NEW BOT Телеграм, страница

Sys-Admin InfoSec

Утечка данных о звонках клиентов оператора T-Mobile

По заявлению телекоммуникационного гиганта, инцидент с безопасностью в T-Mobile привел к доступу к данным о звонках клиентов

Данные о 200к клиентов содержат информацию о звонках, иных активностях которые мог собирать оператор:

https://portswigger.net/daily-swig/amp/t-mobile-data-breach-malicious-unauthorized-hack-exposes-customer-call-information

The Daily Swig | Cybersecurity news and views

T-Mobile data breach: ‘Malicious, unauthorized’ hack exposes customer call information

Mobile giant suffers another security incident

4.14K viewsedited 07:13

Sys-Admin InfoSec

https://www.zdnet.com/article/linus-torvalds-tears-into-intel-favors-amd/

ZDNET

Linus Torvalds tears into Intel, favors AMD

Torvalds, Linux's creator, finds AMD's processors deliver a much bigger bang for the buck than Intel's CPUs.

4.14K views15:24

Sys-Admin InfoSec

Everything You Need to Know About CI/CD and Security
https://www.tripwire.com/state-of-security/devops/everything-need-to-know-about-ci-cd-security/

Tripwire

Everything You Need to Know About CI/CD and Security

Understand what CI/CD means, learn about security in CI/CD pipelines, and learn how to determine if there are potential security risks.

5.48K views18:52

Sys-Admin InfoSec

https://www.intezer.com/blog/research/operation-ElectroRAT-attacker-creates-fake-companies-to-drain-your-crypto-wallets/

4.17K views20:45

Sys-Admin InfoSec

Широко используемая софтверная компания ( JetBrains ) могла стать отправной точкой для хакерских атак

https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html

NY Times

Widely Used Software Company May Be Entry Point for Huge U.S. Hacking

Russian hackers may have piggybacked on a tool developed by JetBrains, which is based in the Czech Republic, to gain access to federal government and private sector systems in the United States.

4.01K views05:53

Sys-Admin InfoSec

Telegram publishes users' locations online.

https://blog.ahmed.nyc/2021/01/if-you-use-this-feature-on-telegram.html?m=1

4.11K viewsedited 05:55

Sys-Admin InfoSec

PoC о новой программе-вымогателе Babuk

Для шифрования Бабук использует свою собственную реализацию хеширования SHA256. Как и многие другие программы-вымогатели, оно также может шифровать все что может быть доступно по сети

http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/

Chuong Dong

Babuk Ransomware

Malware Analysis Report - Babuk Ransomware

3.9K viewsedited 05:57

Sys-Admin InfoSec

Рекомендации Zyxel по безопасности для уязвимости системной учетной записи CVE-2020-29583

https://support.zyxel.eu/hc/ru/articles/360018524720

FAQ по уязвимости от вендора:

http://support.zyxel.eu/hc/ru/articles/360018610460

Zyxel Support Campus EMEA

CVE: CVE-2020-29583
Обновлено: 07.01 - 15:00 CET
Резюме
Zyxel выпустила исправление для уязвимости системной учетной записи затрагивающей шлюзы безопасности и контроллеры точек доступа о которой не...

3.68K viewsedited 04:35

Sys-Admin InfoSec

Уязвимости в FortiWeb

Множественный набор

- https://www.fortiguard.com/psirt/FG-IR-20-123
- https://www.fortiguard.com/psirt/%20FG-IR-20-124
- https://www.fortiguard.com/psirt/FG-IR-20-125
- https://www.fortiguard.com/psirt/%20FG-IR-20-126

FortiGuard Labs

PSIRT | FortiGuard Labs

3.67K viewsedited 04:39

Sys-Admin InfoSec

Вредоносное ПО, использующее новый загрузчик памяти Ezuri

https://cybersecurity.att.com/blogs/labs-research/malware-using-new-ezuri-memory-loader

LevelBlue

Malware using new Ezuri memory loader

This blog was written by Ofer Caspi and Fernando Martinez of LevelBlue Labs Multiple threat actors have recently started using a Go language (Golang) tool to act as a packer and avoid Antivirus detection. Additionally, the Ezuri memory loader tool acts as…

