Search the archive

SPICEDB

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

ILLINOIS MAKES IT POSSIBLE TO SUE FOR DOXXING

Illinois has just unanimously passed the Civil Liability for Doxing Act. This law will allow for victims of doxxing recover damages and request a temporary restraining order from their attackers.

THREAT ACTORS USE BETA APPS TO BYPASS MOBILE APP STORE SECURITY

Cybercriminals are using maliciously crafted cryptocurrency investment apps as beta versions to steal cryptocurrency from mobile app stores. The malicious apps are submitted as betas, which are not subjected to a thorough code review process and are only superficially examined for safety. The FBI warns that the apps can be used to steal personally identifiable information, financial account access, and take over devices.

ADAPT

The current economic downturn has affected CISOs. 54% of cybersecurity budgets have been frozen or reduced. Startups have opportunities through cost/customization advantages, though vendors overall need to offer flexibility like free trials. Even in times of financial restraint, cyber remains a priority, and smart vendors can creatively align to needs.

AWS NLBS NOW SUPPORT SECURITY GROUPS

AWS Network Load Balancers (NLBs) allow for load balancing arbitrary traffic in AWS. With this new update, security groups can be applied to NLBs. This allows for more advanced NLB filtering.

HACKING ATMS

Synack Red Team has discovered that French company Iagona's ScrutisWeb ATM monitoring software has several vulnerabilities that could be exploited by hackers to remotely hack ATMs, including check deposit machines and payment terminals. The flaws were patched by the vendor in July 2023 with the release of ScrutisWeb version 2.1.38. The vulnerabilities include path traversal, authorization bypass, hard coded cryptographic key, and arbitrary file upload issues that can be exploited by remote, unauthenticated attackers.

PROVIDER

Home buyers, sellers, real estate agents, and listing websites throughout the US have been stymied for five days by a cyberattack on a California company that provides a crucial online service used to track home listings. A reminder of the real-world disruptions that cyberattacks can impose on large numbers of people or businesses that depend on a service that gets hacked.

WEB-CHECK

Get an insight into the inner-workings of a given website: uncover potential attack vectors, analyze server architecture, view security configurations, and learn what technologies a site is using.

KUBEFUZZ

kubefuzz is a generative and mutative fuzzer for liberating admissions controller chains that works by parsing the cluster API specification. Users can supply constraints to guide the fuzzer’s resource generation.

BLACK HAT USA 2023 SLIDES

Here are all the slides presented at Black Hat USA 2023.

INTRODUCING THE FIRST AWS SECURITY HEROES

The AWS Heroes program recognizes community members that have combined technical expertise and a desire to help the community. AWS has now created a specialized category for Security Heroes.

TFTUI

TFTUI is a textual GUI for terraform. It enables users to view and interact with their complete terraform state tree. Users can also taint or untaint resources directly from the GUI

LEGITIFY

Tool to detect and remediate misconfigurations, security, and compliance issues across GitHub and GitLab assets.

Checkpoint Software acquired Perimeter 81 for $490m. The deal will close in Q3 2023 and integrate Perimeter 81’s solutions into Checkpoint Infinity’s architecture. It follows Perimeter 81 getting accused of a botched disclosure process for a vulnerability found in its macOS application.