Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
This article talks about four main variants of DDoS attacks, including flooding, amplification, resource depletion, and diversion or ransom attacks. Mitigation strategies include recognizing the signs of DDoS attacks, having an incident response plan, contacting an ISP provider, having threat intel handy, and using other mitigation defenses and tools.
How To Rotate is a website that provides tutorials on how to rotate a variety of API keys. The project is sponsored by Truffle Security and currently includes 19 tutorials.
JA4+ is a network fingerprinting tool that provides a suite of modular network fingerprints for multiple protocols, allowing for improved threat-hunting and security analysis. The fingerprints include TLS client and server response, HTTP client, light distance/location, X509 TLS certificate, and SSH traffic.
BinDiff is an open-source comparison tool for binary files to quickly find differences and similarities in disassembled code. It is used to identify and isolate fixes for vulnerabilities in vendor-supplied patches and to analyze multiple versions of the same binary. BinDiff is now open source.
A group of researchers found that GitHub Copilot and Amazon CodeWhisperer can be coaxed into revealing other people’s API keys. The keys that can be leaked were included in training data as they were accidentally committed in public repositories. The researchers have also released a tool to search for publicly exposed credentials.
OpenAI announced a Red Teaming Network made up of a contracted group of employees to bolster its AI model risk assessment and mitigation strategies. The goal of this effort is to flag biases in models and prompts that can be used to bypass safety filters.
A Spanish judge has closed an investigation into the alleged hacking of ministers' phones with Pegasus spyware due to a complete lack of cooperation from Israel. The judge had sent a formal request for information about the software made by Israeli firm NSO Group, but Israel did not respond.
Crypto has a poor reputation for poor cybersecurity, and according to crypto cybersecurity company Halborn’s COO David Schwed, the culprit is simply poor security practices.
Microsoft has introduced passkeys to Windows 11, allowing users to log in to websites and applications without a username or password, instead relying on device PIN or biometric information.
Sponsored
Companies are using more external software than ever. Third-party risk is a key concern, and compliance frameworks like SOC 2 and ISO 27001 require a robust vendor management program. At the same time, the proliferation of SaaS and shadow IT
A new vulnerability was found in which GCC’s stack smashing protection has no effect on variable length arrays or buffers allocated with alloca(). The vulnerability targeted 64-bit ARM architecture. This article includes details about the vulnerability, a demonstration of the vulnerability, and a discussion of the response. A fix is available on the GCC mailing list.
Israeli tech firm Insanet has developed spyware capable of being delivered through online ad networks and infecting Windows-based computers and Android phones as well as iPhones. The "Sherlock'' spyware's deployment has raised concerns due to its ability to clandestinely infiltrate devices, monitor activities, and collect sensitive information. The Israeli government has approved its sale, which potentially puts many at risk.
The Gelsemium cyberespionage group, which has been operational since 2014, has been spotted in attacks targeting a Southeast Asian government. The group is known for its technical capacity and programming knowledge, which has helped them fly under the radar for many years.
Helpdesk operators are prime targets for exploitation. Recent breaches have highlighted the need for better defense against attacks on these targets. This post says helpdesk vulnerabilities are mostly tech and process gaps, not people. It covers attacker tactics and recommends processes and tech fixes to protect against helpdesk attacks.
This blog post from Elastic Security on leveraging call stacks to reduce false positives, reduce false negatives, and increase visibility. The post begins with an overview of what call stacks are, then discusses how to leverage them for event explainability and walks through examples of other detection use cases.
Microsoft added a tunnel feature to VS Code in July 2023 that allows users to share their Visual Studio desktop via the web. This is a prime utility for attackers to establish persistence. This article provides some methods to disable the usage of VS Code tunnel as well as some methods to detect its usage.
