Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
XLoader malware has re-emerged without Java dependencies, using native Objective-C/C code and signed as a fake "OfficeNote" productivity app. This post examines the new variant’s technical details and threat hunting indicators.
An article discussing how to reduce complexity in SIEM deployments. This article begins with some symptoms of an overly complex SIEM and then discusses helpful questions to try and reduce the complexity to more manageable levels and regain control of it.
The CYFIRMA research team has discovered a new Malware-as-a-service (MaaS) operator that goes by the moniker EVLF DEV. This threat actor is responsible for the development of CypherRAT and CraxsRAT, which in the last 3 years was purchased by over 100 distinct threat actors on a lifetime license. In this research report, they discuss the MaaS operator and the malware being developed by them.
The latest BloodHound CE release brings useful enhancements, but the tool's Neo4j database also enables powerful custom queries to automatically find Active Directory weaknesses. This post demonstrates examples of querying the database directly or via API to uncover basic flaws and augment BloodHound's graph visualizations and attack path planning.
SWAT is a command line tool that is designed for red teaming Google Workspace environments. The tool maps its functionality closely to the MITRE ATT&CK framework and allows for simulating suspicious adversarial behavior.
Envsec is a tool that securely stores environment variables in the cloud of your choice. It is designed with developer experience in mind to be a pleasure to use. It comes with a command line tool and an accompanying Go library.
Tool for obfuscating and deobfuscating data by searching and replacing sensitive data based on regexes pulled from an inputted file.
Kubernetes version 1.28 is now available. In this version, Validating Admission Policy reaches beta status as a more complex and flexible admission controller than Pod Security Admission. This release also adds an authorization API for users to query data about themselves
In this post, Cris Thomas (AKA Space Rogue) from L0pht Heavy Industries discusses the blurry boundary between researchers and hackers, with researchers being a subset of Whitehats. Thomas believes that researchers take a more formal approach to investigations, whereas hackers hack on stuff and experiment with things to see what breaks and what still works.
Ransomware attacks on US local governments rose in 2022, highlighting risks as cities digitize. Hybrid attacks that start digital and eventually impact physical infrastructure will persist without preparation. Cities must find weaknesses, expect threats, and strategically communicate, both internally and externally, to ensure community resilience and recovery.
The UK has introduced several controversial proposals to try to rein in Big Tech. Some companies are saying there is a “tipping point” where they will leave the market instead of complying. The "tipping point" is upcoming UK regulations like the Online Safety Bill that is due to pass in the autumn.
A new State of SaaS Security Posture Management Report from AppOmni indicates that Cybersecurity, IT, and business leaders alike recognize SaaS cybersecurity as an increasingly important part of the cyber threat landscape.
Uptycs published its quarterly threat bulletin that notes a significant increase in the sophistication and complexity of threats faced by organizations globally. It also notes that in Q2 2023, rundll32.exe was the most abused utility for Windows malware. Crontab was the most abused in Linux, while OpenSSL and curl were prevalent in macOS.
Microsoft's Threat Intel team posted a series of blogs about BlackCat’s new version of its Sphynx encryptor. Among the changes in the new version: popular post-exploitation tools Impakcet and RemCom were bundled with the encryptor.
A security flaw in the popular Windows file archiver WinRAR has been fixed after being reported by a researcher to RARLAB. The vulnerability, tracked as CVE-2023-40477, allowed attackers to execute arbitrary code on a computer by opening a specially crafted RAR archive. This was due to a lack of proper validation of user-supplied data. Users are advised to update their installations to version 6.23 to address the flaw before it is exploited by attackers.
Mandiant reports that it has seen an increase in the use of AI in information manipulation campaigns. The success of these campaigns has been fairly limited thus far.
Jamf published a report detailing methods to make an iPhone on iOS 16 appear to be in airplane mode. The report details modifications to the control center, airplane mode icon, and app network connectivity used to achieve this effect. No iOS vulnerabilities are exploited in this technique
This blog post embarks on the initial stages of kernel exploitation. The content serves as an introduction, leading to an imminent and comprehensive whitepaper centered around this subject matter. Through this, a foundation is laid for understanding how kernel drivers are developed, as well as a basic understanding of key concepts that are instrumental to comprehending the paper itself.
