Name Indication (SNI), preventing networks from snooping on which websites a user is visiting. ECH is the last puzzle piece to privacy, and Cloudflare hopes that more providers will offer ECH, leading to a more private internet for everyone.

Discern Security has raised $3M to use AI for cybersecurity. Many firms buy expensive tools but don't know how to use them properly. Discern's software maps infrastructure and tools, then makes recommendations to optimize configurations and get the most protection.

SUBSTATION

Substation is a cloud-native, event-driven data pipeline toolkit. It allows for the deployment of modular, serverless data pipelines, data processing, and writing custom data processing applications in Go.

SECURITY SWEEP

Palo Alto Networks is in talks to acquire Israeli cybersecurity startups Talon Cyber Security and Dig Security for around $1 billion in total. Talon protects distributed workforces with secure enterprise browsing. Dig secures data across public clouds. The deals would expand Palo Alto's security portfolio as demand grows.

OF A SPANISH AEROSPACE COMPANY

ESET researchers uncovered a Lazarus cyberattack on a Spanish aerospace firm. Hackers posed as Meta recruiters on LinkedIn and sent coding challenges containing malware. Once inside the network, Lazarus deployed multiple tools including a new backdoor called LightlessCan. ESET analyzed the attack method and Lazarus' toolset through cooperation with the victim company.

VOLATILITY3: REMOTE ANALYSIS ON CLOUD OBJECT-STORAGE

Volatility3 is a memory forensic framework used for incident response. It recently added support for S3 object storage and released an in-depth blog post on how it was implemented.

WHO’S BEHIND THE 8BASE RANSOMWARE GROUP?

A Krebs on Security reader noted that the 8base ransomware group was leaking a significant amount of information on its public error pages. Brian Krebs used this information to trace the website to a 36-year-old Moldovan programmer. The programmer denied the connection.

FACIAL RECOGNITION TECHNOLOGY

A viral TikTok account has amassed a following by utilizing off-the-shelf facial recognition tools to dox random people. The account usually starts by choosing a victim from other viral videos or comments and then goes through the process of processing the image and doxing the person. TikTok has commented that the account does not violate their policies.

USING CLOUDFLARE TO BYPASS CLOUDFLARE

Cloudflare has a vulnerability where customer-configured protection mechanisms can be bypassed due to gaps in cross-tenant security controls, potentially exposing customers to attacks Cloudflare is supposed to prevent.

FAKE BITWARDEN SITES PUSH NEW PASSWORD STEALER

Fake websites have been popping up that offer a Trojan masquerading as the Bitwarden password manager that includes a new password-stealing malware dubbed ZenRAT. The malware specifically targets Windows devices and directs macOS or Linux users to the official download page. The malware uses WMI queries to acquire system information in addition to the credentials and sends them in a zip to a C2.

RUSSIAN ZERO-DAY SELLER OFFERS $20M FOR HACKING PHONES

Operation Zero, a Russian company specializing in buying and selling zero-day software exploits, has increased its payments for zero-day vulnerabilities in iPhones and Android devices from $200,000 to $20 million. While traditionally, bug bounty platforms inform vendors of vulnerabilities, companies like Operation Zero sell these vulnerabilities to governments, leading to a lucrative yet unregulated gray market where prices and customer identities remain opaque.

PASSWORDS

A threat actor is using an alias of GitHub’s Dependabot feature to install password-stealing malware. By mimicking the Dependabot, which automatically scans projects for vulnerabilities, the attacker has convinced users to accept malicious commits.

OKTA FOR RED TEAMERS

An article providing an overview of some Okta features that are useful for red teaming. The first portion of the article discusses features that allow running Okta with Active Directory environments and how to pivot between the two. The article also includes a discussion of using a fake SAML provider with Okta.

MEET MADPOT, A THREAT INTELLIGENCE TOOL FROM AMAZON

MadPot is a large-scale honeypot network that Amazon runs to catch threats and gain threat intelligence which it shares publicly or with government agencies. MadPot intercepts over 100 million attempts per day and the insights can feed into AWS to bolster their threat detection and prevention offerings such as GuardDuty.

CHROME GRAPHICS AS SEEN BY ATTACKERS

This document provides an overview of how WebGPU works through the eyes of an attacker, discusses vulnerability research methodologies, and describes important bugs found during the research. The report aims to give the security community a deeper understanding of vulnerabilities that may come with the addition of WebGPU.