ExtractBitLockerKeys is a Powershell or Python script for system administrators or attackers conducting post-exploitation to extract BitLocker recovery keys from a domain.
donut-decryptor is a Python script that searches files for known indicators of the donut obfuscator’s loader shell code. If found, it will locate, decrypt, and parse the shell code, dumping any configuration data or modules to disk.
kernel-hardening-checker (formerly kconfig-hardened-check) is a tool for checking the security hardening options of the Linux kernel. It supports checking Kconfig options, sysctl parameters, and boot configs. The repository also contains a map of kernel configuration options and vulnerability classes.
Hex-Rays runs a contest every year to develop novel and interesting plug-ins for IDA. This year, 9 plug-ins were selected from the submissions, including tools to query ChatGPT, analyze functions, and generate unique URIs from disassembled code.
The GitHub Security Lab has reached the milestone of disclosing over 500 CVEs (records of security vulnerabilities) in open source projects. The Security Lab is a team of security experts who audit open source projects and help their maintainers fix vulnerabilities for free. They have reported and helped fix over 1,000 vulnerabilities with a fix rate of 96%.
The FBI claims that Beijing has a cyber espionage program that is larger than all of its major competitors combined. Even if every FBI cyber agent and intelligence analyst focused on China exclusively, Chinese hackers would still outnumber them by at least 50 to 1.
This post talks about how the "Verified Fan" sale that Ticketmaster is doing for the most recent Olivia Rodrigo tour tickets isn't working because scalpers have many accounts and credit cards to quickly buy tickets for resale whereas non-scalpers do not.
APT29, a Russian state-sponsored hacking group, has increased its phishing operations in Ukraine, particularly targeting foreign embassies in Kyiv. This follows an uptick in the group's routine espionage operations against global diplomatic entities, with a focus on European Ministries of Foreign Affairs and embassies, as well as governments in Turkey, India, and Africa.
The hackers who are believed to be behind a major cyberattack that disrupted several casinos and hotels in Las Vegas are part of a small but prolific cybercrime clique whose members have also hit other major U.S. companies in the past year by talking their way into access to computer networks.
Check Point discovered an active BBTok banking malware campaign in Latin America, with a new variant impersonating 40+ Mexican/Brazilian banks to steal 2FA codes and card numbers. Threat actors maintained diverse Windows infection chains with varied file types, showing continued evolution of the malware.
Microsoft researchers posted a link with a misconfigured Azure SAS token that granted access to the full storage account as opposed to just the intended dataset while publishing an open-source dataset on GitHub. The 38TB of accidentally-exposed data includes full backups of two employee workstations as well as secrets, private keys, and internal messages.
Apple has released security patches to address three zero-day flaws that were actively exploited in iOS, iPadOS, macOS, watchOS, and Safari. This brings the total number of zero-day bugs discovered in Apple's software this year to 16. The flaws include a certificate validation issue in the Security framework, a security flaw in Kernel, and a WebKit flaw that could result in arbitrary code execution.
The discussion around Android 14's CA certificate controls has sparked solutions going beyond previous root approaches. While directly writing certs is blocked, root access still enables control by digging into internals. Feedback has produced promising options to regain system-level CA management practically on the latest Android versions.
A blog post that begins with an overview of what cloud ransomware attacks look like and then an overview of AWS Backup. The post then continues to offer advice for deploying AWS Backup at scale using AWS Organizations. It includes terraform code to aid in deployment.
This blog post discusses security options in OpenAPI and what companies are doing regarding API security. Large companies like Facebook and Github use OAuth2 for API security. The post recommends using OAuth2 for authentication, but acknowledges that it can be complex. API keys are still commonly used for security in smaller APIs. Basic authentication is not recommended due to its lack of security.
Sponsored
Ready to wave goodbye 👋 to bugs? QA Wolf
The biggest enterprise software deal of the year to date goes to Cisco for acquiring the observability behemoth Splunk in a $28B deal, paying a premium of $157 per share on the average of $80 or $90 per share Splunk has had this year.
1Password has completed testing for its passkey support. Users can now create, manage, and sign in with passkeys via 1Password mobile apps and web extensions. Passkeys are a new login technology that is meant to replace passwords. 1Password has not enabled the ability to replace a master password with a passkey but teases that the feature is coming later in the fall.
