Elon Musk: We're modifying the algorithm to surface tweets from smaller accounts

The accounts:

https://files.mastodon.social/media_attachments/files/113/050/803/376/456/241/original/4fda4f51ec1b9b3c.png


Happy one-week anniversary, CrowdStrike customers!


Thanks to that stupid EU cookie bs, the
Wayback Machine is now capturing those popups instead of a site's content


How about you f*** off instead

https://files.mastodon.social/media_attachments/files/112/496/985/619/878/396/original/fab386ee92fd6d36.png


Sometimes I wonder why the f*** I even bother using Signal


Travian is still online

I am actually impressed


GhostRace - Exploiting and Mitigating Speculative Race Conditions

https://www.vusec.net/projects/ghostrace/


Jury Finds Russian-Swedish Operator of ‘Bitcoin Fog’ Guilty of Running the Darknet Cryptocurrency Mixer

https://www.justice.gov/usao-dc/pr/jury-finds-russian-swedish-operator-bitcoin-fog-guilty-running-darknet-cryptocurrency


Hunt & Hackett looks at the leak from Chinese hacker-for-hire contractor i-SOON and its possible ties to at least three Chinese APTs—Poison Carp (also known as Evil Eye, Earth Empusa, EvilBamboo), Jackpot Panda, and APT41 (also known as Double Dragon, Wicked Panda, Bronze Atlas).

https://www.huntandhackett.com/blog/isoon-leak-sheds-light


Broadcom has merged Carbon Black into its Symantec cybersecurity division.

The two brands will continue to operate separately. Broadcom acquired the Carbon Black Black last year as part of its $69 billion acquisition of VMware. The company initially planned to sell off Carbon Black.

Broadcom previously acquired Symantec for $10.7 billion in August 2019.

https://www.broadcom.com/blog/broadcom-brings-together-two-proven-portfolios-to-deliver-complete-hybrid-cloud-cybersecurity


Tuta has enabled quantum-safe encryption by default on all new Tuta Mail accounts.

https://tuta.com/blog/post-quantum-cryptography


Is Twitch just endless commercials now?


Spotify saying the quiet part out loud

Article title: Spotify will end service in Uruguay due to bill requiring fair pay for artists

https://mixmag.net/read/spotify-end-service-uruguay-copyright-law-change-artists-fair-pay-amendment-news


Senior Ukrainian cybersecurity officials sacked amid corruption probe

Yurii Shchyhol and Victor Zhora were accused of participating in a scheme to contract software at inflated prices.

https://cyberscoop.com/zhora-shchyhol-fired-corruption/


Binarly has an analysis of the private key leaks that took place at Lenovo in September 2022 and MSI in April 2023.

The report's main finding was that multiple companies were apparently using the same Intel Boot Guard private keys to sign different types of firmware images.

https://binarly.io/posts/Dissecting_Intels_Explanation_of_Key_Usage_in_Integrated_Firmware_Images_IFWI/index.html


Google has launched a new .ing TLD

All customers must use HTTPS for this one

https://blog.google/products/registry/introducing-the-ing-top-level-domain/

https://files.mastodon.social/media_attachments/files/111/338/286/557/842/437/original/15c5bb82b45a3738.png


Enterprise software giant VMWare has published two security advisories to fix two sets of issues in its vCenter Server and Tools applications.

The worst of the two is the vCenter update, which fixes a 9.8/10-rated memory issue that can lead to remote code execution attacks (CVE-2023-34048).

https://www.vmware.com/security/advisories/VMSA-2023-0023.html


PortSwigger researchers have taken the concept behind the HTTP2 Rapid Reset attack that was being used to launch DDoS attacks and have applied it in a manner that allows threat actors to perform remote race condition attacks with just one single TCP package

https://portswigger.net/research/the-single-packet-attack-making-remote-race-conditions-local

https://files.mastodon.social/media_attachments/files/111/279/061/410/194/748/original/2cf4fd5d65e2cfca.png


nostr:npub1nyqeg55nq5eudx30py8fgff82ensxt9j063w6chkzu4leyfjygwsr3vvvs I did this because my normal alt-account was also flooded with GOP and RuZZian stuff and I had no clue where it was coming from


The I-know-better-then-my-customers-now-give-me-money CEO resigns

"John Riccitiello steps down as CEO of Unity after pricing battle"

https://venturebeat.com/games/john-riccitiello-steps-down-as-ceo-of-unity-after-pricing-battle/


nostr:npub1weagd56njpmxt7avmjgpz6wx5nytr04f7cchd4y6js7hu46xfuuspxcz8k no way in hell does Twitter have 500 million users lol 😆


Also:

-MACE Act passes in US
-ASEAN casinos are laundering cybercrime profits
-Ransomware dwell time plummets from 5 to 1 day
-Hacker steals $100k crypto from Python devs
-Rootkits spotted on npm
-China's semiconductor espionage
-Operation Jacana
-macOS DirtyNIB vulnerability
-Cisco, X.org, cURL, and printer bugs
-NSA& CISA publish Top 10 misconfigs
-NSA&CISA publish IAM guidance for vendors
-CISA publishes Security Planning Workbook
-BlackBerry to split in two
-New tool—OpenPubkey

https://files.mastodon.social/media_attachments/files/111/187/293/978/736/376/original/129dee8b6eda4954.png


Newsletter: https://riskybiznews.substack.com/p/tech-companies-eu-vulnerability-disclosure-rules
Podcast: https://risky.biz/RBNEWS205/

-Tech companies and security firms rally against EU vulnerability disclosure rules
-Apple and Atlassian patch zero-days
-Supermicro patches BMC bugs
-PEACHPIT ad fraud botnet goes down
-23andMe denies data breach
-Lyca Mobile goes down in cyber attack
-Sony discloses MOVEit breach
-NVD reaches 200k entries
-ECH support lands in Firefox
-Android 14 is out
-Pixel 8 support extended to 7 years
-Russia tests social scoring system

https://files.mastodon.social/media_attachments/files/111/187/279/427/874/859/original/5a51edb7b5128c32.png


Human Security has taken down the PEACHPIT ad fraud botnet

https://www.humansecurity.com/company/satori-threat-intelligence/badbox

https://files.mastodon.social/media_attachments/files/111/184/090/131/165/415/original/0b939a007a47b30d.png


Massive outage impacts Xiaomi devices in Russia and Belarus

https://www.rbc.ru/technology_and_media/05/10/2023/651dd1a49a79477a0afffc4f


ESET researchers have identified a cyber-espionage campaign targeting a governmental entity in Guyana.

