> TODAY'S SUMMARY (3 articles)
Cybercriminal activities are intensifying, particularly with the financially motivated group Storm-3358 exploiting the ARTEX framework to target the financial sector. In addition, SonicWall has issued alerts regarding a serious SSL-VPN multi-factor authentication bypass vulnerability, which has been actively exploited in attacks, emphasizing the need for immediate security updates. Meanwhile, Slackware has released new httpd packages to address security issues in its 15.0 and current versions. Organizations are urged to prioritize patching vulnerabilities to mitigate potential threats. Overall, the landscape is marked by increasing sophistication in cyberattacks and a need for robust defense measures.
|
// AI-powered summary generated at 04:00
PM urges organizations across sectors to improve cyber-resilience
The Shadowbunny TTP in the PenTest Magazine The latest edition of the PenTest Magazine features an article of mine about using virtual machines (VMs) during lateral movement to establish persistence and evade detections.
A few years back when I came up with the idea of using VMs for lateral movement...
US takes action against Nigerians who targeted Americans with email scams
Report shows espionage group has enhanced its capabilities
As a company, we believe Black lives matter. In the face of continued police brutality, racial disparities in law enforcement, and limited accountability, we demand an end to systemic racism, endorse restrictions on police use of force, and seek greater accountability for police actions. We believe...
FCC advised to partially deny cable system linking US with Hong Kong over security concerns
UK government puts privacy first, chooses decentralized COVID contact-tracing app model
Some organization have this interesting concept of a bug jail to prevent new feature development when there are too many existing flaws in the system.
For instance, if an engineer has 5 or more bugs assigned they aren’t allowed to work on anything else but fixing their bugs.
What is the Security Bug...
Report highlights data privacy and protection risks and failures made by the police
Digital Shadows finds site moderators in high demand
Upgradeable contracts are not as safe as you think. Architectures for upgradeability can be flawed, locking contracts, losing data, or sabotaging your ability to recover from an incident. Every contract upgrade must be carefully reviewed to avoid catastrophic mistakes. The most common delegatecall p...
Virus-themed phishing and malware threats are branded outliers
Video conferencing platform reverses controversial decision
The elliptic curve digital signature algorithm (ECDSA) is a common digital signature scheme that we see in many of our code reviews. It has some desirable properties, but can also be very fragile. For example, LadderLeak was published just a couple of weeks ago, which demonstrated the feasibility of...
C-Suite executives suffer fewer Business Email Compromise attacks as new target pummeled
Gaming-related web attacks increased by more than 50% in April
Monte Carlo simulations can be a useful tool to uplevel your red teaming skills and provide a different and fresh perspective for highlighting, discussing and presenting findings.
Red teaming is about challenging an organization. This includes analyzing business processes and methodologies, includin...
Evanston tech CEO charged with lying to obtain a $400k forgivable COVID-relief loan
Half of mobile banks are vulnerable to fraud and theft of funds
TL;DR: Can we check if a mutex is locked in Go? Yes, but not with a mutex API. Here’s a solution for use in debug builds. Although you can Lock() or Unlock() a mutex, you can’t check whether it’s locked. While it is a reasonable omission (e.g., due to possible race conditions; see also Why […]