# Latest Podcast
# Description
# Tradecraft
[#]
Credential exposure in front-end code poses severe risks, and recommending systematic secure coding practices, regular training, code reviews, and automated scanning tools like Ferret can mitigate these vulnerabilities.
[#]
The article discusses vulnerabilities with Linux character devices, particularly with the systemd-run and pkexec commands, showing how low-privileged users can exploit pseudo-terminal (pty) allocations to interact with high-privileged processes and suggests using chown to restrict access as a mitigation.
[#]
CVE-2023-46012 is a critical vulnerability in Linksys EA7500 routers, allowing remote code execution with root privileges via a buffer overflow in the UPnP service; users should disable UPnP or use a firewall to block incoming UPnP traffic until a patch is available.
[#]
The tool allows you to create custom wordlists for dictionary attacks using a UI, language-specific fine-tuning, and publicly available target information, generating millions of words in seconds.
[#]
This website offers a comprehensive resource for OSINT (Open Source Intelligence) and i3 (Internet Intelligence & Investigations), listing various tools and sites for investigators to gather information and conduct investigations.
[#]
The code provided demonstrates an exploit for CVE-2024-27804 using a combination of AVFoundation and IOKit frameworks to cause a kernel panic on Apple M1 devices by manipulating video decoding and flipping bits in kernel memory.
[#]
PingRAT is a tool that covertly bypasses firewalls by using ICMP payloads for Command and Control, making it largely undetectable by most antivirus and endpoint detection systems.
[#]
AWS Trail Recon analyzes permissions of a leaked AWS key by using CloudTrail:LookUpEvents, with tools available in Python and Bash versions, and improvements such as better output formats and low-profile arguments planned.
[#]
This article explains the memory internals of Hyper-V EXO partitions, how they differ from full VMs, and how to access and manage these partitions using Windows Hypervisor Platform APIs and other tools.
[#]
Response Filter Denial of Service (RFDoS) can disable a website by leveraging WAF rules through specific input strings, requiring a review of response body rules and their configurations to avoid such attacks.
# News
[#]
The Ebury botnet has compromised nearly 400,000 Linux servers since 2009, using techniques like credential stuffing and exploiting software vulnerabilities, with recent attacks targeting hosting providers and utilizing obfuscation to evade detection.
[#]
Hackers are spreading malicious Android apps disguised as popular services like Instagram and Snapchat, which can steal personal data by requesting inappropriate permissions; avoid this by downloading apps only from official sources and checking permissions carefully.
[#]
Apple has released security updates to fix a zero-day vulnerability (CVE-2024-27834) in Safari, exploited at Pwn2Own Vancouver, that allowed remote code execution and bypassed Pointer Authentication on macOS Monterey and Ventura.
[#]
Sorry, the file you have requested does not exist. Make sure that you have the correct URL and the file exists.
Get stuff done with Google Drive. Apps in Google Drive make it easy to create, store, and share online documents, spreadsheets, presentations, and more. Learn more at drive.google.com/start/apps.
[#]
VMware has announced that Fusion Pro and Workstation Pro are now available for free personal use but require a paid subscription for commercial use; users can download the latest builds at support.broadcom.com.
[#]
A series of cybersecurity incidents and frauds have occurred involving cryptocurrency exchanges, influencers, and platforms, highlighted by Rain's $14.8 million hack, ZKasino's $33 million rug pull, and Hedgey Finance's $45 million flash loan attack.
[#]
VMware has patched severe security flaws in Workstation and Fusion products, urging users to update to versions 17.5.2 and 13.5.2 to fix issues related to Bluetooth, 3D graphics, and information disclosure.
[#]
The FCC has classified an international robocalling gang called "Royal Tiger" as a Consumer Communications Information Services Threat, aiming to prevent their fake automated calls impersonating government agencies, banks, and utilities from reaching U.S. telecommunications networks.
[#]
ESET reported that Ebury malware has compromised around 400,000 Linux servers over the past decade, stealing cryptocurrency and sensitive data, with mitigation strategies including monitoring SSH activity, checking for modified libkeyutils.so files, and using advanced EDR solutions.
[#]
Telegram CEO Pavel Durov claims Signal has ties to the US government and alleges its encryption isn't secure, though there is no presented evidence to support these claims.
[#]
SAP released patches for critical flaws in CX Commerce, NetWeaver, and other products, advising customers to apply updates immediately.
[#]
Zscaler confirmed that an isolated test server was hacked, impacting no customer, production, or corporate data, after an independent investigation.
[#]
The Matrix Cup, a Chinese hacking contest sponsored by Qihoo 360 and Beijing Huayun’an Information Technology, is offering $2.5 million in rewards for exploits targeting various technology products, mainly from the West, with zero-day vulnerabilities to be disclosed to vendors.
[#]
Christie's auction house is experiencing a cyber attack, which has taken its website offline, impacting online viewing of items worth $840m, with bids still being accepted by phone and in person.
[#]
A malicious fork of the legitimate “requests” Python package called "requests-darwin-lite" was found on PyPI containing a backdoor hidden in a PNG file, which was detected and removed after being downloaded 417 times.
[#]
A new Chrome zero-day vulnerability, CVE-2024-4761, affecting the V8 JavaScript engine, is actively being exploited and users should update their browser to version 124.0.6367.207/.208 for Windows and macOS, and 124.0.6367.207 for Linux to mitigate risks.
[#]
Foxit PDF Reader users are being targeted by a new exploit that deceives them into executing harmful commands due to default "OK" options, causing the download and execution of malicious files; users should stay current with system updates and be cautious with unexpected emails containing links.
