Checkov
https://github.com/bridgecrewio/checkov
Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languageshttps://github.com/bridgecrewio/checkov
GitHub
GitHub - bridgecrewio/checkov: Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as…
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew. - bridgecrewio/checkov
Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]
В статье рассказывается о механизме обхода изолированной среды iframe :
https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba
В статье рассказывается о механизме обхода изолированной среды iframe :
https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba
Medium
Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]
This blog post is about the mechanics of a long tail iframe sandbox bypass found in a payload belonging to the persistent malvertising…
SHAREit Flaw Could Lead to Remote Code Execution
Удалённое выполнение кода в одном из популярных приложений для шаринга файлов - SHAREit
PoC
https://www.trendmicro.com/en_us/research/21/b/shareit-flaw-could-lead-to-remote-code-execution.html
Удалённое выполнение кода в одном из популярных приложений для шаринга файлов - SHAREit
PoC
https://www.trendmicro.com/en_us/research/21/b/shareit-flaw-could-lead-to-remote-code-execution.html
Trend Micro
SHAREit Flaw Could Lead to Remote Code Execution
We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.
OpenSSL Security Advisory [16 February 2021]
Доступны новые патчи OpenSSL
https://www.openssl.org/news/secadv/20210216.txt
Информация по CVE
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23841
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23839
Доступны новые патчи OpenSSL
https://www.openssl.org/news/secadv/20210216.txt
Информация по CVE
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23841
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23839
cve.mitre.org
CVE -
CVE-2021-23841
CVE-2021-23841
The mission of the CVE® Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities.
Chrome релиз закрывает несколько опасных уязвимостей
https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html
https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 88.0.4324.182 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full lis...
Как сделать easy-fix в Linux kernel
Рассказ от первого лица:
https://forum.sys-adm.in/t/kak-sdelat-easy-fix-v-linux-kernel/7541
Большое спасибо автору за шаринг уникальных знаний - Sabyrzhan @novitoll Tasbolatov. Security Researcher in Spectre Security Group, spectre.kz
Рассказ от первого лица:
https://forum.sys-adm.in/t/kak-sdelat-easy-fix-v-linux-kernel/7541
Большое спасибо автору за шаринг уникальных знаний - Sabyrzhan @novitoll Tasbolatov. Security Researcher in Spectre Security Group, spectre.kz
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
From Docker Compose to Kubernetes with Podman
https://www.redhat.com/sysadmin/compose-kubernetes-podman
Use Podman 3.0 to convert Docker Compose YAML to a format Podman recognizes.https://www.redhat.com/sysadmin/compose-kubernetes-podman
Redhat
From Docker Compose to Kubernetes with Podman
The Docker Compose tool has been valuable for many people who have been working with containers. According to the documentation, Docker Compose describes its...
New BIND releases are available: 9.11.28, 9.16.12, and 9.17.10
https://www.mail-archive.com/bind-announce@lists.isc.org/msg00595.html
CVE Info
https://kb.isc.org/docs/cve-2020-8625
DoH в BIND 9
https://www.isc.org/blogs/bind-implements-doh-2021/
In addition to bug fixes and feature improvements, these particular maintenance releases also contain the fix for a vulnerability, CVE-2020-8625https://www.mail-archive.com/bind-announce@lists.isc.org/msg00595.html
CVE Info
https://kb.isc.org/docs/cve-2020-8625
DoH в BIND 9
https://www.isc.org/blogs/bind-implements-doh-2021/
kb.isc.org
CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negoti
CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
ApoMacroSploit: апокалиптическая гонка FUD
FUD - full none-detection. Некоторое время назад Check Point Research обнаружила новый компоновщик вредоносных программ для Office под названием APOMacroSploit, который был замешан в нескольких фишинговых компаниях.
В ходе расследования CP обнаружили, что этот инструмент включает функции, позволяющие избежать обнаружения Защитником Windows, и ежедневно обновляется (чтобы обеспечить низкие показатели обнаружения). В этой статье авторы раскрывают злонамеренные намерения злоумышленников и раскрывают настоящую личность одного злоумышленника...
Здесь целый набор PoC + OSINT
https://research.checkpoint.com/2021/apomacrosploit-apocalyptical-fud-race/
FUD - full none-detection. Некоторое время назад Check Point Research обнаружила новый компоновщик вредоносных программ для Office под названием APOMacroSploit, который был замешан в нескольких фишинговых компаниях.
В ходе расследования CP обнаружили, что этот инструмент включает функции, позволяющие избежать обнаружения Защитником Windows, и ежедневно обновляется (чтобы обеспечить низкие показатели обнаружения). В этой статье авторы раскрывают злонамеренные намерения злоумышленников и раскрывают настоящую личность одного злоумышленника...
