/ THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise

Full deep dive analyses

Bash noscripting - DNS Tester Tool

DNS Tester Tool can test speed response for IP addresses from list and collect and show speed statistics in terminal:

— IP address
— Average response
— Minimal time of response
— Maximum time of response

• [en] - https://lab.sys-adm.in/blog/tool-dns-tester
• [ru] - https://lab.sys-adm.in/ru/blog/tool-dns-tester

/ High Vulnerability – Dahua – CVE-2022-30564

Redinent Researchers discovered unauthorised device timestamp modification vulnerability in Dahua products.

— https://www.redinent.com/blog/dahua-cve-2022-30564/

/ Reddit was hacked

Reddit systems were hacked as a result of a sophisticated and highly-targeted phishing attack. They gained access to some internal documents, code, and some internal business systems..:

https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/

/ Globalping CLI

This CLI tool provide access a global network of probes without leaving console. In short: this tool allow use ping from different regions from the world, example:

globalping ping lab.sys-adm.in --from "Paris"

Tool supplied in docker, or pre-builded packages, or own build binary which can build with Go. Repo:

— https://github.com/jsdelivr/globalping-cli

Tis project has API, which can try on link: https://api.globalping.io/demo/

/ Fool’s Gold: dissecting a fake gold market pig-butchering scam

Scammers use counterfeit bank website, hijacked legitimate app to defraud and steal identifying information:

https://news.sophos.com/en-us/2023/02/13/fools-gold-dissecting-a-fake-gold-market-pig-butchering-scam/

/ iOS, iPadOS, macOS, and Safari Under Attack with New Zero-Day

CVE-2023-23529 - bug in the WebKit browser engine that could be activated when processing maliciously crafted web content, culminating in arbitrary code execution:

— macOS: https://support.apple.com/en-us/HT213633
— iOS: https://support.apple.com/en-us/HT213635
— Safari: https://support.apple.com/en-us/HT213638

/ Crypto Wallet Address Replacement Attack

https://blog.phylum.io/phylum-discovers-revived-crypto-wallet-address-replacement-attack

Network Pentesting MindMap

— https://github.com/c4s73r/NetworkNightmare

/ Windows Graphics Component Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823

/ VMware ESXi 8.0b Release Notes

https://docs.vmware.com/en/VMware-vSphere/8.0/rn/vsphere-esxi-80b-release-notes/index.html

/ Android launches yet another way to spy on users with “Privacy Sandbox” beta

https://arstechnica.com/gadgets/2023/02/googles-privacy-sandbox-advertising-system-arrives-on-android-in-beta/

/ Citrix Releases Security Updates for Workspace Apps, Virtual Apps and Desktops

Emergency note from CISA:

https://www.cisa.gov/uscert/ncas/current-activity/2023/02/14/citrix-releases-security-updates-workspace-apps-virtual-apps-and

/ Remote code execution flaw patched in Apache Kafka

https://portswigger.net/daily-swig/remote-code-execution-flaw-patched-in-apache-kafka

/ ClamAV fixed a possible remote code execution vulnerability

https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html

/ Hijack Explorer Context Menu for Persistence & Fun

Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder:

— https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html

/ Atlassian Data Leak 🤦

Atlassian has confirmed that a breach at a "third-party vendor" caused a recent leak of company data and that their network and customer information..:

https://www.bleepingcomputer.com/news/security/atlassian-says-recent-data-leak-stems-from-third-party-vendor-hack/

/ Mirai Variant V3G4 Targets IoT Devices

https://unit42.paloaltonetworks.com/mirai-variant-v3g4/

/ Malware Abuses Microsoft IIS Feature to Establish Backdoor

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/frebniis-malware-iis

/ Account Takeover Vulnerability in a Popular Package, Affecting 1000+ Organizations


illustria’s research team finds a popular npm package with nearly 4 million weekly downloads, vulnerable to account takeover attack..:

https://blog.illustria.io/illustria-discovers-account-takeover-vulnerability-in-a-popular-package-affecting-1000-8aaaf61ebfc4?gi=10ee34fdeff8

/ Dirty bug in HAProxy's headers processing, and that, when properly exploited, this bug allows to build an HTTP content smuggling attack

HAProxy Security Update (CVE-2023-25725)

https://www.mail-archive.com/haproxy@formilux.org/msg43229.html