DinodasRAT used against governmental entity in Guayana – Week in security with Tony Anscombe

The backdoor can exfiltrate files, manipulate Windows registry keys, and execute commands that are capable of performing various actions on a victim’s machine

Fake friends and followers on social media – and how to spot them

One of the biggest threats to watch out for on social media is fraud perpetrated by people who aren’t who they claim to be. Here’s how to recognize them.

Weekly Update 368

This must be my first "business as usual" weekly update since August and damn it's nice to be back to normal! New sponsor, new breaches, new blog post and if you're in this part of the world, a brand new summer creeping over the horizon. I've now got a couple of months with very little in the way of travel plans and a goal to really knock a bunch of new HIBP features out of the park, some of which I talk about in this week's video. Enjoy! 🍻

References

1. Sponsored by: NTT’s Samurai XDR offers affordable enterprise-grade security for businesses of any size. $40 /endpoint/year. Try it free for 30 days!
2. The Horse Isle breach went into HIBP (if you're a big fan of fantasy horse games, this one is for you!)
3. The Activision breach also went into HIBP (only employees and what looks like contractors in this one, probably more embarrassing for the organisation than actually impactful)
4. And the Hjedd breach went into HIBP too (if you're a big fan of Chinese porn, well, uh, yeah...)
5. You never actually believed the claims of "safe, secure, anonymous", did you? (turns out that's literally horseshit 🐎)

Operation Jacana: Foundling hobbits in Guyana

ESET researchers discovered a cyberespionage campaign against a governmental entity in Guyana

MGM Resorts attackers hit personal data jackpot, but house lost $100M

Racecars and cyber insurance will balance its books in no time, though

MGM Resorts has admitted that the cyberattack it suffered in September will likely cost the company at least $100 million.…

North Korea's Lazarus Group Launders $900 Million in Cryptocurrency

As much as $7 billion in cryptocurrency has been illicitly laundered through cross-chain crime, with the North Korea-linked Lazarus Group linked to the theft of roughly $900 million of those proceeds between July 2022 and July of this year. "As traditional entities such as mixers continue to be subject to seizures and sanctions scrutiny, the crypto crime displacement to chain- or asset-hopping

Apple Patches 17th Zero-Day Of 2023

Android Devices With Backdoored Firmware Found In US Schools

Ransomware Gang Qakbot Resurfaces After Botnet Takedown

Microsoft Releases New Report On Cybercrime, State Sponsored Cyber Operations

CDW Data To Be Leaked Next Week After Negotiations With LockBit Break Down

Cisco Warns Of Critical Flaw In Emergency Responder Code

To Schnorr and beyond (Part 1)

submitted by /u/feross
[link] [comments]

CDW data to be leaked next week after negotiations with LockBit break down

Ransomware spokesperson scoffs at IT reseller's offer of payment

CDW, one of the largest resellers on the planet, will have its data leaked by LockBit after negotiations over the ransom fee broke down, a spokesperson for the cybercrime gang says.…

Predator Files: Technical deep-dive into Intellexa Alliance's surveillance products

submitted by /u/DonnchaOC
[link] [comments]

How to stop ransomware thieves WORMing their way into your data

Stay immutable in the face of cyber crime adversity, says Object First

Sponsored Feature Most of us dislike cyber criminals, but not many of us dislike them quite as much as Anthony Cusimano.…

Google promises Germany to creep on users less after market power probe

Regulation complements EU's Digital Markets Act to cover more services

Google has committed to being a little less creepy with user data in response to proceedings from the German Federal Cartel Office (Bundeskartellamt).…

Chinese Hackers Target Semiconductor Firms in East Asia with Cobalt Strike

Threat actors have been observed targeting semiconductor companies in East Asia with lures masquerading as Taiwan Semiconductor Manufacturing Company (TSMC) that are designed to deliver Cobalt Strike beacons. The intrusion set, per EclecticIQ, leverages a backdoor called HyperBro, which is then used as a conduit to deploy the commercial attack simulation software and post-exploitation toolkit.