3.73K viewsedited 04:41

Sys-Admin InfoSec

Nissan source code leaked online after Git repo misconfiguration

Следить нужно не только за бэкапами, но и за настройками (настройками всего, не только git'а) по возможности:

https://www.zdnet.com/google-amp/article/nissan-source-code-leaked-online-after-git-repo-misconfiguration/

4.08K viewsedited 07:39

Sys-Admin InfoSec

How to configure iptables on CentOS - Tutorial
https://upcloud.com/community/tutorials/configure-iptables-centos/

UpCloud

Tutorials - UpCloud

Tutorials Archive - UpCloud

4.69K viewsedited 07:42

Sys-Admin InfoSec

Hackers can clone Google Titan 2FA keys using a side channel in NXP chips
https://arstechnica.com/information-technology/2021/01/hackers-can-clone-google-titan-2fa-keys-using-a-side-channel-in-nxp-chips

Ars Technica

Hackers can clone Google Titan 2FA keys using a side channel in NXP chips

Yubico and Feitian keys that use the same chip are likely susceptible, too.

4.69K views04:30

Sys-Admin InfoSec

ssh-mitm - intercept ssh traffic

https://github.com/ssh-mitm/ssh-mitm#available-modules

GitHub

GitHub - ssh-mitm/ssh-mitm: SSH-MITM - ssh audits made simple

SSH-MITM - ssh audits made simple. Contribute to ssh-mitm/ssh-mitm development by creating an account on GitHub.

4.34K views01:46

Sys-Admin InfoSec

A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code.

Статус critical. Аналогичные проблемы существуют в chrome, egde. Ставим патчи.

https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/

Mozilla

Security Vulnerabilities fixed in Firefox 84.0.2, Firefox for Android 84.1.3, and Firefox ESR 78.6.1

4.19K viewsedited 07:26

Sys-Admin InfoSec

После обновления до Windows 10 версии 20H2 появляются ошибки при доступе к параметрам входа или пользовательской оснастке MMC

В том числе это могут быть автоматические перезагрузки:

Windows 10, version 20H2, you might receive the error in LSASS.exe with the text "Your PC will automatically restart in one minute"

Workaround на оф. сайте:

https://support.microsoft.com/en-us/help/4592802/error-when-accessing-the-sign-in-options-or-users-mmc-snap-in

Microsoft

After updating to Windows 10, version 20H2, you might receive an error when accessing the sign-in options or users MMC snap-in…

Learn about an error with LSASS when accessing dialogs with user accounts

4.09K views09:12

Sys-Admin InfoSec

Технический осмотр бэкдоров Kazuar и Sunburst

Включая сравнение указанием факторов сходства между ними

https://securelist.com/sunburst-backdoor-kazuar/99981/

Примечание: эти два бэкдора использовались для взлома SolarWinds

Securelist

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified .NET backdoor known as Kazuar.

4.09K viewsedited 14:30

Sys-Admin InfoSec

Появился декриптор для Darkside

Darkside, это облачный ramsomware сервис который направлен на продажу “шифровальных” услуг по корпоративной бизнес-модели (детали можно прочитать здесь - https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/)

Детали в отношении декриптора:

https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/

ReliaQuest

DarkSide: The New Ransomware Group Behind Highly Targeted Attacks

We’ve recently observed the emergence of a new ransomware operation named DarkSide. The nuance of the operation includes corporate-like methods and customized ransomware executables, which have made headlines.

3.9K viewsedited 08:30

Sys-Admin InfoSec

Windows Process Herpaderping

Method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself.

https://jxy-s.github.io/herpaderping/

herpaderping

Process Herpaderping

Detection Evasion Exploit

3.72K views14:55

Sys-Admin InfoSec

Sysmon v13.00 - Новый релиз

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

Основная фишка релиза - Process tampering detection (детектирование подложных процессов windows)
https://medium.com/falconforce/sysmon-13-process-tampering-detection-820366138a6c

Docs

Sysmon - Sysinternals

Monitors and reports key system activity via the Windows event log.

3.95K views14:55

Sys-Admin InfoSec

Microsoft Defender Remote Code Execution Vulnerability

Уязвимость активно эксплуатируется

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647

3.55K views01:27

About

Blog

Apps

Platform