LDAPWORDLISTHARVESTER

LDAPWordlistHarvester is a tool for generating wordlists from information present in an LDAP for cracking non-random passwords of domain accounts. Once you have the wordlist, you can use hashcat with rules to crack passwords.

CISA LAUNCHES NATIONAL CAMPAIGN TO RAISE ONLINE SECURITY AWARENESS

The Cybersecurity and Infrastructure Security Agency has launched a nationwide cybersecurity campaign called "Secure Our World". The campaign is part of CISA's Cybersecurity Awareness Program, which aims to raise public awareness of cyber threats and online security.

PASSKEYS ARE GENERALLY AVAILABLE ON GITHUB

GitHub has made passkeys available to all users on its platform, following the successful beta launch in July.

THE MYSTERY OF THE CVES THAT ARE NOT VULNERABILITIES

An unknown party submitted a large number of backdated CVEs with high CVSS scores. The problem with this is that a researcher has found that many of these are just automatic submissions that are not actually vulnerabilities. This could cause issues when these CVEs are pulled in by systems that don’t check whether they are disputed.

SONY LAUNCHES INVESTIGATION AFTER POTENTIAL BREACH

A ransomware group named Ransomed.vc claims to have breached Sony's systems and has threatened to sell the stolen data. Although the claims remain unconfirmed, Cyber Security Connect reported that the group provided evidence such as screenshots of internal pages and Java files.

SECURITY RESEARCHERS HIGHLIGHT TWO POTENTIAL ICLOUD KEYCHAIN ISSUES

Potential iCloud Keychain issues have been identified by security researchers in iOS 17 and macOS Sonoma. The first problem is that the feature may automatically activate upon upgrading, even if it was previously turned off. The second issue is that if users disable iCloud Keychain, the data might not be deleted from Apple's servers, contrary to past practice.

RASPBERRY PI 5 ANNOUNCED

The next generation of Raspberry Pi will be released this October and features 2-3x the speed of the previous model.

GOVERNMENT SHUTDOWN COULD BENCH 80% OF CISA STAFF

Roughly 80% of the staff at US cybersecurity agency CISA may be furloughed if a government shutdown occurs this week. While some personnel involved with cybersecurity operations are likely to be classified as essential and exempt from furlough, there will be fewer staff available for security monitoring and response.

MISCONFIGURED TESLAMATE INSTANCES PUT TESLA CAR OWNERS AT RISK

Misconfigured instances of third-party data logging application TeslaMate may potentially expose Tesla cars and their drivers to malicious attacks, according to IoT security intelligence firm Redinent. While TeslaMate is a useful tool for tracking car data, it poses a significant risk if not properly configured.

DECADE OF NEWBORN CHILD DATA STOLEN

BORN Ontario, Ontario’s government-sponsored birth registry, reported a data breach affecting 3.4 million people who sought fertility, pregnancy, newborn, or child healthcare from 2010-2023. BORN reported that the hack was due to the MOVEit cyberattacks.

ATTACK

GPUs from all major suppliers are susceptible to a new attack, as demonstrated in a recent research paper, that allows malicious websites to read visual data from other websites, violating the Internet's critical same-origin security policy. While currently deemed more of a curiosity than an immediate threat, the vulnerability highlighted by the attack underscores the risks inherent in hardware optimizations and the need to re-evaluate trust in hardware as a foundational security measure.

MULTI-YEAR CAMPAIGN

Chinese state-sponsored hackers identified as TAG-74 have been conducting a multi-year cyber espionage campaign targeting academic, political, and government organizations in South Korea. The hackers utilize social engineering attacks, including Microsoft Compiled HTML Help (CHM) file lures, to deploy the ReVBShell backdoor and Bisonal remote access trojan.

SOURCE CODE MANAGEMENT PLATFORM BEST PRACTICES

A list of best practices and configurations for GitHub and GitLab. The list includes tools to aid in source code management best practices as well as a series of controls that are recommended to be implemented.

This article talks about one of the latest phishing delivery methods - a sophisticated infostealer that targets the hospitality industry through online booking services. It involves a malicious actor making a booking request and sending a series of urgent emails with links to an executable infostealer. The article provides recommendations for staying safe online, including avoiding clicking on unsolicited links and verifying the authenticity of messages through official channels.