Search the archive

For over three years, the download site freedownloadmanager[.]org surreptitiously distributed malware to Linux users by occasionally redirecting them to a malicious domain.

MGM RESORTS REPORT A CYBERSECURITY ISSUE

Hotel and casino giant MGM Resorts has confirmed a “cybersecurity issue” is to blame for an ongoing outage affecting systems at the company’s Las Vegas properties.

ACTIVE NORTH KOREAN CAMPAIGN TARGETING SECURITY RESEARCHERS

North Korean threat actors have been targeting security researchers for the past two and a half years using 0-day exploits. Google’s Threat Analysis Group has tracked and disrupted campaigns from these actors and recently discovered a new campaign likely from the same actors. The threat actors used social media sites to build rapport with their targets before sending a malicious file that contained at least one 0-day in a popular software package.

SPYWARE

Several malicious Telegram clones for Android on Google Play were installed over 60,000 times, infecting people with spyware that steals user messages, contact lists, and other data.

DEVICES

Advanced Persistent threat actors were found to have exploited two vulnerabilities, CVE-2022-47966 (Zoho Suite) and CVE-2022-42475 (FortiOS devices), to gain unauthorized access and establish persistence on an organization's network. The Cybersecurity and Infrastructure Security Agency and co-sealers have released a joint Cybersecurity Advisory to provide network defenders with tactics, techniques, and procedures, IOCs, and methods to detect and protect against similar exploitation.

7 WAYS TO ESCAPE A CONTAINER

A blog post containing 7 different techniques that an attacker could use to escape from a container boundary. Each technique includes a list of required Linux capabilities for the attack, a description of the attack, an example command to launch a vulnerable container, and an example command to escape the container.

WORKFLOWS

The recommended method for pinning GitHub Actions per GitHub is to pin the action to a full commit hash which causes the tarball of the action to be downloaded. However, some actions can still be exploited through supply chain attacks if they depend upon unpinned external dependencies (docker containers, other actions, etc). A total of 32% of the top started actions were deemed unpinnable. This article concludes with advice to mitigate unpinnable action attacks

CODE VULNERABILITIES PUT PROTONMAIL AT RISK

A blog post from the Sonar research team detailing their findings in Proton Mail. The post includes an in-depth breakdown of the vulnerability that they discovered and the patch that was issued.

FLIGHTSIM

flightsim is a tool to help security teams generate malicious traffic to test security controls and network visibility. It can test for a variety of different malicious traffic patterns.

SEMGREP-RULES

A collection of Semgrep rules that apply to HashiCorp products. This repository is a work in progress and currently only includes rules for terraform.

CHEPY

Chepy is a pure Python implementation of the features of Cyberchef utility. It preserves the ability to stack various actions together. While it lacks Cyberchef's magic function, it has a lot of features that could be desirable for security researchers.

US CYBER BOARD TO INVESTIGATE MICROSOFT HACK OF GOVERNMENT EMAILS

A U.S. review board tasked with investigating major cybersecurity incidents said it will begin looking at the recent intrusion of U.S. government email systems provided by Microsoft, whose handling of the incident drew ire and scrutiny from federal lawmakers and the wider security community.

TWO REAL-LIFE EXAMPLES OF WHY LIMITING PERMISSIONS WORKS

A blog post from the AWS Customer Incident Response Team detailing two cases that they worked on. In both of these cases, real-world examples of least privilege are given in actual customer environments.

CLOUD DETECTION AND RESPONSE NEEDS TO BREAK DOWN BOUNDARIES

A post that partially leverages the Crowdstrike “Nowhere to Hide” threat hunting report to analyze the current state of cloud detection and response. It notes that many modern attacks and breaches leverage credentials to pivot between systems (such as IDPs, cloud environments, and CI/CD environments). However, most tooling is siloed to a specific environment. The post argues that tooling needs to adapt to these more complex environments and provides advice for teams.

WEEK?

The University of Michigan was without internet for a large part of last week. CTO of SensCy Dave Kelly said that proactively taking down systems pointed to a security breach. Some sources said that the university found malware in its WiFi network.

VITALIK BUTERIN’S X ACCOUNT HACKED, LEADING TO $691K IN LOSSES

Vitalik Buterin, Ethereum’s co-founder, allegedly had his X account compromised. According to prominent blockchain investigator ZachXBT, the incident has led to victims collectively losing over $691,000 after clicking on a malicious link.

THE INTERNATIONAL CRIMINAL COURT WILL NOW PROSECUTE CYBERWAR CRIMES

The International Criminal Court's lead prosecutor, Karim Khan, has announced that the Hague will investigate and prosecute cybercrimes that potentially violate the Rome Statute, including war crimes, crimes against humanity, and genocide. The ICC will collect and review evidence of hacking that impacts critical infrastructure such as medical facilities or control systems for power generation.