While ESET has not formally attributed the attacks, they believe the campaign was the work of a China-aligned threat group.

https://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/

https://files.mastodon.social/media_attachments/files/111/183/522/498/944/499/original/5d23325831ad1c77.png


Ransomware is being deployed within one day of initial access in more than 50% of engagements.

In just 12 months the median dwell time identified in the annual Secureworks State of the Threat Report has freefallen from 4.5 days to less than one day.

In 10% of cases, ransomware was even deployed within five hours of initial access.

https://www.secureworks.com/about/press/ransomware-dwell-time-hits-low-of-24-hours


The US NIST National Vulnerability Database (NVD) is now storing information on more than 200,000 vulnerabilities

https://www.linkedin.com/feed/update/urn:li:activity:7115682975899426818/


Yesterday, Google released Android 14: https://blog.google/products/android/android-14/

...and announced seven years of security updates for Pixel devices: https://blog.google/products/pixel/google-pixel-8-pro/


Researchers from TruffleSecurity have identified more than 700 live API keys and passwords that were included in comments filed with pull requests and issues filed on GitHub.

https://trufflesecurity.com/blog/thousands-of-github-comments-leak-live-api-keys

https://files.mastodon.social/media_attachments/files/111/182/912/069/294/616/original/b7dcb9e4d1872555.webp


The Binarly REsearch team has discovered multiple vulnerabilities in the Supermicro IPMI firmware component developed by ATEN.

Vulnerabilities can be exploited by unauthenticated remote attackers and could result in obtaining the root of the BMC system.

https://binarly.io/posts/Binarly_REsearch_Uncovers_Major_Vulnerabilities_in_Supermicro_BMCs/

https://files.mastodon.social/media_attachments/files/111/182/152/709/042/922/original/dcec5371498a6b12.png


The X.org team has patched five vulnerabilities in two of its component libraries.

https://lists.x.org/archives/xorg/2023-October/061506.html


nostr:npub1t22ezsps7a7hredz249naq3s9d3csytmrzyf0yhqw94pklxk8ggq6x3ddy coming to Romania in 2024


nostr:npub13cc0d3r3nqgzapsw3sfrua58vmkzlqzjy0x4n29qcq6694u3q0vska8nxu Probably Kevin McCarthy being pissed he lost his job


The US House of Representatives has passed a bill that would remove minimum education requirements on federal cybersecurity jobs.

Named the Modernizing the Acquisition of Cybersecurity Experts Act, the bill passed with an overwhelming 394-1 vote

https://fedscoop.com/house-passes-bill-relax-federal-cyber-educational-requirements/


nostr:npub15axsepjyky82gn376cskrv496jzsc5ffm2mhkfm6l4t8dcf0uduqr5vcus was not on the verified account.... thought he abandoned it


From cURL founder on the nazi-X-chan:

"We are cutting the release cycle short and will release curl 8.4.0 on October 11, including a fix for a severity HIGH CVE."


Ukraine Energy Minister German Galushchenko says cyberattacks are a bigger threat to the country's power grid than rockets and drones because the repercussions of a cyber incident can paralyze whole systems rather than impact small substations—as rockets usually tend to do

https://archive.ph/Y2srj


Apple has a security update for iOS devices to patch two actively exploited zero-days.

The first is a vulnerability (CVE-2023-42824) in the iOS kernel that Apple says was exploited against older iPhones using iOS 16.6 or lower.

The second is a zero-day (CVE-2023-5217) in the Libvpx library that Google discovered last week, and Apple also ported and fixed in iOS.

https://support.apple.com/en-us/HT213961


Atlassian has released a security update to patch an actively exploited zero-day in Confluence "Data Center" and "Server" appliances.

Tracked as CVE-2023-22515, the vulnerability is a local privilege escalation that can be used to create unauthorized admin accounts and access Confluence resources.

https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html


Interesting episode this week from Pat and Adam, with Pat talking to Kroll about how Clop has been testing its MOVEit exploits for over 2 years before this year's hacks

https://risky.biz/RBNEWS724/


nostr:npub1zpevrgd6ylh4kyucxktvrxwymqzftue6ae3yvj8394mnm7nvsmfsmkc2yq I thinkwe all know Microsoft. You don't need to redact it, bud!


And:

-Thai crypto scammers detained
-18.6% of FOSS JS and Java projects went dead this year
-Malware reports on Knight ransomware and Mystic Stealer
-APT reports on APT41's Android malware, new REF5961 group, Konni, and Cytrox
-Microsoft patches apps for Libwebp and Libvpx zero-days
-Exim patches RCE bugs
-New Looney Tunables vulnerability
-New ShellTorch vulnerability
-ConnectedIO router bugs
-Gartner's cybersecurity spending forecast (it's good news)
-New tools—cloudgrep and KubeHound

https://files.mastodon.social/media_attachments/files/111/176/004/758/846/742/original/83afe49c8697f8ee.webp


Newsletter: https://riskybiznews.substack.com/p/ransomware-gangs-go-after-teamcity-ws-ftp
Podcast: https://risky.biz/RBNEWS204/

-Ransomware gangs hit TeamCity and WS_FTP servers
-Website leak exposes Russian military and intelligence centers
-Mandatory MFA for AWS root accounts
-Google Cloud moves security feature behind paywall
-Gmail adds more anti-spam features
-Arm, Google, and Qualcomm patch zero-days
-European Media Freedom Act adds some anti-spyware protections for journalists
-FSB wants to track geolocation data
-VPN ban incoming in RU in 2024

https://files.mastodon.social/media_attachments/files/111/175/951/451/641/474/original/a8317cc3eb9ea361.png


nostr:npub1w5uc8s2gzguth3kqmqlq9dp2x6sa9jyl87kep6234ftujrd7whfq9aegep bots... lots of them pretending to be infosec people too


he European Parliament has proposed an updated version of the European Media Freedom Act that includes a ban on the use of spyware against journalists.

The new document does not introduce a full blanket ban. Spyware may be used against journalists as a "last resort" and on a "case-by-case basis" under judicial authority to investigate serious crimes, such as terrorism or human trafficking.

https://www.europarl.europa.eu/news/en/press-room/20230929IPR06111/media-freedom-act-meps-tighten-rules-to-protect-journalists-and-media-outlets


Amazon makes MFA mandatory for AWS root access

"Beginning in mid-2024, customers signing in to the AWS Management Console with the root user of an AWS Organizations management account will be required to enable MFA to proceed."

https://aws.amazon.com/blogs/security/security-by-design-aws-to-enhance-mfa-requirements-in-2024/


nostr:npub1va4pvavezzdp0alne63emvg59hdvpzl0amasqd5avrasv7wnqgrs7urdx3 not yet, anyway


nostr:npub17lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0qlk9uux Only a few days ago people were ridiculing this vulnerability because there were "only 550 servers" connected online. Looks like ransomware gangs didn't give a shit about the infosec community's opinions once again.