Aftermath is a free macOS Incident Response framework from JAMF. It allows defenders to collect and analyze data from a compromised host. Aftermath can be run as a standalone tool or deployed via MDM and then a series of collection modules can be run to collect data for analysis.
This blog post dives into the group LUCR-3. LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875. It is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing intellectual property for extortion. LUCR-3 targets Fortune 2000 companies across various sectors, including but not limited to software, retail, hospitality, manufacturing, and telecom.
Pizza Hut Australia says 190,000 customers' info – including names, delivery addresses, email addresses, phone numbers, and order information – have been accessed. It told customers it learned of the incident in early September and described it as "unauthorized third party" access to a subset of its data.
T-Mobile customers on X and Reddit reported that they were able to see other accounts’ information in the T-Mobile app. T-Mobile has fixed the issue. The issue was caused by a technology update glitch and was not a cyberattack.
Poland's watchdog is investigating whether ChatGPT breaches EU GDPR data laws, adding to privacy lawsuits OpenAI already faces in the US. The lack of clarity around how the chatbot handles and secures user data is drawing growing regulatory scrutiny.
AWS IAM has added Action Last Accessed support to over 140 services. Action Last Accessed allows admins to see when an IAM identity last accessed an action, which can aid in finding over-privileged identities.
Marvell has denied allegations that its subsidiary, Cavium, backdoored chips for US intelligence. Documents leaked by Edward Snowden in 2013 identified Cavium as a vendor of semiconductors backdoored for US intelligence. The allegations surfaced again in Jacob Appelbaum's PhD thesis, which was published in March 2022.
Sponsored
If you want to scale compliance without overwhelming security and GRC teams, you’re probably looking into compliance automation
VulnCheck has found that around 12,000 Juniper firewall devices exposed on the internet are vulnerable to a recently disclosed remote code execution (RCE) flaw. The vulnerability could be exploited by an unauthenticated and remote hacker to execute arbitrary code on Juniper firewalls without creating a file on the system. It was patched by Juniper Networks last month, but the company warned that it detected exploitation attempts in the wild.
Malwarebytes reports that a malicious Google Ad impersonating the official Webex download portal has managed to garner the top search result spot for the term Webex. The download page includes a fake Webex installer that downloads the BatLoader malware which then downloads the DanaBot credential stealer. A Google spokesperson commented that actions were taken against the account that listed the ads.
The International Criminal Court (ICC) announced a cyberattack on its systems last week and is currently investigating with the Dutch authorities. The extent of the impact is unknown, and the Court is working to ensure its core work continues. The ICC plans to intensify its cybersecurity defense and expedite the adoption of cloud technology.
This blog post discusses security options in OpenAPI and what companies are doing regarding API security. Large companies like Facebook and Github use OAuth2 for API security. The document recommends using OAuth2 for authentication but acknowledges that it can be complex. API keys are still commonly used for security in smaller APIs. Basic authentication is not recommended due to its insecurity.
A tutorial from AWS on creating a centralized, multi-account, and multi-region Security dashboard that aggregates AWS Config and Security Hub compliance scores.
A State Department cybersecurity expert implanted a warning mechanism in 2020 to detect future hacks. It went off in June 2022, alerting the US government to a Chinese hack. The State Department's actions likely prevented Beijing from gaining more extensive access to the private communications of key US officials.
GraphQL-Armor is a dead-simple yet highly customizable security middleware for various GraphQL server engines.
Cobalt Strike 4.9 has been released with new features, including an overhaul to its post-exploitation capabilities, the ability to export Beacon without a reflective loader, support for callbacks in built-in functions, and a new in-Beacon data store. Its post-exploitation capabilities now support prepend-style User Defined Reflective Loaders and updates to Beacon User Data as well as Aggressor Script support for sending and receiving data between Cobalt Strike clients.