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential to safeguard an organization’s assets, maintain customer trust, and meet regulatory requirements.  A

GitHub - kitabisa/teler-proxy: 🔐 teler Proxy enabling seamless integration with teler WAF 🛡️ to protect locally running web service against a web-based attacks. 🥷

submitted by /u/dwisiswant0
[link] [comments]

GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack

GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services (AWS), Microsoft, Google, and Slack. Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by secret scanning are active, thereby allowing for effective remediation measures. It was first

Supermicro's BMC Firmware Found Vulnerable to Multiple Critical Vulnerabilities

Multiple security vulnerabilities have been disclosed in the Intelligent Platform Management Interface (IPMI) firmware for Supermicro baseboard management controllers (BMCs) that could result in privilege escalation and execution of malicious code on affected systems. The seven flaws, tracked from CVE-2023-40284 through CVE-2023-40290, vary in severity from High to Critical, according to Binarly

GoldDigger Android trojan targets Vietnamese banking apps, code contains hints of wider targets

More malware scum using acessibility features to steal personal info

Singapore-based infosec outfit Group-IB on Thursday released details of a new Android trojan that exploits the operating system's accessibility features to steal info that enables theft of personal information.…

Cisco warns of critical flaw in Emergency Responder code

Hard-coded credentials strike again

Cisco has issued a security advisory about a vulnerability in its Emergency Responder software that would allow an unauthenticated remote attacker to log in to an affected device using the root account.…

Another security update, Apple? You're really keeping up with your tech rivals

Zero day? More like every day, amirite?

Apple has demonstrated that it can more than hold its own among the tech giants, at least in terms of finding itself on the wrong end of zero-day vulnerabilities.…

Linux Foundation Announces OpenPubkey Open Source Cryptographic Protocol

School Surveillance Tech Does More Harm Than Good

Sony Confirms Data Stolen In Two Recent Hacker Attacks

South Korea Accuses North Of Phish And Ships Attack

Apple Fixes Overheating And Zero Day Flaws With New iOS Update

QakBot Threat Actors Still in Action, Using Ransom Knight and Remcos RAT in Latest Attacks

Despite the disruption to its infrastructure, the threat actors behind the QakBot malware have been linked to an ongoing phishing campaign since early August 2023 that led to the delivery of Ransom Knight (aka Cyclops) ransomware and Remcos RAT. This indicates that “the law enforcement operation may not have impacted Qakbot operators’ spam delivery infrastructure but rather only their

Cisco Releases Urgent Patch to Fix Critical Flaw in Emergency Responder Systems

Cisco has released updates to address a critical security flaw impacting Emergency Responder that allows unauthenticated, remote attackers to sign into susceptible systems using hard-coded credentials. The vulnerability, tracked as CVE-2023-20101 (CVSS score: 9.8), is due to the presence of static user credentials for the root account that the company said is usually reserved for use during

NetHunter Hacker IX: How to use MANA Toolkit to create Wi-Fi rogue access point and intercept traffic

submitted by /u/barakadua131
[link] [comments]

Curl: Severity HIGH security problem to be announced with curl 8.4.0

submitted by /u/Wiremask
[link] [comments]

Analysis and Config Extraction of Lu0Bot, a Node.js Malware with Considerable Capabilities

Nowadays, more malware developers are using unconventional programming languages to bypass advanced detection systems. The Node.js malware Lu0Bot is a testament to this trend. By targeting a platform-agnostic runtime environment common in modern web apps and employing multi-layer obfuscation, Lu0Bot is a serious threat to organizations and individuals. Although currently, the malware has low

Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack

A governmental entity in Guyana has been targeted as part of a cyber espionage campaign dubbed Operation Jacana. The activity, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant written in C++ called DinodasRAT. The Slovak cybersecurity firm said it could link the intrusion to a known threat actor or group,

Lorenz ransomware crew bungles blackmail blueprint by leaking two years of contacts

Data leakers become data leakees

The Lorenz ransomware group leaked the details of every person who contacted it via its online contact form over the course of the last two years.…

GoldDigger Android Trojan Targets Banking Apps in Asia Pacific Countries

A new Android banking trojan named GoldDigger has been found targeting several financial applications with an aim to siphon victims' funds and backdoor infected devices. "The malware targets more than 50 Vietnamese banking, e-wallet and crypto wallet applications," Group-IB said. "There are indications that this threat might be poised to extend its reach across the wider APAC region and to

Introducing cmloot.py - New tooling for attacking Configuration Manager

submitted by /u/ivxrehc
[link] [comments]

CISA Warns of Active Exploitation of JetBrains and Windows Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation, while removing five bugs from the list due to lack of adequate evidence. The vulnerabilities newly added are below - CVE-2023-42793 (CVSS score: 9.8) - JetBrains TeamCity Authentication Bypass Vulnerability CVE-