Cado Security has open-sourced cloudgrep, a tool for searching resources across S3 cloud storage servers.

>>>>>>>"It currently supports searching log files, optionally compressed with gzip (.gz) or zip (.zip), in AWS S3."

https://github.com/cado-security/cloudgrep


Android patches Libwebp zero-day and a second GPU driver exploit in Arm Mali

https://source.android.com/docs/security/bulletin/2023-10-01


ThreatFabric has published an in-depth analysis of two Android malware strains used by the APT41 Chinese cyber-espionage group.

https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack

They're named LightSpy and AndroidControl and are the DragonEgg and WyrmSpy strains first spotted by Lookout earlier this year.

https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41


The website of the Lorenz ransomware gang has leaked every message ever sent through its contact form. Copies of all messages are available here.

https://github.com/htmalgae/research/blob/main/lorenz-contact-form-messages.txt


DataDog's security team has open-sourced a tool named KubeHound that can be used to analyze Kubernetes clusters and create graphs of possible attach paths.

Blog: https://securitylabs.datadoghq.com/articles/kubehound-identify-kubernetes-attack-paths/

Tool: https://kubehound.io/

https://files.mastodon.social/media_attachments/files/111/167/679/036/805/386/original/e5422373f83c6679.png


Ransomware groups are exploiting a recently disclosed vulnerability in JetBrains TeamCity servers to breach corporate networks

https://files.mastodon.social/media_attachments/files/111/167/634/197/943/428/original/059173f6645ec9b9.png


Exim patches are out: https://www.exim.org/download.html

Analysis of that no-auth RCE: https://labs.watchtowr.com/exim-0days-90s-vulns-in-90s-software/

"But in the meantime, don’t panic - this one is more of a damp squib than a world-ending catastrophe."


For the love of God infosec community.... stop dumping PoCs two days after a patch is out.

At least allow IT teams to schedule a patch.

jfc almighty!


nostr:npub1ugjnpxyglz3e0lj6s3peua5p6gxpr5tfxxrhxrp8863uv0tyhp9qf4sjuz nah... both are cheap... yachts and an AWS account


nostr:npub1ugjnpxyglz3e0lj6s3peua5p6gxpr5tfxxrhxrp8863uv0tyhp9qf4sjuz I have ideas how


nostr:npub1hcm6hdruvlmd0q7tskh24c6ctcay866v82vfnyg5r9gtpxklltas2mwkzk because I'm a rebel!


And:

-Malware reports on BunnyLoader, RustDeck, GuLoader
-Lazarus poses as Meta recruiter
-Oilrig targets Saudi Arabia
-US report on Chinese disinformation efforts
-Vulnerability exploitation trends from Mandiant
-Exploitation of JetBrains TeamCity servers is underway
-SharePoint bug PoC is live
-You can bypass Cloudflare with Cloudflare
-New tool—DavRelayUp
-DarkBeam leaks its own database
-Source code of India's BharOS leaks
-The Apple iOS feature you should probably be aware of

https://files.mastodon.social/media_attachments/files/111/164/610/469/580/970/original/3275e7308c5daac3.jpg


Newsletter: https://riskybiznews.substack.com/p/disclosure-snafu-delays-exim-patch-a-year
Podcast: https://risky.biz/RBNEWS203/

-Exim drama explained
-New major bug hits Progress (MOVEit) customers
-Greek govt sabotages spyware investigation
-IronNet ceases all operations
-SBU infiltrated ransomware gangs
-ShinyHunter member pleads guilty
-8 scam call centers disrupted in India
-Malicious ads in Bing AI chat
-Malware adopts smart contracts
-Clop torrents lead back to Moscow
-Phantom Hacker scams on the rise
-New AWS honeypots probed within 3 minutes

https://files.mastodon.social/media_attachments/files/111/164/591/952/516/821/original/05899544ecc69ade.png


A malware gang is storing parts of malicious JavaScript code inside smart contracts hosted on the Binance blockchain

https://finsin.cl/2023/09/29/infeccion-en-sitio-web-de-e-commerce-chileno/


It is October and I am now ultra aware of cybersecurity


Cybersecurity firm IronNet has ceased all operations across all subsidiaries after the company ran out of funds

https://www.securityweek.com/bankrupt-ironnet-shuts-down-operations/


Israeli officials have allowed local police to deploy the Pegasus spyware in a one-time case to investigate the murder of a Palestinian family.

Officials have allowed police to use the spyware for surveillance but not to extract data from infected devices.

https://www.timesofisrael.com/ag-approves-use-of-pegasus-phone-spyware-in-probe-of-shooting-that-killed-5/


Back in June, the Clop gang began releasing some of the data from the MOVEit hacks as torrent files after it began having problems with its hosting infrastructure.

Researchers from Palo Alto Networks have analyzed the seeds of the Clop torrent files and found that most of the stolen MOVEit files have been released through three IP addresses belonging to Moscow-based web hosting provider FlyServers.

https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/


CyFirma security researcher Kaushík Pał has discovered a new hacking forum named SeekShell that launched earlier this year

https://www.linkedin.com/posts/kaushik%7Epal_cybersecurity-threatintelligence-blockchain-activity-7113730677891633152-TrpH/


nostr:npub1acy80hewv4x2jt8tlxcak23hazdutnr98j3rwsfwrfksv8wzydcsvjp50z wall hacks, obviously


Someone tried baiting people into downloading malware on r/cybersecurity

https://chris.partridge.tech/2023/malware-targeting-cybersecurity-subreddit/

https://files.mastodon.social/media_attachments/files/111/159/106/288/232/911/original/b50a2adc814e2975.png


Details and PoC for that WS_FTP 10.0 CVSS vulnerability (CVE-2023-40044):

https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044

Exploitation requires an HTTPS POST request.

There are currently more than 550 WS_FTP servers connected to the internet, according to Shodan.

This is very bad!


