Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
CrowdStrike, a cybersecurity vendor, has announced plans to acquire Bionic, a Silicon Valley startup that sells tools in the Application Security Posture Management (ASPM) category. The cash-and-stock transaction is valued at around $350 million, allowing CrowdStrike to enhance its enterprise cloud security portfolio.
This article talks about the various risks and penalties of not complying with various cybersecurity best practices or compliance frameworks. Non-compliance in cybersecurity can lead to several risks, including vulnerability to cyberattacks, data breaches, and damage to a company's reputation. While non-compliance with legal frameworks like HIPAA and GDPR can result in severe penalties, including substantial fines and legal action, not implementing adequate controls required by these frameworks also often leave systems vulnerable to cyberattacks.
Mike Privette presents 25 lessons that he’s learned from his 17 years in the cybersecurity industry. The lessons range from observations about the industry, career development, to cybersecurity culture and conferences. He concludes with some takeaways.
The NIST has released its draft of the updated Cybersecurity Framework. After a decade, the NIST has updated the Cybersecurity Framework to reflect the changing cybersecurity landscape. The scope of the five existing pillars has been expanded and a sixth pillar, govern, has been added. The post claims that it is unlikely to fundamentally improve the nation's cyber posture.
A trove of documents from the Xbox vs FTC court case have been leaked. The documents detail confidential business secrets on acquisitions and product roadmaps. The FTC reports that Microsoft is responsible for the leak.
The recent cyber attack on Clorox is still affecting the supply of its cleaning products. The company has taken some of its systems offline and implemented additional security measures. It has engaged third-party cybersecurity experts to investigate the incident.
Microsoft has reported that an Iranian cyber espionage group, tracked as Peach Sandstorm but known otherwise as Holmium, APT33, or Elfin, targeted organizations in the satellite, defense, and pharmaceutical sectors. The group compromised dozens of entities, exfiltrated data from a subset, and gained access using password spray attacks. The campaign began in February and targeted thousands of organizations.
From 2020 until 2022, a random sampling of users downloading the Free Download Manager software received a Trojan horse version of the app. The malicious software has a collector backdoor that collects secrets from systems and then utilizes another backdoor to download an uploaded script from a C2 and periodically upload the stolen secrets. IOCs are included in the article.
Researchers from Checkmarx discovered a new method to exploit a race condition in the GitHub retired namespaces protection process to repojack popular repositories. Repojacking is an attack where an attacker sets up a malicious mirror of a GitHub repository that was renamed with the goal of impersonating the old repository. To prevent these attacks, GitHub enabled a protection to automatically retire popular repository namespaces when they are renamed. However, attacks such as this one bypass this protection.
This document provides an in-depth analysis of TPM-based BitLocker Drive Encryption, which is a feature in Windows that allows users to encrypt their hard drives. It explains how the BitLocker keys are stored and how they are accessed using the TPM. Additionally, the author describes a vulnerability in BitLocker that allows attackers to bypass the encryption and provides a detailed explanation of how the attack works.
A vulnerability in Facebook/Meta's Canvas on the Comet platform could allow account takeover if a user plays a malicious Canvas game. The issue stems from Compat iframes used for OAuth dialogs. A malicious game could exploit cross-window messaging with the parent window to set up a rogue communication channel and take over the account. This blog post explains how the exploit works with examples.
Terraform’s remote-exec provisioner is a powerful tool that allows for executing commands on a remote server to configure it. However, without proper guardrails, this can pose security risks such as data exfiltration. This article features an example and discusses some mitigations.
Dropbox has released this repository of prompt injection example scripts for educational purposes to understand how to attack LLMs and learn how to defend against these types of prompts.
Invictus-AWS is a standalone Python script to enumerate relevant data and services in an AWS account.
Pynt is a security testing solution that automates security testing for developers and testers, enabling effortless vulnerability discovery and mitigation throughout the SDLC. It has raised a $6 million seed funding round.
The National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) have released a Cybersecurity Information Sheet (CSI) on deepfake threats. The CSI provides an overview of synthetic media threats, techniques, and trends. It includes recommended steps and best practices for organizations to prepare, identify, defend against, and respond to these threats.
Meta's Native Assurance team found a vulnerability in the Meta Quest 2's Android OS that could have allowed arbitrary code execution with system privileges by exploiting memory corruption over IPC. Though it never reached production, the vulnerability highlighted improvements needed in Quest security. Meta shares its review process to demonstrate its commitment to secure product development.
An article from AWS outlining some of the DDoS options offered by AWS as well as the options and processes for running DDoS simulations on AWS. Users have the option of running a simulated DDoS attack through an approved partner or a synthetic simulated DDoS attack with the AWS Shield Response Team.
A new possibly North Korean group named Konni has entered the ransomware game. It recently started to employ new techniques using WinRAR vulnerabilities to exploit for cryptocurrency.
The CISA has announced a new program offering free vulnerability scans for public water utilities. The program will install scanners in the organizations and send weekly scan reports with vulnerabilities and recommendations.
Scattered Spider, a cybercrime group known for social engineering attacks, has hit over 100 organizations and recently deployed ransomware in attacks. Mandiant reports they are expanding beyond telecom and outsourcing into hospitality, retail, media, and finance. Mitigations include monitoring for phishing links, credential theft, and ransomware.
Sponsored
If compliance matters to your organization, it can’t be an afterthought. Modern GRC teams shouldn’t be scrambling to collect evidence and generate reports before an audit. What’s the alternative? The best organizations partner with Drata
Meduza co-founder Galina Timchenko's phone was infected with Pegasus spyware, making her the first Russian journalist to be targeted. The software is marketed exclusively to state clients for use against criminals, but has been used to target journalists, activists, and politicians around the world. Meduza worked with experts to investigate the attack and learn which states may have spent millions of dollars to hijack Timchenko's phone.