Здесь целый набор PoC + OSINT
https://research.checkpoint.com/2021/apomacrosploit-apocalyptical-fud-race/
Check Point Research
ApoMacroSploit : Apocalyptical FUD race - Check Point Research
1.1 Introduction At the end of November, Check Point Research detected a new Office malware builder called APOMacroSploit, which was implicated in multiple malicious emails to more than 80 customers worldwide. In our investigation, we found that this…
Apple-Platform-Security-Guides
https://github.com/0xmachos/Apple-Platform-Security-Guides
iOS-Security-Guides
https://github.com/0xmachos/iOS-Security-Guides
Additional links:
https://support.apple.com/guide/security/welcome/web
https://developer.apple.com/programs/security-research-device/
https://www.apple.com/mac/m1/
Arm'd & Dangerous
https://objective-see.com/blog/blog_0x62.html
https://github.com/0xmachos/Apple-Platform-Security-Guides
iOS-Security-Guides
https://github.com/0xmachos/iOS-Security-Guides
Additional links:
https://support.apple.com/guide/security/welcome/web
https://developer.apple.com/programs/security-research-device/
https://www.apple.com/mac/m1/
Arm'd & Dangerous
malicious code, now native on apple siliconhttps://objective-see.com/blog/blog_0x62.html
GitHub
GitHub - 0xmachos/Apple-Platform-Security-Guides: Every Apple Platform Security Guide
Every Apple Platform Security Guide. Contribute to 0xmachos/Apple-Platform-Security-Guides development by creating an account on GitHub.
Remotely Exploitable 0day in Internet Explorer Gets a Free Micropatch
https://blog.0patch.com/2021/02/remotely-exploitable-0day-in-internet.html
https://blog.0patch.com/2021/02/remotely-exploitable-0day-in-internet.html
Masslogger campaigns exfiltrates user credentials
PoC
https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html?m=1
PoC
https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html?m=1
Cisco Talos Blog
Masslogger campaigns exfiltrates user credentials
By Vanja Svajcer.
News summary
* As protection techniques develop, attackers are finding it harder to successfully attack their targets and must find creative ways to succeed.
* Cisco Talos recently discovered a campaign utilizing a variant of the…
News summary
* As protection techniques develop, attackers are finding it harder to successfully attack their targets and must find creative ways to succeed.
* Cisco Talos recently discovered a campaign utilizing a variant of the…
The next Windows 10 Long Term Servicing Channel (LTSC) release
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-next-windows-10-long-term-servicing-channel-ltsc-release/ba-p/2147232
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-next-windows-10-long-term-servicing-channel-ltsc-release/ba-p/2147232
TECHCOMMUNITY.MICROSOFT.COM
The next Windows 10 Long Term Servicing Channel (LTSC) release | Microsoft Community Hub
Find out when the next LTSC release will be available plus when and how LTSC versions are best utilized in an organization.
Обход методов зашиты при помощи сервисов Google с целью хищения данных платежных карт
Несмотря на прошлогоднюю дату, метод все ещё имеет право на жизнь
PoC
https://sansec.io/research/skimming-google-defeats-csp
Несмотря на прошлогоднюю дату, метод все ещё имеет право на жизнь
PoC
https://sansec.io/research/skimming-google-defeats-csp
Sansec
Digital skimmer runs entirely on Google, defeats CSP
New Phishing Attack Identified: Malformed URL Prefixes
Новая фишинговая атака.
Атака не предполагает изменения букв URL-адреса в фишинговых сообщениях, фактически в url адресах ничего не меняется, что позволяет максимально эффективно обходить методы защиты, вместо этого изменяется префикс URL
Все о новом виде фишинговой атаки:
https://www.greathorn.com/blog-new-phishing-attack-identified-malformed-url-prefixes/
Новая фишинговая атака.
Атака не предполагает изменения букв URL-адреса в фишинговых сообщениях, фактически в url адресах ничего не меняется, что позволяет максимально эффективно обходить методы защиты, вместо этого изменяется префикс URL
Все о новом виде фишинговой атаки:
https://www.greathorn.com/blog-new-phishing-attack-identified-malformed-url-prefixes/
GreatHorn
New Phishing Attack Identified: Malformed URL Prefixes - GreatHorn
The GreatHorn Threat Intelligence Team has identified a new email attack trend, where cybercriminals are able to bypass traditional URL defenses to attack end users. Read how phishing attackers are using http:/ in their URL prefix.
Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight
https://redcanary.com/blog/clipping-silver-sparrows-wings/
https://redcanary.com/blog/clipping-silver-sparrows-wings/
Red Canary
Silver Sparrow macOS malware with M1 compatibility
Silver Sparrow includes a binary compiled to run on Apple’s new M1 chips but lacks one very important feature: a payload
Nodejs - February 2021 Security Releases
The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, February 23th, 2021.
- One Critical severity issue
- One High severity issue
- One Low severity issue
https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
Ув. Подписчик. Спасибо за ссылку ✌️
The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, February 23th, 2021.
- One Critical severity issue
- One High severity issue
- One Low severity issue
https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
Ув. Подписчик. Спасибо за ссылку ✌️
nodejs.org
Node.js — February 2021 Security Releases
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.