French cybersecurity firm Intrinsec has a 31-page report on the GuLoader malware, the Italian company behind it, and its recent campaigns

https://www.intrinsec.com/cyber_threats_targetting_energy_industry/

https://files.mastodon.social/media_attachments/files/111/156/934/028/191/873/original/95ba4be3631966b9.png


nostr:npub1e7rqcsp5pypj3ac5wxnvgnwxmdl5the60wggwlqytaxm9kql0cdsp8uf8g it's also paid, so doesn't matter since most people won't use it anyway


After a PoC was released last week, threat actors are now exploiting a vulnerability (CVE-2023-42793) in the JetBrains TeamCity CI/CD server to gain access to corporate repositories.

https://viz.greynoise.io/tag/jetbrains-teamcity-authentication-bypass-attempt?days=10


Adobe Photoshop is now a web app (too):

https://photoshop.adobe.com

https://files.mastodon.social/media_attachments/files/111/155/077/969/296/544/original/b7678d630b6e202b.png


Plus:

-ECH support lands in Chrome
-Snatch ransomware leak site leaks data on its owners
-Confiant takes down ScamClub malvertising group
-FBI warns of double-ransomware attacks
-Hackers spoof Dependabot to inject malware in projects
-APT reports on AridViper and Budworm
-Taiwan hit with CN disinfo
-Russian exploit broker promises $20mil for iOS and Android zero-days
-Apache NiFi and JBoss RichFaces exploitation
-Apple security updates
-New GPU.zip, Marvin, SideEye attacks
-New tool—Chalk

https://files.mastodon.social/media_attachments/files/111/147/699/183/159/247/original/4889de20ddd937dd.png


Newsletter: https://riskybiznews.substack.com/p/chinese-apt-hacks-subsidiaries
Podcast: https://risky.biz/RBNEWS202/

-Chinese APT hacks subsidiaries, pivots to corporate headquarters
-Google and Mozilla patch another Chrome & Firefox zero-day
-Cisco patches its own zero-day
-new DarkRiver APT targets Russian defense sector
-HVAC platform Johnson Controls goes down in ransomware incident
-Google urges SMS EoL
-OpenSSL 1.x EoL
-82% of CISA staff to be furlough in govt shutdown
-Twitter fully embraces propaganda
-Russian hacker couple detained

https://files.mastodon.social/media_attachments/files/111/147/683/873/963/212/original/885399558440f810.png


The Chrome zero-day from yesterday (CVE-2023-5217: Heap buffer overflow in libvpx) also received a fix in Firefox a few hours ago

https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/


Chinese security firm Rising analyzes Megazord, the latest version of the Akira ransomware.

http://it.rising.com.cn/fanglesuo/20045.html


Resecurity looks at the history of the RansomedVC ransomware and data extortion gang, which has made quite a few headlines lately after their alleged intrusions at Sony and NTT Docomo.

https://www.resecurity.com/blog/article/ransomedvc-in-the-spotlight-what-is-known-about-the-ransomware-group-targeting-major-japanese-businesses

https://files.mastodon.social/media_attachments/files/111/144/204/666/321/956/original/2c501d0dc419659b.png


There's also a new Cisco zero-day in there: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx


Cisco has released 14 security updates for various products.

Of the 14, there's a security patch marked as critical for Cisco Catalyst WAN switches: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z


A threat actor named ScamClub is abusing ad platforms to place malicious ads on reputable websites that redirect users to phishing pages, gift card scams, and giveaway scams.

The group has been active since 2019, has employed multiple browser zero-days, and is believed to have made an estimated $8.5 million in the first half of the year alone.

Security firm Confiant has linked the group's operations to a Hong Kong company named WayTop International Advertising Limited.

https://blog.confiant.com/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537


Manifest confusion attacks also work on PyPI:
https://stiankri.substack.com/p/manifest-confusion-in-pypi

The initial attack was only demoed on npm: https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem


New attack on RSA—the Marvin Attack, a new variation of the 1998 Bleichenbacher timing attack

"The Marvin Attack is a return of a 25 year old vulnerability that allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed with the private key. "

https://people.redhat.com/~hkario/marvin/

https://files.mastodon.social/media_attachments/files/111/143/030/821/378/690/original/6e5c9c57777db105.png


Finally... hope many more follow suit

"Chase U.K. to Block Crypto Payments Citing Fraud, Scams"

https://www.coindesk.com/policy/2023/09/26/chase-uk-to-block-crypto-payments-citing-fraud-scams/


This research blew my mind... basically they're using image stabilization technology in modern phones to see how camera lenses adjust themselves to sound waves (spoken words) and then extracting that information from photos, reconstructing the sound.

🤯 🤯 🤯 🤯 🤯 🤯 🤯


Chinese security firm Xitan Laboratory has published a write-up on "five remote control backdoors" allegedly used by the NSA to breach the Xi'an Northwestern Polytechnical University in June of last year.

The five backdoors are NOPEN, FireJet, SecondDate, CunningHeretic, and StoicSurgeon

https://mp.weixin.qq.com/s/N_jJzk5ZqJEyU8COqBzzxQ


"Using Side Eye, a machine learning assisted tool that Fu and his research team created, Fu can determine the gender of someone speaking in the room where a photo was taken –– and even the exact words they spoke."

https://news.northeastern.edu/2023/09/25/audio-recovery-still-images-silent-videos/


DevSecOps company Phylum has discovered 46 malicious JavaScript and Python libraries—41 on npm and 5 on PyPI—designed to steal Kubernetes configuration files and SSH keys from infected systems: https://blog.phylum.io/sensitive-data-exfiltration-campaign-targets-npm-and-pypi/

The campaign is related to a cluster of activity Sonatype spotted last week: https://blog.sonatype.com/npm-packages-caught-exfiltrating-kubernetes-config-ssh-keys


Reddit has removed the ability for its users to opt out of personalized ads.

https://www.reddit.com/r/reddit/comments/16tqihd/settings_updateschanges_to_ad_personalization/


Cisco has responded to the joint US-JP security advisory that Chinese APT BlackTech is replacing Cisco router firmware in attacks:

"The most prevalent initial access vector in these attacks involves stolen or weak administrative credentials. As outlined in the report, certain configuration changes, such as disabling logging and downloading firmware, require administrative credentials. There is no indication that any Cisco vulnerabilities were exploited."

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csa-cyber-report-sept-2023


Did you expect the WebP zero-day to impact LibreOffice too? Cause I didn't

https://blog.documentfoundation.org/blog/2023/09/26/lo-762-and-lo-757/


PT Security say new APT named Dark River has targeted at least four Russian defense industry companies

The group's main tool is the MataDoor backdoor

https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/


Edge appears to have converted some of its users saved passwords into serial keys of some sort... LOL

https://old.reddit.com/r/MicrosoftEdge/comments/16nk2ke/edge_messed_up_my_password/

https://files.mastodon.social/media_attachments/files/111/142/234/769/368/417/original/998865b44184d310.webp


Chrome 117, released earlier this month, supports Encrypted ClientHello (ECH) for fully encrypted TLS traffic.

https://groups.google.com/a/chromium.org/g/blink-dev/c/CmlXjQeNWDI/m/hx-_4lNBAQAJ


nostr:npub1rzylsd8uuegfgyasuzaj5kz7qk58l373nvj4jw64pw3yleqr5w2syqzpg7 lol... thought you were talking about CounterStrike 2


Google has released a security update to patch another Chrome zero-day vulnerability. Tracked as CVE-2023-5217, the zero-day resides in libvpx, a codec for processing VP8, VP9, and AV1 video files in Chrome.