Yet More Unauth Remote Command Execution Vulns in Firewalls - Sangfor Edition

submitted by /u/dx7r__
[link] [comments]

Beyond XSS: Explore the Web Front-end Security Universe

submitted by /u/Available-Egg-7367
[link] [comments]

Pitfalls of relying on eBPF for security monitoring (and some solutions)

submitted by /u/sanitybit
[link] [comments]

South Korea accuses North of Phish and Ships attack

Kim Jong-un looks at industry's progress with green eyes, says South Korea's spy agency

South Korea's National Intelligence Service (NIS) has warned North Korea is attacking its shipbuilding sector.…

Apple Rolls Out Security Patches for Actively Exploited iOS Zero-Day Flaw

Apple on Wednesday rolled out security patches to address a new zero-day flaw in iOS and iPadOS that it said has come under active exploitation in the wild. Tracked as CVE-2023-42824, the kernel vulnerability could be abused by a local attacker to elevate their privileges. The iPhone maker said it addressed the problem with improved checks. "Apple is aware of a report that this issue may have

Atlassian Confluence Hit by New Actively Exploited Zero-Day – Patch Now

Atlassian has released fixes to contain an actively exploited critical zero-day flaw impacting publicly accessible Confluence Data Center and Server instances. The vulnerability, tracked as CVE-2023-22515, is remotely exploitable and allows external attackers to create unauthorized Confluence administrator accounts and access Confluence servers. It does not impact Confluence versions prior to

IT networks under attack via critical Confluence zero-day. Patch now

'Handful' of customers hit so far, public-facing instances at risk

Atlassian today said miscreants have exploited a critical bug in on-premises instances of Confluence Server and Confluence Data Center to create and abuse admin accounts within the enterprise colab software.  …

Make-me-root 'Looney Tunables' security hole on Linux needs your attention

What's up, Doc? Try elevated permissions

Grab security updates for your Linux distributions: there's a security hole that can be fairly easily exploited by rogue users, intruders, and malicious software to gain root access and take over the box.…

Critical Provesc Zero Day in Confluence

submitted by /u/Cubensis-n-sanpedro
[link] [comments]

'Gay furry hackers' brag of second NATO break-in, steal and leak more data

'No impact on missions,' military powerhouse insists

NATO is "actively addressing" multiple IT security incidents after a hacktivist group claimed it once again breached some of the military alliance's websites, this time stealing what's claimed to be more than 3,000 files and 9GB of data.…

Binarly REsearch - Multiple Critical Vulnerabilities in Supermicro BMCs

submitted by /u/netsec_burn
[link] [comments]

Red Cross lays down hacktivism law as Ukraine war rages on

Rules apply to cyber vigilantes and their home nations, but experts cast doubt over potential benefits

New guidelines have been codified to govern the rules of engagement concerning hacktivists involved in ongoing cyber warfare.…

PoC exploit for CVE-2023-4911 "Looney Tunables"

submitted by /u/netsec_burn
[link] [comments]

/r/netsec's Q4 2023 Information Security Hiring Thread

submitted by /u/netsec_burn
[link] [comments]

CISA barred from coordinating with social media sites to police misinformation

The 5th Circuit's re-ruling adds CISA to a list of alleged first-amendment violators. Next stop: Supreme Court

The US Fifth Circuit Court of Appeals has modified a ruling from last month to add the Cybersecurity and Infrastructure Security Agency (CISA) to a list of US government entities prohibited from working with social media outfits to curtail the spread of misinformation. …

A Practical Approach to SBOM in CI/CD Part III — Tracking SBOMs with Dependency-Track

submitted by /u/theowni
[link] [comments]

Researchers Link DragonEgg Android Spyware to LightSpy iOS Surveillanceware

New findings have identified connections between an Android spyware called DragonEgg and another sophisticated modular iOS surveillanceware tool named LightSpy. DragonEgg, alongside WyrmSpy (aka AndroidControl), was first disclosed by Lookout in July 2023 as a strain of malware capable of gathering sensitive data from Android devices. It was attributed to the Chinese nation-state group APT41. On

Qualcomm Patches 3 Zero Days Reported By Google

New Supermicro BMC Vulnerabilities Could Expose Many Servers To Remote Attacks

TorchServe Flaws Means PyTorch Users Need An Urgent Upgrade