[#]
Broadcom has released patches for critical VMware vulnerabilities (CVE-2024-22267, CVE-2024-22268, CVE-2024-22269, CVE-2024-22270) that can lead to code execution and data leaks, urging immediate updates to Workstation 17.5.2 and Fusion 13.5.2.
[#]
Google and Apple will release an anti-stalking feature for Android and iOS, alerting users if a hidden Bluetooth tracker is following them and providing tools to disable it.
[#]
Google has patched a Chrome zero-day vulnerability, CVE-2024-4671, that is a "use after free" bug, highlighting ongoing issues with memory management in C-based programming languages.
[#]
Apple released a security patch for iTunes on Windows, addressing CVE-2024-27793, which involves unexpected app termination and arbitrary code execution.
[#]
SAP released security patches, including one for a critical vulnerability (CVE-2024-33006) in SAP NetWeaver that could lead to system takeover; organizations should apply these patches immediately.
[#]
Three critical vulnerabilities in Arcserve UDP software have proof of concept code released, prompting the NHS and cybersecurity experts to urge immediate patching and heightened monitoring to prevent potential exploitation.
[#]
Anthropic launched its AI chatbot, Claude, in Europe, offering advanced multilingual support and secure AI capabilities amid regulatory challenges.
[#]
Security researchers found critical vulnerabilities in Cinterion cellular modems that could let attackers remotely control IoT devices, urging organizations to update and secure their systems.
[#]
The Ascension health system is working to restore IT systems disrupted by a ransomware attack believed to be from the Black Basta group, significantly affecting hospital operations and forcing a temporary shift to paper-based records.
[#]
The Phorpiex botnet has launched a large-scale LockBit Black ransomware campaign by sending millions of phishing emails that contain a ZIP attachment with an executable which, upon execution, installs the ransomware to encrypt victims' systems; to defend, use endpoint security solutions and email filtering.
[#]
The City of Helsinki suffered a data breach on April 30, 2024, affecting over 80,000 students, guardians, and personnel due to an unpatched vulnerability in the Education Division's network server, leading to compromised personal and sensitive information.
[#]
A hacker named "salfetka" is selling the source code for INC Ransomware for $300,000, which could lead to more widespread ransomware attacks.
[#]
The FCC has identified 'Royal Tiger' as a robocall threat actor group, operating from multiple countries, to improve tracking and enforcement actions against illegal robocall campaigns.
[#]
Christie's auction house shut down its website due to a cyberattack just days before an $840 million art sale, causing them to redirect to a temporary site while ensuring that live auctions can still proceed as scheduled, albeit without online bidding options.
[#]
Threat actors are using DNS tunneling to covertly track when phishing emails are opened and to scan networks for vulnerabilities; organizations should implement DNS monitoring and restrict DNS resolvers to mitigate this threat.
[#]
Apple has released urgent security updates for older iPhones, iPads, and macOS to address multiple vulnerabilities including a memory corruption flaw (CVE-2024-23296) and a logic issue (CVE-2024-27789), which may have been exploited as zero-days.
[#]
The PyPI repository was targeted with a malicious package, "requests-darwin-lite," which hid a Go binary within a PNG image, and users who installed it should remove the package and scan for potential compromise.
[#]
A vulnerability CVE-2024-35205 in WPS Office allows path traversal attacks that can lead to unauthorized access and code execution, affecting over 500 million Android users, who should update the app to version 17.0.0 or above to mitigate the risk.
[#]
Cybersecurity experts at G Data discovered a malware campaign that uses GoTo Meeting executables to deliver the Remcos RAT via deceptive ZIP files, emphasizing the need for caution with attachments and updated security measures.
[#]
Cacti has updated to fix two major vulnerabilities: a command injection flaw (CVE-2024-29895) and a reflected XSS issue (CVE-2024-30268), urging users to upgrade immediately.
[#]
A paper from Stanford reveals that advanced geolocalization tech can now identify photo locations quickly and accurately, highlighting privacy risks and the need to avoid posting location-revealing images online.
[#]
In Q1 2024, cyber incidents increased by 7%, with data leaks being the most frequent outcome, while new exploits in Ivanti and ScreenConnect products led to widespread attacks; organizations should promptly patch vulnerabilities and implement security measures such as WAFs and sandboxes.
[#]
The Intelligence Community needs new contracting and technical methods to handle the growing influx of open-source intelligence driven by AI, while ensuring secure integration and streamlined procurement processes.
[#]
Criminals are evolving their generative AI tactics by opting to jailbreak existing language models like ChatGPT rather than creating new ones and are increasingly using deepfake services for fraudulent activities such as bypassing KYC verification measures.
[#]
Black Hat USA will be held from August 3-8, 2024, followed by SecTor in October, and other regional Black Hat events later in the year.
[#]
Informa Black Hat is part of Informa Tech Division and provides updates on cybersecurity events, including conferences and briefings, with the next events being Black Hat USA in August 2024 and SecTor in October 2024.
[#]
Google has patched a high-severity zero-day vulnerability (CVE-2024-4761) in Chrome's V8 JavaScript engine that could allow remote code execution, advising users to update to version 124.0.6367.207/.208 immediately.
[#]
Last week at OffensiveCon 2024, Solar Designer presented a keynote talk on the evolution and optimization of offline password cracking, detailing the historical context and future outlook of the practice, available in his slides: https://www.openwall.com/presentations/OffensiveCon2024-Password-Cracking/.