The company says it spotted the attacks this Monday and released a security update two days later, on Wednesday.

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html


Talks from the DEFCON 31 security conference, which took place this Augst, are now available on YouTube.

https://www.youtube.com/@DEFCONConference/playlists

https://files.mastodon.social/media_attachments/files/111/139/468/795/577/892/original/28868fe392e70077.png


Joint US and Japanese security advisory warn of attacks from a Chinese APT named BlackTech that likes to compromise routers at subsidiaries and then pivot to main corporate US/JP headquarters

The group has a craving for Cisco routers... nom nom nom

https://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-cisa-and-japanese-partners-release-advisory-prc-linked-cyber-actors


Plus:

-UN-ASEAN-China collaboration to fight scams
-FSB agent detained for getting bribes from cybercrime group
-Shadow ransomware renames to C0met
-New ShadowSyndicate group
-Malware reports on Xenomorph, HijackLoader, Lu0Bot, ZenRAT, MoneyMessage, Hive, Retch, SHO, NSA backdoors
-APT reports on AtlasCross, STARK#VORTEX
-Russian APT activity in Ukraine switches to phishing
-Openfire servers infected with ransomware/cryptominers
-JetBrains TeamCity security update
-Sophos closes Naked Security

https://files.mastodon.social/media_attachments/files/111/136/174/659/697/498/original/1af9d7cc7d4259ef.png


Newsletter: https://riskybiznews.substack.com/p/cisa-releases-hbom-framework
Podcast: https://risky.biz/RBNEWS201/

-CISA releases HBOM framework
-Crypto platform Mixin hacked for $200 million
-the UK is also conducting hunt-forward missions
-Google open-sources BinDiff
-HTX (Huobi) hacked for $8mil
-OpenSea rotates API keys
-New Iran government hack
-MOVEit victim count passes 2K
-Sony investigates ransomware attack
-New Windows 11 security features
-Firefox 118 has built-in translations
-Patreon privacy update puts all profiles public

https://files.mastodon.social/media_attachments/files/111/136/160/594/279/981/original/65ed4392ade537b3.png


It has begun!

https://files.mastodon.social/media_attachments/files/111/132/744/730/709/574/original/59925bae6fa04be0.png


nostr:npub1zfc3mah2gclz28urlfc8g4p48p0vdpkc6p68ln8584fgd7e99uus9ez9y6 it's done locally, via language packs


A major UK logistics operator, KNP Logistics, has filed for administration and will fire roughly 730 employees after a ransomware attack impacted its operations and market position earlier this year in June

https://www.bbc.com/news/uk-england-northamptonshire-66927965


Firefox 118 is out and Firefox now supports built-in translations

https://files.mastodon.social/media_attachments/files/111/132/416/765/382/790/original/90dfefafee852ca3.png

https://files.mastodon.social/media_attachments/files/111/132/416/801/548/187/original/1f6f1bfd945f9860.png


Another report of OpenFire exploitation: https://news.drweb.com/show/?i=14756

See VulnCheck (https://vulncheck.com/blog/openfire-cve-2023-32315) and Surevine (https://www.surevine.com/openfire-cve-2023-32315-what-we-know/) from August and June respectively

CVE is CVE-2023-32315


The number of companies impacted by Clop's MOVEit hacking spree has formally surpassed 2,000, according to security firm Emsisoft.

https://www.emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysis/

https://files.mastodon.social/media_attachments/files/111/131/654/604/699/913/original/ab1887e11296beca.png


Google fixes another LibWebP bug... gives it a 10.0 CVSSv3 score.

CVE-2023-5129: https://nvd.nist.gov/vuln/detail/CVE-2023-5129


Report on ShadowSyndicate, an affiliate for seven different RaaS platforms:  Quantum, Nokoyawa, AlphV, Royal, Clop, Cactus, and Play

https://www.group-ib.com/blog/shadowsyndicate-raas/


Sophos has closed its Naked Security blog: https://news.sophos.com/en-us/2023/09/26/update-on-naked-security/


The HTX cryptocurrency exchange has lost $8 million worth of Ether after a hacker gained access and emptied one of its hot wallets

https://archive.ph/QLLbL


Chinese security firm NSFOCUS has discovered a new APT group named AtlasCross that has been running spear-phishing operations aimed at infecting its victims with the DangerAds and AtlasAgent malware.

The company didn't attribute the attacks to any state but said the campaign was interesting because it spoofed US Red Cross operations.

https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/

https://files.mastodon.social/media_attachments/files/111/130/802/816/923/145/original/74d6add7a8a644f8.png


A Russian APT group named STARK#VORTEX (UAC-0154) is targeting members of the Ukrainian military using malware hidden inside drone manuals

https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/

https://files.mastodon.social/media_attachments/files/111/130/609/335/622/200/original/56e7a0117a0df099.png


JetBrains has released a security update for TeamCity on-premise CI/CD servers to fix an authentication bypass vulnerability that could have allowed attackers to run malicious code on customer systems.

https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/


Google's Christian Blichmann has open-sourced BinDiff, a tool used to compare the structure of binary files. The tool has been free to use since 2016, but its source code was still private.

https://github.com/google/bindiff/releases/tag/v8


RansomedVC claims to have breached Sony and is selling their data after the company refused to pay a ransom

https://files.mastodon.social/media_attachments/files/111/128/056/709/973/090/original/4cb4bf9568b8710a.png


Some observed trends:

-targeting law enforcement agencies investigating Russian war crimes
-revisiting past victims to maintain access
-focus on immediate data exfil
-less  malware op, more phishing ops
-constant attacks on the UA media to plant fake news and disinformation
-LOLBIN is king
-relentless targeting of email servers


Some CERT-UA naming conventions from the report:

UAC-0010 (Gamaredon/FSB)
UAC-0056 (GRU)
UAC-0028 (APT28/GRU)
UAC-0082 (Sandworm/GRU)
UAC-0144/UAC-0024/UAC-0003 (Turla)
UAC-0029 (APT29/SVR)
UAC-0109 (Zarya)
UAC-0106 (XakNet)
UAC-0107 (CyberArmyofRussia)


Ukraine's SSSCIP agency has released a report detailing how the tactics of Russian hackers have changed in the first half of the year

Seems activity has gone down

https://cip.gov.ua/en/news/yak-zminyuyutsya-taktiki-cili-i-spromozhnosti-khakerskikh-grup-uryadu-rf-ta-kontrolovanikh-nim-ugrupovan-zvit

https://files.mastodon.social/media_attachments/files/111/127/816/932/706/957/original/ef9b5974732e2bd0.png


DeFi platform Mixin hacked for $200 million

https://archive.li/AnB0O


Not gonna lie.... Substack is starting to piss me off.

