> TODAY'S SUMMARY (3 articles)
Cybercriminal activities are intensifying, particularly with the financially motivated group Storm-3358 exploiting the ARTEX framework to target the financial sector. In addition, SonicWall has issued alerts regarding a serious SSL-VPN multi-factor authentication bypass vulnerability, which has been actively exploited in attacks, emphasizing the need for immediate security updates. Meanwhile, Slackware has released new httpd packages to address security issues in its 15.0 and current versions. Organizations are urged to prioritize patching vulnerabilities to mitigate potential threats. Overall, the landscape is marked by increasing sophistication in cyberattacks and a need for robust defense measures.
|
// AI-powered summary generated at 04:00
Nation state attackers shift from financial theft and gain to stealing user credentials
Dark web traders selling personal data and cracked passwords
Chart of the IAM unique ID prefixes.
IBM finds remote work increases financial impact and incident response
Tanium study also reveals a quarter stopped patching
In this post I will discuss some testing techniques for internal red teams to identify privacy issues in services and infrastructure, most importantly a simple three step approach that might uncover interesting results.
Background story First, let me share a story from the past. When I did my master...
Dangerous Integrated Dell Remote Access Controller vulnerability detected and fixed
State-sponsored threat group is big-game hunting with VHD ransomware
Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.
Survey finds lack of executive accountability is main reason security pros want to quit
No More Ransom has prevented an estimated $632m reaching criminals
When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.
Garmin admits it suffered encrypting cyber-attack last week
86% of IT experts believe monitoring for cybersecurity threats will become more challenging due to increase in SaaS apps
Finally I got to writing some basic tooling for invoking the Firefox debugging API to send commands to the browser and read the responses. This can be useful for grabbing cookies in the post-exploitation phase.
It works for Windows and macOS, should also work on Linux.
This technique is probably mos...
Unsecured cloud server discovered by researchers
QSnatch has infected over 60,000 devices globally
Previously I talked about remotely debugging Chrome, and we also covered the latest Microsoft Edge browser along the way.
These features allow an adversary to gain access to authentication tokens and cookies. See MITRE ATT&CK Technique T1539: Steal Web Session Cookie as well for this.
What about...
Redscan data finds many are failing on security training and testing
The CEO of a bankrupt Crystal City tech firm has been charged with investment fraud