Cybercrime crew BianLian says it has broken into the IT systems of top nonprofit Save The Children and stolen a ton of files, including what they claim is financial, health, and medical data.
A new phishing campaign is sending malicious attachments that install the DarkGate malware loader via Microsoft Teams. The article contains more details about the obfuscation and detection evasion mechanisms that the malware uses.
A very thorough tutorial on the unintuitive process to enforce DNS name constraints in an AWS private CA. The post includes sample code and tests to verify the constraints.
Akamai details the newly released CVE-2023-3676 which is a command injection vulnerability in Kubernetes on Windows hosts. This article details the vulnerability and provides a proof-of-concept YAML file, a method to check if you’re vulnerable, and an OPA rule to block the vulnerability.
This article comprehensively discusses the risks associated with building product features using third-party Large Language Model APIs and offers controls available to mitigate these risks. The article also suggests traditional governance, risk, and compliance controls, as well as provides a lot of reference material on the topic.
NTLM over SMB is commonly used when attacking Windows domains in attacks such as pass-the-hash or password cracking. In a new update, Windows 11 will allow administrators to block NTLM responses over SMB to prevent hashes being leaked to external servers. Previously, the only way to achieve this was to disable NTLM completely
Google has announced that all Chromebooks will receive regular automatic updates for 10 years, making them the most updated operating system available. The platform encourages the use of renewable materials, with plans to use more post-consumer recycled materials for future models. The company also aims to make repair processes quicker and more energy-efficient with new features such as adaptive charging and battery saver.
CyberCatch has launched an SEC Compliance Manager solution to enable compliance with the SEC's new Cybersecurity Incident Reporting and Risk Management Rule. The new rule mandates reporting and disclosure of a material cybersecurity incident within four business days and disclosure of cybersecurity risk management, strategy, and governance, including board oversight over cybersecurity risk management.
CISA has released a roadmap outlining its Open Source Security strategy. The roadmap outlines what CISA’s role is in the space, how CISA plans to outline key dependencies, and how CISA plans to reduce risk to the government and consumers.
A significant vulnerability in the WebP Codec affecting the heap buffer overflow has been unearthed, prompting major browser vendors, including Google and Mozilla, to expedite the release of updates to address the issue.
The Sonar Research team discovered and responsibly disclosed code vulnerabilities in Skiff's web client that would allow attackers to steal decrypted emails and impersonate victims if they interacted with malicious messages. This article provides technical details of the vulnerabilities found and advice on how to avoid such vulnerabilities in code.
Retool faced an unauthorized access issue involving 27 cloud customers due to a spear-phishing attack via text message. The breach started with an employee's compromised Google account, underscoring the need for employee training and strong defense measures.
The ALPHV/BlackCat ransomware group took responsibility for the MGM Resorts cyber outage on Tuesday, claiming that the conversation that granted initial access took just 10 minutes.
With an unprecedented 70 zero-day vulnerabilities uncovered so far in 2023, apps are being patched at a rapid rate. Apple, Microsoft, Google, Mozilla, Adobe, and Cisco have all been affected, and this month the number of zero-days tracked has been considerably higher than the monthly average.
Hackers are using a massive network of fake and compromised Facebook accounts to send out millions of Messenger phishing messages to target Facebook business accounts with password-stealing malware, ultimately compromising one out of every seventy accounts targeted.
Wyze alleges that a “web caching issue” led to a period of 30 minutes where owners of Wyze cameras logged into the web portal were able to view other users’ cameras. The site was quickly put into maintenance mode to fix the issue.
Hackers stole $41 million worth of cryptocurrencies from Stake.com, an online casino and sports betting site. The FBI has attributed the attack to North Korea's Lazarus Group. The Lazarus Group is known for high-profile hacks worth over $1 billion. It is responsible for stealing over $200 million in crypto this year alone.
The Amazon Search team needed to build systems that could withstand Prime Day levels of traffic at 84k requests/second. It heavily utilized Chaos Engineering to test fault tolerance to ensure system stability. This post discusses the Chaos Engineering Orchestrator the team built as well as general Chaos Engineering methodology.
This article explores the multifaceted landscape of safeguarding data, identities, networks, and services in cloud environments. The key security considerations discussed include data vulnerability, identity and access management, vulnerability management, and cloud service provider evaluation. The article also talks about employee training and awareness, continuous monitoring, and incident response.
Large language models present security and privacy risks that must be addressed when implementing them in an organization. This guide explores the top risks and strategies to mitigate them. Top risks include supply chain vulnerabilities and overreliance on LLM-generated content. Mitigation strategies include implementing strict input validation, data sanitization procedures, and rigorous data validation and cleaning processes.
A collection of tools, tutorials, and other resources for the Flipper Zero hacking tool.
A yara ruleset from Sentinel Labs to detect potentially malicious code in macOS samples.
AttackGen uses a Large Language Model via LangSmith and the comprehensive MITRE ATT&CK framework to generate tailored incident response scenarios based on user-selected threat actor groups and organization details.
An article bringing awareness to the mental health challenges that cyber professionals face. The article includes statistics and testaments that discuss the elevated levels of stress that many employees face and includes some ways that organizations are seeking to combat it.
HijackLoader is a modular malware loader known for its evasion techniques and flexibility in loading malicious payloads. While it doesn’t possess any advanced features, it uses various tactics, such as syscall evasion and delayed code execution, to avoid detection by security solutions.
New research by Sonatype shows that 97% of surveyed developers and application security leaders are using generative AI in software development. 74% of respondents feel pressured to use AI, despite the security risks associated with the technology.
Spurred on by the Russia-Ukraine war, hacktivism is making a comeback. This article analyzes the current state and likely future of hacktivist activity.