Why is there no more "View on web" link in its newsletters?


Catching up with a week's worth of news is a PITA


nostr:npub1zh3tctfxy433qlpqwnakrrx5fw6jyfcmq6kq6zfmrns7xqltdntqys8rtv Translation: We'll allow bot networks to manipulate Notes to help out our QAnon right-wing propaganda brethren from being mass-embarrassed on a daily basis.


Plus:

-French prosecutors appeal PyLocky case dismissal
-New PTI-257 group
-Reports from VISA, Europol, NSA+FBI+CISA
-Malware reports on Lydia spyware, MetaStealer, DBatLoader, 3AM and Sphynx ransomware
-Operation Rusty Flag hits Azerbaijan
-Peach Sandstorm Iranian APT behind wave of password-spraying
-APT reports on APT36, Lazarus, Konni
-Qihoo360 threatens to expose 13 NSA staffers
-ThemeBleed vulnerability
-GitHub Actions worm
-GitHub repojacking vulnerability
-Azure HDInsight vulns

https://files.mastodon.social/media_attachments/files/111/068/672/177/242/172/original/c0019644716ac797.png


Newsletter: https://riskybiznews.substack.com/p/north-korean-hackers-are-behind-coinex-hack
Podcast: https://risky.biz/RBNEWS199/

-Lazarus steals $54 million from CoinEx crypto-exchange
-US wants countries to commit to not paying ransoms;
-Caesars paid $15 million ransom
-Meduza head infected with Pegasus spyware
-DevOps companies Retool and Rollback get hacked
-Airbus and MalindoAir suffer data leaks
-Windows 11 to block SMB from sending NTLM outside an org
-DOD releases Cyber Strategy
-US Army to focus on OSINT
-Spyware firms weaponize online ads

https://files.mastodon.social/media_attachments/files/111/068/655/834/484/865/original/f5c53d46fd55ec87.png


There are definitely some web developers who need to be yeeted into the Sun.

How the hell are you freezing browser rendering with your shitty JS code in 2023!!!!!


nostr:npub1j0rcfvgkm54tsyw9sl3ae49hnjcayqpsxunqqce00qllldlhrrls4eqfwc I don't know, tbh: https://asset-group.github.io/cves.html


nostr:npub17l7fwwfjqcvwzk0sr00sm4gg8umshk69dwcynae7hs8puk7u70tsv4ljgk Doubt it. It's very likely Bluetooth vulns, like their previous research: https://asset-group.github.io/cves.html


@CyberHues take your "US hegemony" talking points back to the racist site, plz


5Ghoul  vulnerabilities coming in December 👀

https://files.mastodon.social/media_attachments/files/111/064/945/755/644/763/original/f219fa965343114f.png


Palo Alto says there's a way to build a GitHub Actions worm that can spread through and compromise GH projects... yey!

https://www.paloaltonetworks.com/blog/prisma-cloud/github-actions-worm-dependencies/

https://files.mastodon.social/media_attachments/files/111/064/839/960/054/524/original/194cbf4a1003dc2d.png


Caesars has disclosed its August hack to the SEC: https://www.sec.gov/ix?doc=/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm

Here's the MGM disclosure from earlier this week: https://www.sec.gov/ix?doc=/Archives/edgar/data/789570/000119312523233855/d502352d8k.htm


Qihoo360:

"With the cooperation of industry partners from multiple countries, our work has made a major breakthrough and has now successfully identified the true identity of the US National Security Agency (NSA) staff member who launched the cyber attack on Northwestern Polytechnical University."


nostr:npub1lw70vfcx6typxmsdjzc4tl29wsrmr52urkg7fzx2hedak3gqcmsq4tctzc Timeline of the attack seems to indicate it is


ThemeBleed - RCE in Windows Themes

https://exploits.forsale/themebleed/


From the Retool incident (related to those Okta attacks from last month):

"The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice".... then reset MFA and took control of the Okta account.


Caesars paid hackers $15 million after they initially requested $30 million

https://www.casino.org/vitalvegas/caesars-entertainment-paid-millions-to-hackers-now-look-like-geniuses/


DevOps company Retool discloses hack: https://retool.com/blog/mfa-isnt-mfa/

DevOps company Rollbar discloses hack: https://archive.ph/Pp27e


SentinelOne has discovered a new infostealer targeting macOS systems named MetaStealer: https://www.sentinelone.com/blog/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks/

It is unclear if this is related to a similar infostealer targeting Windows systems, discovered last year by NCC Group: https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/


Broadcom's Symantec division has discovered a new Rust-based ransomware strain named 3AM.

Symantec saw the ransomware used in one attack so far, where a known ransomware affiliate deployed it on a victim's network after Lockbit was detected and blocked.

The 3AM ransomware comes with a Tor-based support and payment portal but does not appear to operate a dark web leak site (yet).

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3am-ransomware-lockbit


nostr:npub13vsca44c57rv5swtjzf0jpr8n7y6dlrxtq2emneax7399676hqzq8ngqh3 it was the Frenchies. It's always the Frenchies


White House urging dozens of countries to publicly commit to not pay ransoms

https://therecord.media/counter-ransomware-initiative-members-ransom-payments-statement


nostr:npub1e8hcr9u5qsxz40m57jg0m0y5axppfux0wan2pg263czf2a9dlljqxl5ac8 nostr:npub17lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0qlk9uux Most journalists are lazy self-praising morons. I should know.


nostr:npub104gx8p5palmv95se49nvwkaet7syanalzqtyhngjms7jmct7mevqp08993 I'd normally say threat intel firms, but 20 years back... is a lot.

Maybe Risk Based Security?

Cyber-insurers might have that data too.


nostr:npub1w5uc8s2gzguth3kqmqlq9dp2x6sa9jyl87kep6234ftujrd7whfq9aegep why exactly?


nostr:npub1zh3tctfxy433qlpqwnakrrx5fw6jyfcmq6kq6zfmrns7xqltdntqys8rtv Nice, more propaganda capabilities. Can't fall behind to Twitter and Telegram, can't we.