URL encoding converts non-standard characters to valid % escapes so URLs transmit reliably. The purpose of URL encoding is not to hide parts of a URL from an outside observer, but rather to ensure that the URL is easily and unequivocally interpretable by the receiving server and to prevent manipulation of the URL by the user of the client that is constructing and sending the URL.
Fast and customizable vulnerability scanner based on simple YAML based DSL. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, and Headless. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.
ProtoBurp is a Burp Suite extension that enables security researchers to encode and fuzz custom Protobuf messages. The tool allows users to convert JSON data into a Protobuf message, enabling them to fuzz inputs using Burp's Repeater and Intruder tools, as well as proxy traffic from other tools.
A terraform module to send notifications upon manual changes made in the AWS console. These changes could suggest a compromised account or otherwise lead to gaps in infrastructure as code observability.
Chrome 117 will add a new feature to the Privacy and Security setting to highlight extensions that have been removed from the Chrome Web Store along with a reason. The three reasons currently supported are a developer unpublishing the extension, a violation of a policy, or malware. Users can choose to ignore the warning or remove the extension
Despite hype, criminals struggle to use generative AI like ChatGPT for malware, with limited real world usage seen. Research from Trend Micro and Mandiant finds interesting but no groundbreaking criminal uses as AI isn't providing the exploit shortcut hackers hoped for.
A comparison of major security benchmarks against Microsoft Baselines. Only a small fraction deviate, usually redundant or erroneous suggestions undermining security. The analysis revealed ineffective or counterproductive advice in some benchmarks, highlighting the need for rigorous security guidance vetting.
The Flipper Zero is an incredibly popular multi-tool for interacting with digital interfaces. It had faced massive supply issues due to underestimating demand. Flipper Devices have announced that they have ironed out their supply issues and will have more regularly available stock.
CyCognito's report on external exposure reveals majorly exposed surfaces: 74% of assets with PII are exploitable, 70% of web apps have severe security gaps, and 3000+ enterprise web apps are exploitable. The report underscores the risks of unknown digital shadows and the critical need for full attack surface visibility.
Patrick Wardle presented three techniques to bypass macOS' malware detection feature at DEFCON. The Background Task Manager functions by alerting users and third-party security tools when new persistent tasks are installed. Wardle discovered multiple exploit paths, including two that don’t require root access.
More than 4 million people had their sensitive medical and health information stolen after hackers exploited a zero-day vulnerability in the widely used MOVEit file transfer software.
Canadian dental benefits administrator Alberta Dental Service Corporation (ADSC) has started informing roughly 1.47 million individuals about a ransomware attack discovered on July 9 in which their personal information was compromised. The ADSC stated that less than 7,300 records contained personal banking information.
A guide from HashiCorp on monitoring Vault at scale. It covers threats facing Vault, the various logs and data sources available, core metrics, and tips on monitoring and reporting.
This educational post covers dynamic syscall ID extraction using Hell's Gate and C++ to build basic malware as a springboard for more advanced evasion. While open source tools provide some bypass potential, truly effective and subtle red team engagements require custom malware resilient to signature/behavioral detection. Mastering fundamentals like Hell's Gate lays the groundwork for advanced techniques.
Team82 deep dive into how it created a technique to impersonate NAS devices to redirect users to an attacker-controlled device, allowing attackers to access a user’s remote device, steal personal information, and access stored data.
AWS Backup is a feature for backing up and isolating data in the event of a ransomware attack. It allows for a further level of data isolation. This announcement post includes details of how the capability works and how to use it.
noir is an attack surface detector that uses source code analysis to identify frameworks and programming languages used and endpoints. The data can then be made available to tools like Burp Suite or ZAP.
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. It can scan binaries for over 200 common vulnerable components, including openssl, libpng, libxml2, and expat. It can provide lists of known vulnerabilities associated with a Software Bill of Materials or a list of components and versions.