EXPERTS FEAR CROOKS ARE CRACKING STOLEN LASTPASS KEYS

A steady trickle of cryptocurrency heists targeting security-conscious tech professionals has led some to believe that LastPass Vaults that were involved in the November 2022 breach were cracked. Taylor Monahan, lead product manager of MetaMask, documented the heists on X and notes that the victims of the cryptocurrency schemes are unique in that they have not suffered from any of the attacks (such as email compromise) that tend to predate these attacks. More details and interviews are presented in the article.

THE WILD

Two zero-day vulnerabilities fixed by Apple in emergency security updates were exploited to deploy Pegasus commercial spyware onto fully patched iPhones through iMessage. The attackers were able to infect iPhones without victim interaction by sending PassKit attachments containing malicious images. Apple and Citizen Lab are encouraging device updates and the activation of Lockdown Mode for those at risk of targeted attacks.

Ticketing services agency See Tickets has notified more than 300,000 individuals that their payment card data was stolen in a new web skimmer attack. The ticketing services agency also notes that it has no evidence to suggest that the stolen personal information was fraudulently used. However, such data is typically shared between cybercriminals and used to perform various types of fraud.

Security researcher Nea Paw has created a fully autonomous AI disinformation system called CounterCloud using existing AI tools. The CounterCloud AI system can scrape, generate, and distribute AI-generated disinformation tweets and articles. This research project has not been made publicly available and all tweets and articles have been kept private. Experienced journalists who received access to the generated content reported that it seemed very realistic.

GETTING STARTED WITH ETHICAL HACKING SERIES

Ethical hacking refers to the process of identifying and exploiting vulnerabilities in computer systems, networks, and applications with the intention of improving their security. This series dives into how anyone can get into ethical hacking.

ACCOUNTS

In a post-mortem report, Microsoft revealed how hackers stole a cryptographic consumer key and used it to forge tokens for Outlook.com and Outlook Web Access. The key was stolen from a software dump that was created when a Microsoft computer crashed. Microsoft has now fixed the bugs that allowed the breach to happen, but users should still be vigilant and take steps to protect their accounts.

ETERNALHUSH FRAMEWORK

The EternalHush Framework is an open-source advanced C2 framework designed for Windows machines. The framework includes an extensible Python API and plugin ecosystem. It also includes a GUI to simplify controlling and collecting data from infected machines

TARTUFO

tartufo searches through git repositories for secrets, digging deep into commit history and branches. Effective at finding accidentally committed secrets, tartufo also can be used by git pre-commit scripts to screen changes for secrets before they are committed to the repository.

THREATINGESTOR

ThreatIngestor can be configured to watch X, RSS feeds, sitemap (XML) feeds, and other sources, extract meaningful information, such as malicious IPs/domains and YARA signatures, and send that information to another system for analysis.

IT’S OFFICIAL: CARS ARE THE WORST CATEGORY WE HAVE EVER REVIEWED

The *Privacy Not Included team at Mozilla has released its review of privacy features of major car brands and concluded that every single one of the 25 car brands failed to meet their privacy standards. All of the brands collect too much data, 92% give little to no control over data collection to users, and 84% admit to selling that data. Tesla and Nissan scored the worst on the privacy tests and Renault and Dacia scored the best.

ROOT

Android 14 tightens control of trusted certificates, blocking modification even on rooted devices, continuing the shift from openness towards locked-down vendor control. This creates challenges for developers, testers, and reverse engineers by requiring direct certificate authority control.

STATE OF THE VIRTUAL CISO 2023 REPORT

The State of the Virtual CISO Survey Report provides insights on vCISO adoption trends and challenges among 200 MSP/MSSP security leaders. It reveals drivers and blockers for the growing vCISO model, helping MSPs/MSSPs evaluate and overcome hurdles to offering security leadership services.

DEFENSIVE SECURITY IS A GLACIER

A thought piece that compares defensive security to a glacier in the sense that it is a colossal, slow-moving machine. The article gives some examples of major milestones in security and argues that they were all done by large corporations/governments and could not have happened sooner no matter what individuals did. It concludes that in defensive security, individuals must focus on smaller changes and wins than on large scale change.

'FEASIBLE'

The UK dropped mandatory messaging scanning from its Online Safety Bill after tech industry backlash, but clauses remain, passing the issue to future governments when "technically feasible." A bare minimum concession, the core controversy continues unresolved.