Also:

-Chrome 117 is out
-Smaller fines in the UK if you report hacks to the NCSC
-CISA publishes OSS roadmap
-CyberCom completes 50 hunt forward missions
-Football Leaks hacker sentenced
-Storm-0324 saw running MSFT Teams phishing campaigns
-Malware reports on CatDDoS, Hook, MidgeDropper, OriginBotnet, RomCom, Cuba, Remcos, Prohqcker
-Ballistic Bobcat hacks 32 Israeli companies
-Redfly compromises Asian power grid
-Patch Tuesday is out
-WiKI-Eve attack
-FBI warns of CSAM sextortions

https://files.mastodon.social/media_attachments/files/111/057/232/777/303/000/original/5b1908262be60b23.png


Newsletter: https://riskybiznews.substack.com/p/cisa-to-provide-free-security-scans-water
Podcast: https://risky.biz/RBNEWS198/

-CISA to provide free security scans to public water utilities
-Adobe, Google, Mozilla, and Microsoft patch zero-days
-MGM Resorts suffers mysterious cyber incident
-Dutch football federation pays ransom to avoid player data leak
-arXiv suffers DDoS attack
-Free Download Manager supply chain attack
-Twitch extensions hijacked to spread spam
-Council of Europe calls for spyware investigations
-Smaller fines in the UK

https://files.mastodon.social/media_attachments/files/111/057/223/245/411/103/original/f839c9ebe9d550c3.png


oh no... it's Patch Tuesday today, isn't it!


Newsletter: https://riskybiznews.substack.com/p/microsoft-to-phase-out-3rd-party-printer-drivers
Podcast: https://risky.biz/RBNEWS197/

-Microsoft to phase out 3rd-party printer drivers
-Akira and Lockbit exploit Cisco ASA/FTD zero-day
-FBI links Stake crypto-heist to North Korea
-Ukrainian hacktivists unmask Russia's Cuban mercenary recruiting scheme
-Ransomware hits Sri Lanka govt
-Twitter bans scraping
-15 Israeli opposition party members have a WhatsApp issue mysteriously at the same time
-China's Myanmar fraud crackdown hits 1.2k
-Chinese info-op on Gab

https://files.mastodon.social/media_attachments/files/111/045/942/288/389/865/original/f1ed7e7fd57ab687.png


A Vietnamese threat actor going by the name of MrTonyScam has been conducting expansive Facebook Messenger spam campaigns delivering malware using malicious attachments.

https://labs.guard.io/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-business-3182cfb12f4d

https://files.mastodon.social/media_attachments/files/111/041/674/783/769/663/original/50fbf2e76356c2e0.png


BugProve researchers have identified 33 vulnerabilities in Zabio IP security cameras.

Seven of the reported vulnerabilities are pre-authentication remote code execution flaws that can be used to hijack affected security camera models.

The company has published details and proof-of-concept scripts for all issues after the vendor failed to respond for almost nine months.

https://bugprove.com/knowledge-hub/cve-2023-3959-cve-2023-4249-multiple-critical-vulnerabilities-in-zavio-ip-cameras/


An academic study of 4,600 malicious Python libraries found that 72% of packages persisted across PyPI mirror sites even after the libraries were removed from the main PyPI website.

https://about.honywen.com/publication/2023ase/


"I brought down a scamming operation with 15 bytes of PHP"

https://archive.li/hhn6C


nostr:npub1ja9xuu0z8lll7rqzh88fm0zj3936d8nkyajt2n5ggx7j4nt3eadqc5egyf I hate it.... of all the software patches the fintech industry and public needs to know, a privately sold seldomly exploited is not one of them


And:

-Polish Senate investigation into Pegasus scandal
-China weaponized its vulnerability disclosure program
-Verizon fined for lying about cybersecurity
-Adobe Creative Cloud Sync EoL
-Emsisoft has a critical update after GlobalSign blunder
-SeeTickets reveals skimming incident
-LastPass hack thefts estimated at $35mil
-Seville, Spain's 4th largest city, hit by ransomware attack
-Android 14 is annoying researchers
-ICC to investigate cyber war crimes
-Internet censorship in RU is now at 850k

https://files.mastodon.social/media_attachments/files/111/028/976/387/627/756/original/7e30769d67316b5c.png


Plus:

-IronNet furloughs workers
-Vulns in ProtonMail, Firefox, Apache Superset, Jenkins, Cisco, K8s
-IRM hotel booking 0-day
-New shelLM honeypot system
-Chinese IOs improve dramatically
-North Korean hackers on Mastodon
-APT reports on ScarCruft, APT28
-APT attacks on Fortinet and Zoho systems
-Malware reports on DarkGate, Raspberry Robin, AtomicStealer, RegStealer, AgentTesla, crypto-miners in the cloud
-Pandora malware impacts Android TVs
-Rayobyte's role in DDoS attacks

https://files.mastodon.social/media_attachments/files/111/028/961/275/468/993/original/19d204910c37e399.png


Newsletter: https://riskybiznews.substack.com/p/us-and-uk-dox-sanction-trickbot-conti-member
Podcast: https://risky.biz/RBNEWS196/

-US and UK dox and sanction 11 more Trickbot/Conti members
-China bans iPhones for government work
-Microsoft explains how it lost its signing key
-Apple patches zero-days used to install NSO Group's Pegasus spyware without user interaction
-Cars are a privacy nightmare
-Chrome to get a new UI
-Russian businessman sentenced for hacking
-PYTA31's PyPI campaign still going
-W3LL gang made half a mil from hacking tools

https://files.mastodon.social/media_attachments/files/111/028/942/166/371/892/original/bd33724de04fb753.png


More on this from CitizenLab, which says both iOS zero-days were part of a zero-click no-user-interaction exploit chain named BLASTPASS.

The exploit was used in the wild to install the NSO Group Pegasus spyware on the latest version of iOS (16.6).

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/


Nine more Trickbot/Conti members were charged by the DOJ today: https://www.justice.gov/opa/pr/multiple-foreign-nationals-charged-connection-trickbot-malware-and-conti-ransomware

They were also sanctioned by both the US and UK too: https://home.treasury.gov/news/press-releases/jy1714

https://www.nationalcrimeagency.gov.uk/news/russian-ransomware-group-hit-with-new-sanctions

https://files.mastodon.social/media_attachments/files/111/025/435/252/171/280/original/61dc942a53c6fd72.png


Yahoo's security team found four Ivanti bugs

https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-ivanti-issues-security-alert

https://files.mastodon.social/media_attachments/files/111/025/408/035/255/082/original/6fb5a75447ca9ca1.png


SilentPush has published details about a fast flux network used by the Russian Gamaredon cyber-espionage group.

