Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package

On Thursday, December 9th, a 0-day exploit in the popular Java logging library log4j (version 2)
was discovered that results in Remote Code Execution (RCE), by logging a certain string.
Given how ubiquitous this library is, the impact of the exploit (full server control),
and how easy it is to exploit, the impact of this vulnerability is quite severe.
We're calling it "Log4Shell" for short.
The 0-day was tweeted along with a POC posted on GitHub. It has now been published as CVE-2021-44228.

https://www.lunasec.io/docs/blog/log4j-zero-day/

Ukrainian military agencies, state-owned banks hit by DDoS attacks

https://ift.tt/JUODXvp

SANS CWE Top 25 Software Errors

https://www.sans.org/top25-software-errors/

APPSEC Cali 2018 - A Tour of API Underprotection

Effective API protection is a growing concern, reflecting the popularity of RESTful Web APIs and richer front-end clients which stress current security and access authorization approaches. You’ll learn about potential threats resulting from undersecured Web APIs and techniques to strengthen your API security posture. You'll gain a clear understanding of user authorization via OAuth2, software authorization via static API keys and the critical interplay between them. Of particular concern are mobile API consumers whose code is statically published with secrets which are often poorly concealed. Practical advice with code examples will show how to improve mobile API security. TLS is necessary but insufficient to fully secure client-server communications. Certificate pinning is explained with code examples to show how to strengthen channel communications. Some advanced techniques will be discussed such as app hardening, white box cryptography and mobile app attestation. You should gain a good understanding of the underprotected API problem, with some immediately practical tips to improve your API security posture and a sense of emerging tools and technologies that enable a significant step change in API security.

Author

Skip Hovsmith is a Principal Engineer and VP Americas for CriticalBlue, working on securing API usage between mobile apps and backend services. Previously, Skip consulted with CriticalBlue customers on accelerating mobile and embedded software running on multicore and custom coprocessor platforms in video, networking, and security modules. Prior to CriticalBlue, Skip worked in formal verification, FPGA design, reconfigurable hw/sw systems, and VLSI and mixed-signal chip design. He enjoys working directly with customers and is a writer at Hacker Noon, focused on API security topics such as “They reverse engineered 16k apps; here’s what we’d fix”, and "Mobile API Security".

https://youtu.be/lgAEJwgxe0Y

🕴 @Phantasm_Lab

Mobile Network Hacking, IP Edition

We explore which protection measures are missing from the mobile network and discuss how to best bring them over from the IT security domain into mobile networks.

https://www.youtube.com/watch?v=3XUo7UBn28o&list=PLH15HpR5qRsXiPOP3gxN6ultoj0rAR6Yn&index=3

$300 Google API key leaked to Public on Live Website
https://www.youtube.com/watch?v=ZUXUz22dCiQ

Getting started with the Red Team Guides

RedTeamGuides is a platform that provides red team tutorial and guidance along with cheatsheets. It is aimed at helping security professionals and enthusiasts to learn about red teaming and penetration testing techniques.

The platform provides a wide range of resources, including step-by-step tutorials, how-to guides, and cheat sheets, that cover different topics related to red teaming, such as reconnaissance, exploitation, post-exploitation, and privilege escalation. The guides are regularly updated to keep up with the latest techniques and tools in the field.

https://redteamguides.com/index.html