SilentPush has published details about a fast flux network used by the Russian Gamaredon cyber-espionage group.
Also:
"A large amount of Gamaredon subdomains used in spear phishing attacks are linked to the TLD .ru, registered via REGRU-RU and contain the number 71."
lol
https://www.silentpush.com/blog/from-russia-with-a-71
"We can not help you attributing the attacks as privacy of the crooks that buy our services is very important"
also known as the typical abuse report reply from any shady AS you can think of
Security researcher Georgi Guninski disclosed a DoS bug that can flood Firefox's Downloads window with random files.
>>>>>"The user is notified about this in a small dialog, but there is no option to stop the downloads. The potential denial of service is that the user must manually delete the created files and this might be PITA."
PoC included (Don't access that on Firefox... kek)
https://seclists.org/fulldisclosure/2023/Sep/2
Emsisoft releases an urgent security updates asking customers to reboot all their devices after GlobalSign flubbed the company's certificate renewal
"Yesterday, GlobalSign reached out to us letting us know that they made a mistake with our certificate: namely, they entered our business number incorrectly. This means they must revoke the certificate on September 8th and re-issue a new one with the correct business number."
https://www.emsisoft.com/en/blog/44496/critical-software-update-urgent/
More than 24,000 websites have been hacked as part of a campaign to redirect legitimate traffic to shady Q&A sites.
The campaign has been going on since September of last year when it was present on only 2,500 hacked sites.
The group behind the hacks is focused on generating revenue using Google ads displayed on the Q&A sites.
https://blog.sucuri.net/2023/09/bogus-url-shorteners-go-mobile-only-in-adsense-fraud-campaign.html
Android 14 will block all changes to system certificates, even changes from root.
This happens because Google moved the management of a device's certificate root store into a separate component that can be updated via the Play Store.
The new mechanism prevents researchers from adding certificates to their devices for security and research work that requires intercepting HTTPS traffic.
"If you want to debug your own HTTPS traffic, you'll need to stick to Android 13."
https://httptoolkit.com/blog/android-14-breaks-system-certificate-installation/
"This report demonstrates that the mandated vulnerability and threat-intelligence sharing from the MIIT’s new database to the CNCERT/CC’s CNVD facilitates access to reporting by a regional MSS office, a known PLA contractor, and a university research center with ties to PLA hacking campaigns and which conducts offensive and defense research."
"These organizations with ties to offensive hacking activities would be negligent if they did not utilize their access to CNVD vulnerability reports to equip their operators. The observable increase in the number of zero-days used by PRC hacking teams, as indicated by the 2022 Microsoft “Digital Defense Report,” suggests that these organizations’ access is resulting in vulnerabilities being used by offensive teams."
"This report demonstrates that the mandated vulnerability and threat-intelligence sharing from the MIIT’s new database to the CNCERT/CC’s CNVD facilitates access to reporting by a regional MSS office, a known PLA contractor, and a university research center with ties to PLA hacking campaigns and which conducts offensive and defense research."
Oddbean new post about login | logout
Notes by Catalin Cimpanu | export