Also:

"A large amount of Gamaredon subdomains used in spear phishing attacks are linked to the TLD .ru, registered via REGRU-RU and contain the number 71."

lol

https://www.silentpush.com/blog/from-russia-with-a-71


Apple releases iOS and macOS security updates to fix two zero-days, one discovered by CitizenLab

https://support.apple.com/en-us/HT201222

https://files.mastodon.social/media_attachments/files/111/025/110/396/535/064/original/3b5ce0ed51305a47.png


CISA: " Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475"

These are Zoho ManageEngine and Fortinet vulnerabilities

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a


Security firm Sekoia has published a map of China's offensive cyber operations, its APT groups, and their respective affiliations.

https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/

https://files.mastodon.social/media_attachments/files/111/024/906/839/515/797/original/4cc6b016e4d93847.png


Google has spotted another online persona operated by North Korean hackers used to target and trick security researchers into infecting themselves with malware.

For the first time, the fake persona also operated accounts on Wire and Mastodon.

https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/


Bitdefender has identified five vulnerabilities in the IRM Next Generation online booking system that have been exploited in the wild since 2021 to drop malware IRM servers

All five remain unpatched as the vendor has not responded to any private disclosure efforts

https://www.bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/


Organizational chart representing a snapshot of the functions and entities forming part of the CCP’s overt propaganda ecosystem

https://files.mastodon.social/media_attachments/files/111/024/325/320/806/825/original/a8fd06ba94887034.png


An investigation by the Qurium Media Foundation has found that the infrastructure of US-based proxy provider Rayobyte is being used to carry out DDoS attacks against independent news outlets in oppressive countries

https://www.qurium.org/press-releases/one-years-research-of-qurium-shows-how-proxy-and-vpn-providers-are-used-to-conduct-ddos-attacks/


"We can not help you attributing the attacks as privacy of the crooks that buy our services is very important"

also known as the typical abuse report reply from any shady AS you can think of


AT&T Customers Doxed Themselves En Masse In Reply-All Nightmare

https://www.vice.com/en/article/bvjyz8/atandt-customers-doxed-themselves-en-masse-in-reply-all-nightmare


nostr:npub1pra7rgurnp6hh8na0zjrhck4gea7nancn5ka4jajaegulw20jd2s892r5c YOLO... I'm going in!

:tinking:


I'm confused to why the "Clear Downloads" button would not work.... but I also don't wanna test this myself... :KEKW:


Security researcher Georgi Guninski disclosed a DoS bug that can flood Firefox's Downloads window with random files.

>>>>>"The user is notified about this in a small dialog, but there is no option to stop the downloads. The potential denial of service is that the user must manually delete the created files and this might be PITA."

PoC included (Don't access that on Firefox... kek)

https://seclists.org/fulldisclosure/2023/Sep/2


Emsisoft releases an urgent security updates asking customers to reboot all their devices after GlobalSign flubbed the company's certificate renewal

"Yesterday, GlobalSign reached out to us letting us know that they made a mistake with our certificate: namely, they entered our business number incorrectly. This means they must revoke the certificate on September 8th and re-issue a new one with the correct business number."

https://www.emsisoft.com/en/blog/44496/critical-software-update-urgent/


nostr:npub196k4frgw28trqyh9g566cvrqxxmu8u2kyj3a4ay3m46jftwhuvnsvc6435

What can I say. People get bored in retirement.


Tenable has announced its intention to acquire cloud security firm Ermetic for $240 million

https://www.tenable.com/press-releases/tenable-announces-intent-to-acquire-ermetic


A threat actor tracked as PYTA31 is uploading malicious libraries to the PyPI portal infected with the WhiteSnake malware.

The group has continued its activities unabated even after its operations were exposed in April this year.

https://checkmarx.com/blog/threat-actor-continues-to-plague-the-open-source-ecosystem-with-sophisticated-info-stealing-malware/

https://files.mastodon.social/media_attachments/files/111/023/907/740/385/257/original/6a6d2060210541a9.png


Broadcom's Symantec division has spotted a new malware strain named RegStealer.

The malware is written in Python, operates as an infostealer, and has been seen in campaigns targeting South Korea.

https://www.broadcom.com/support/security-center/protection-bulletin#blt0db95c886e9921ba_en-us


More than 24,000 websites have been hacked as part of a campaign to redirect legitimate traffic to shady Q&A sites.

The campaign has been going on since September of last year when it was present on only 2,500 hacked sites.

The group behind the hacks is focused on generating revenue using Google ads displayed on the Q&A sites.

https://blog.sucuri.net/2023/09/bogus-url-shorteners-go-mobile-only-in-adsense-fraud-campaign.html


Cloud security firm Wiz has published a summary of all the cryptomining payloads it spotted in the wild over the past three months.

https://www.wiz.io/blog/cryptojacking-attacks-summer-2023

https://files.mastodon.social/media_attachments/files/111/023/584/436/757/382/original/669f33a28d100b65.png


Android 14 will block all changes to system certificates, even changes from root.

This happens because Google moved the management of a device's certificate root store into a separate component that can be updated via the Play Store.

The new mechanism prevents researchers from adding certificates to their devices for security and research work that requires intercepting HTTPS traffic.

"If you want to debug your own HTTPS traffic, you'll need to stick to Android 13."

https://httptoolkit.com/blog/android-14-breaks-system-certificate-installation/


DarkGate goes from malspam to spamming employees via MS Teams with social-engineered HR-themed files

https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams

https://files.mastodon.social/media_attachments/files/111/023/388/024/398/187/original/d77245c346fcbe21.webp


"These organizations with ties to offensive hacking activities would be negligent if they did not utilize their access to CNVD vulnerability reports to equip their operators. The observable increase in the number of zero-days used by PRC hacking teams, as indicated by the 2022 Microsoft “Digital Defense Report,” suggests that these organizations’ access is resulting in vulnerabilities being used by offensive teams."


"This report demonstrates that the mandated vulnerability and threat-intelligence sharing from the MIIT’s new database to the CNCERT/CC’s CNVD facilitates access to reporting by a regional MSS office, a known PLA contractor, and a university research center with ties to PLA hacking campaigns and which conducts offensive and defense research."


An Atlantic Council report argues that Beijing has used a law passed in 2021 that mandates companies disclose security flaws to the government in two days to gain access to vulnerabilities its hackers can use in the wild.

https://www.atlanticcouncil.org/in-depth-research-reports/report/sleight-of-hand-how-china-weaponizes-software-vulnerability/


Vulnerabilities in Proton Mail, Skiff, and Tutanota

https://www.sonarsource.com/blog/code-vulnerabilities-leak-emails-in-proton-mail/