HOW CHINA GETS FREE INTEL ON TECH COMPANIES’ VULNERABILITIES

China's 2021 law mandates that tech companies operating in the country disclose hackable flaws in their products to the government. Some foreign firms with operations in China appear to be complying, potentially giving Chinese state-sponsored hackers an advantage in exploiting these vulnerabilities, raising cybersecurity concerns.

GRAFANA SECURITY UPDATE

Grafana released an alert that one of its GPG private keys and passphrases was leaked. In response it has revoked the affected certificate and users will need to update their GPG trust relationships if they utilize package repositories.

4,500 OF THE TOP 1 MILLION WEBSITES LEAKED SOURCE CODE, SECRETS

Security researchers collaborated to scan the Alexa Top 1 Million Websites for leaked secrets and discovered that 4,500 of the most heavily visited websites in the world publicly exposed their git directory, which often contained the entire private source code for a given website. AWS and GitHub keys accounted for 45% of all leaked credentials and third-party email marketing services accounted for a large percentage of the leaked keys.

ALL FREECYCLE USERS IMPACTED BY DATA BREACH

Freecycle.org, a platform that allows users to recycle their belongings, has prompted millions of users to reset their passwords after credentials were compromised in a data breach. The breach of data includes usernames, User IDs, email addresses, and passwords.

HUNTING C2S WITH NUCLEI

This is a blog post detailing a method to repurpose Nuclei, a common DAST tool, for threat hunting. The author outlines the steps that they used through other tools and manually to threat hunt and then the high-level process for automating their process with Nuclei. The post also includes an example of hunting for Nimplant.

REVISTING BLISTER: NEW DEVELOPMENT OF THE BLISTER LOADER

BLISTER, a malware loader associated with financially-motivated intrusions has been growing over the last two years under the radar. It now integrates techniques to remove any process instrumentation hook. BLISTER has modified its configuration with multiple revisions, now encompassing additional fields and flags. This post dives into the advancements of BLISTER.

USING OPEN-SOURCE SOFTWARE COMPOSITION ANALYSIS TOOL FROM GOOGLE

This article dives into how you can set up and configure osv-scanner, an open source SCA tool, to identify vulnerabilities in popular open source projects.

STRATUS-RED-TEAM

Stratus-red-team is a tool for emulating offensive attack techniques in a controlled manner on cloud environments for the purpose of testing detection and response. Attacks are organized by cloud provider and category of attack. Each attack has a comprehensive wiki page with a MITRE ATT&CK mapping, description, and example detections. The recently released v2.9.0 includes new techniques for ransomware simulation.

CALDERA-OT

A collection of plugins that extend Caldera (adversary emulation platform) to the Operational Technology (OT) environment.

MERCATOR

Mercator is an Open Source web application to manage the mapping of an information system as described in the Mapping The Information System Guide of the ANSSI.

GETTING INTO AWS CLOUD RESEARCH

A comprehensive guide to beginning to research AWS cloud security. The guide suggests ways to gain more foundational knowledge, leaders in the field to follow, and different ways to dive deep. The guide concludes with reporting methods and assorted tips.

COST OF A DATA BREACH REPORT 2023

IBM's 2023 installment of their annual "Cost of a Breach" report has brought up some interesting trends such as the average cost of a breach rose once again to $4.45 million, increasing 15% over the last three years. It also has an industry-specific focus and breakdown of breaches.

POP-UPS

A security researcher who asked to be referred to as only Anthony demonstrated an attack using a Flipper Zero where a small device can be programmed to perform wireless attacks on devices in its range, such as iPhones, as well as car keyfobs, contactless and RFID cards, and more.

OKTA CROSS-TENANT IMPERSONATION: PREVENTION AND DETECTION

Threat actors are using social engineering to convince IT desk personnel to reset multifactor authentication (MFA) for highly privileged Okta enterprise accounts, gaining access to the cloud-based identity access management (IAM) service and moving laterally through targeted networks from there. Okta warns about how common this threat is and how to prevent it.

MULTIPLE NOTEPAD++ FLAWS LET ATTACKERS EXECUTE ARBITRARY CODE

Several Buffer Overflow vulnerabilities have been discovered in Notepad++ that can be exploited by threat actors for malicious purposes.

CHROME EXTENSIONS CAN STEAL PLAINTEXT PASSWORDS FROM WEBSITES

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

DOXXING NEARLY ANYONE IN AMERICA FOR $15

An investigation from 404 Media details a category of bots that utilizes credit headers to dox nearly anyone in America. Hackers seem to have acquired access to this data and are selling it for $15-$40. 404 Media has confirmed that at least some of the extensive data is accurate. Data that the tool provides include addresses, mobile phone numbers, email addresses, driver's license numbers, and even names and birth years of the target’s relatives.