> TODAY'S SUMMARY (3 articles)
Cybercriminal activities are intensifying, particularly with the financially motivated group Storm-3358 exploiting the ARTEX framework to target the financial sector. In addition, SonicWall has issued alerts regarding a serious SSL-VPN multi-factor authentication bypass vulnerability, which has been actively exploited in attacks, emphasizing the need for immediate security updates. Meanwhile, Slackware has released new httpd packages to address security issues in its 15.0 and current versions. Organizations are urged to prioritize patching vulnerabilities to mitigate potential threats. Overall, the landscape is marked by increasing sophistication in cyberattacks and a need for robust defense measures.
|
// AI-powered summary generated at 04:00
Another attempt to capitalize on COVID-19 news
Over 7.5 million records published on dark web forum
In this post I will discuss some testing techniques for internal red teams to identify privacy issues in services and infrastructure, most importantly a simple three step approach that might uncover interesting results.
Background story First, let me share a story from the past. When I did my master...
The United States is planning to develop a second, parallel internet from quantum networks
Ex-Florida tax collector indicted for stalking and stealing identity of political rival
Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.
Holland & Knight sued after fraudulent wire transfer nets scammers over $3m
The NSA and CISA say OT assets are being targeted
When stealing IAM credentials from an EC2 instance you can avoid a GuardDuty detection by using VPC Endpoints.
Joint effort will drive greater internet measurements, security and standards in the continent
Some 36 high-profile accounts had messages accessed in recent incident
Finally I got to writing some basic tooling for invoking the Firefox debugging API to send commands to the browser and read the responses. This can be useful for grabbing cookies in the post-exploitation phase.
It works for Windows and macOS, should also work on Linux.
This technique is probably mos...
Suspected ransomware attack puts connected pilot systems out of action
Cloud provider under fire for paying ransom and delayed breach notification
Previously I talked about remotely debugging Chrome, and we also covered the latest Microsoft Edge browser along the way.
These features allow an adversary to gain access to authentication tokens and cookies. See MITRE ATT&CK Technique T1539: Steal Web Session Cookie as well for this.
What about...
Tax Collector’s Office says virus may have caused data breach affecting 450k Polk County residents
All nationally chartered US banks may now provide custody services for crypto-currencies
A technique on Windows that is less known is how to do basic port-proxying.
Proxying ports is useful when a process binds on one (maybe only the local) interface and you want to expose that endpoint on another network interface.
Let’s say you have an existing process that listens only on the loopbac...
Researchers expose malicious cyber-operation involving 29 fraudulent photo apps
Security leaders dissatisfied with current cyber insurance offerings