/ Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool

https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/

/ DNS settings to avoid email spoofing and phishing for unused domain

https://www.cyberciti.biz/security/dns-settings-to-avoid-email-spoofing-and-phishing-for-unused-domain/

/ Multiple vulnerabilities were privately reported to VMware. (critical)

Patches are available to remediate these vulnerabilities in affected VMware products:

https://www.vmware.com/security/advisories/VMSA-2022-0021.html

/ CVE-2022-29154: Rsync client-side arbitrary file write vulnerability

https://www.openwall.com/lists/oss-security/2022/08/02/1

/ XSS vulnerabilities in Google Cloud, Google Play could lead to account hijacks

Article does not has any tecnical analysys, but has discovering information:

https://portswigger.net/daily-swig/xss-vulnerabilities-in-google-cloud-google-play-could-lead-to-account-hijacks

/ GitLab plans to delete dormant projects in free accounts

🙁

https://www.theregister.com/2022/08/04/gitlab_data_retention_policy

/ Hijacking email with Cloudflare Email Routing
…
Cloudflare Email Routing was in closed beta back when I discovered this vulnerability, with only a few domains having been granted access. Sadly, I was not invited to the party, so I was simply going to have to crash it instead.
…

https://albertpedersen.com/blog/hijacking-email-with-cloudflare-email-routing/

Fourteen Ways to Read the PID for the Local Security Authority Subsystem Service (LSASS)

Process enumeration is necessary prior to injecting shellcode or dumping memory. Threat actors tend to favour using CreateToolhelp32Snapshot with Process32First and Process32Next to gather a list of running processes. And if they’re a bit more tech-savvy, they’ll use the NtQuerySystemInformation system call directly.

Although this post will focus on obtaining a PID specifically for LSASS, the methods described here can be adapted to resolve PIDs for any process. Some of these are well known and have been discussed before, but there’s also a few new ones that many readers won’t be familiar with…

* https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/

/ CyRC Vulnerability Advisory: Local privilege escalation in Kaspersky VPN

https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/

/ Zimbra Email - Stealing Clear-Text Credentials via Memcache injection

https://blog.sonarsource.com/zimbra-mail-stealing-clear-text-credentials-via-memcache-injection/

/ Notice about Slack password resets

On August 4, 2022, we notified approximately 0.5% of Slack users that we reset their passwords in response to a bug that occurred when users created or revoked a Shared Invite Link for their workspace. When a user performed either of these actions, Slack transmitted a hashed version of their password to other workspace members. This hashed password was not visible in any Slack clients; discovering it required actively monitoring encrypted network traffic coming from Slack’s servers. This bug was discovered by an independent security researcher and disclosed to us on July 17, 2022. It affected all users who created or revoked Shared Invite Links between April 17, 2017 and July 17, 2022.

https://slack.com/blog/news/notice-about-slack-password-resets

/ An incident impacting some accounts and private information on Twitter

We want to let you know about a vulnerability that allowed someone to enter a phone number or email address into the log-in flow in the attempt to learn if that information was tied to an existing Twitter account, and if so, which specific account.

https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-accounts

/ Multiple vulnerabilities were privately reported to VMware. Patches are available to remediate these vulnerabilities in affected VMware products (critical)

https://www.vmware.com/security/advisories/VMSA-2022-0021.html

/ Cisco Small Business RV Series Routers Vulnerabilities

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR

/ dnsdist: implement own rate-limiting function

Dnsdist is a highly DNS-, DoS- and abuse-aware loadbalancer. Its goal in life is to route traffic to the best server, delivering top performance to legitimate users while shunting or blocking abusive traffic.

Fully LUA & Redis integrated solition with code examples:

* Part 1 - https://blog.mrpk.info/posts/dnsdist-implement-own-rate-limiting-function/
* Part 2 - https://blog.mrpk.info/posts/dnsdist-implement-own-rate-limiting-function-part2/

/ HiddenAds malware affects 1M+ users and hides on the Google Play Store

* Research from McAfee

P.S. Malware domain already blocked in Open BLD service

SQUIP: Exploiting the Scheduler Queue Contention Side Channel

In this paper, we present the SQUIP attack, the first side-channel attack on scheduler queues. With SQUIP, we measure the precise degree of Scheduler Queue Usage (i.e., occupancy) via Interference Probing. We show that this occupancy level measurement works on microarchitectures of different vendors, namely the Apple M1, AMD Zen 2 and Zen 3…

/ The mechanics of a sophisticated phishing scam and how we stopped it

Message from CF: Yesterday, August 8, 2022, Twilio shared that they’d been compromised by a targeted phishing attack. Around the same time as Twilio was attacked, we saw an attack with very similar characteristics also targeting Cloudflare’s employees. While individual employees did fall for the phishing messages, we were able to thwart the attack through our own use of Cloudflare One products, and physical security keys issued to every employee that are required to access all our applications..

IOCs from CF:
* https://blog.cloudflare.com/2022-07-sms-phishing-attacks/

/ Thread actors breached Cisco systems in May and stole gigabytes of information from Cisco..

Cisco Talos shares insights related to recent cyber attack on Cisco

https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html

Cisco Event Response: Corporate Network Security Incident details:

https://tools.cisco.com/security/center/resources/corp_network_security_incident

/ Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

https://portswigger.net/research/browser-powered-desync-attacks