/ Zyxel’s guidance for the recent attacks on the ZyWALL devices
— some firewall versions could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device
https://www.zyxel.com/global/en/support/security-advisories/zyxels-guidance-for-the-recent-attacks-on-the-zywall-devices
— some firewall versions could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device
https://www.zyxel.com/global/en/support/security-advisories/zyxels-guidance-for-the-recent-attacks-on-the-zywall-devices
Zyxel
Zyxel’s guidance for the recent attacks on the ZyWALL devices | Zyxel Networks
Summary Zyxel recently became aware of a cyberattack targeting our ZyWALL devices. These vulnerabilities already have patches - we took immediate action as soon as we become aware of them, and have released patches, as well as security advisories for CVE…
Netdata - Best Open-source Monitoring And Troubleshooting System
Few time ago I found Netdata.cloud - is a brilliant service with unique features:
• Fast deploy: One line of code and metrics will start collecting
• Multiple monitors: Auto-discovering many type of services on target systems
• Envs: On-premise, hybrid, IoT, multi-cloud, containers (k8s, Docker, LXC, LXD, and more)
• Integrations: OS, DB, Networks, Applications with over 1k+ integrations
• Import data: Prometheus, StatsD, SQL - visualize with opinionated dashboards and charts
In short - a couple of minutes is enough to start monitoring the system, with full coverage for all necessary needs
• Active Directory, CoreDNS, IIS, Docker and more and more live monitors Live Demo
• Site: https://www.netdata.cloud/features
#sysadminlab #news #netdata #monitoring #observability #mychoice
Few time ago I found Netdata.cloud - is a brilliant service with unique features:
• Fast deploy: One line of code and metrics will start collecting
• Multiple monitors: Auto-discovering many type of services on target systems
• Envs: On-premise, hybrid, IoT, multi-cloud, containers (k8s, Docker, LXC, LXD, and more)
• Integrations: OS, DB, Networks, Applications with over 1k+ integrations
• Import data: Prometheus, StatsD, SQL - visualize with opinionated dashboards and charts
In short - a couple of minutes is enough to start monitoring the system, with full coverage for all necessary needs
• Active Directory, CoreDNS, IIS, Docker and more and more live monitors Live Demo
• Site: https://www.netdata.cloud/features
#sysadminlab #news #netdata #monitoring #observability #mychoice
✨️️ Open SysConf'23 - Регистрация Докладчика
Несмотря на то, что мы планируем встречу на осень, было решено начать сбор докладчиков уже сегодня.
Тематики как всегда - IT, Dev(Sec)Ops, AppSec, Cybersec, Hardening, Сложные сертификации.. особенно круто, если это собственный ресерч или крутая разработка, которая делает этот прекрасный мир лучше.
Начинай думать, сегодня о том, что будем делать завтра 😉
— Форма регистрации Здесь
Несмотря на то, что мы планируем встречу на осень, было решено начать сбор докладчиков уже сегодня.
Тематики как всегда - IT, Dev(Sec)Ops, AppSec, Cybersec, Hardening, Сложные сертификации.. особенно круто, если это собственный ресерч или крутая разработка, которая делает этот прекрасный мир лучше.
Начинай думать, сегодня о том, что будем делать завтра 😉
— Форма регистрации Здесь
/ Can you trust ChatGPT’s package recommendations?
ChatGPT can offer coding solutions, but its tendency for hallucination presents attackers with an opportunity:
https://vulcan.io/blog/ai-hallucinations-package-risk/
ChatGPT can offer coding solutions, but its tendency for hallucination presents attackers with an opportunity:
https://vulcan.io/blog/ai-hallucinations-package-risk/
Tenable®
Cybersecurity Snapshot: New Guide Details How To Use AI Securely, as CERT Honcho Tells CISOs To Sharpen AI Security Skills Pronto
Cyber agencies from multiple countries published a joint guide on using artificial intelligence safely. Meanwhile, CERT’s director says AI is the top skill for CISOs to have in 2024. Plus, the UK’s NCSC forecasts how AI will supercharge cyberattacks. And…
/ When Hackers hack the Hackers - Malware Analysis for a group targeting Malware Developers
Detailed analysis revealed Command & Control (C2) connections using Discord for communication.
https://www.r-tec.net/r-tec-blog-when-hackers-hack-the-hackers.html
P.S. Malicious domains with Cobalt Strike C2, Remcos C2 already blocked in OpenBLD.net DNS
Detailed analysis revealed Command & Control (C2) connections using Discord for communication.
https://www.r-tec.net/r-tec-blog-when-hackers-hack-the-hackers.html
P.S. Malicious domains with Cobalt Strike C2, Remcos C2 already blocked in OpenBLD.net DNS
www.r-tec.net
When Hackers hack the Hackers
In this post, the malware analysis process, as well as attacker activities and Indicators of Compromise (IoCs) are presented.
Открытый практикум: Configuration drift – управляем конфигурацией приложений
13 Июня (Вторник) 19:00 по МСК. Детали
Программа:
• Что такое configuration drift?
• Какая может быть архитектура configuration drift?
• Рассмотрим пример реализации configuration drift
Ведет:
Александр Крылов – Опыт работы в DevOps более 7 лет. Постоянный спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.
13 Июня (Вторник) 19:00 по МСК. Детали
Программа:
• Что такое configuration drift?
• Какая может быть архитектура configuration drift?
• Рассмотрим пример реализации configuration drift
Ведет:
Александр Крылов – Опыт работы в DevOps более 7 лет. Постоянный спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.
/ Cisco AnyConnect for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM (High)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw
Cisco
Cisco Security Advisory: Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows…
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM.…
/ Update. Barracuda Email Security Gateway Appliance (ESG) Vulnerability
ACTION NOTICE: Impacted ESG appliances must be immediately replaced regardless of patch version level.
Barracuda’s remediation recommendation at this time is full replacement of the impacted ESG:
https://www.barracuda.com/company/legal/esg-vulnerability
Prev post:
https://news.1rj.ru/str/sysadm_in_channel/4655
ACTION NOTICE: Impacted ESG appliances must be immediately replaced regardless of patch version level.
Barracuda’s remediation recommendation at this time is full replacement of the impacted ESG:
https://www.barracuda.com/company/legal/esg-vulnerability
Prev post:
https://news.1rj.ru/str/sysadm_in_channel/4655
/ MFA is no protection against this critical new Fortinet vulnerability, CVE-2023-27997
https://www.thestack.technology/fortinet-vulnerability-vpn-cve-2023-27997/
https://www.thestack.technology/fortinet-vulnerability-vpn-cve-2023-27997/
The Stack
MFA no protection against new Fortinet bug CVE-2023-27997
"It is a pre-auth RCE [and] has been proven to be exploitable in a consistent manner; we found it during a Red Team engagement and have exploited it remotely..."
15, 20 в Алматы пройдет несколько ИБ-ивента
- 15 июня проведет Trend Micro в рамках мирового роадшоу Risk to Resilience: https://resources.trendmicro.com/R2R-WT23-Almaty-Russian.html
- 20 июня - впервые в Казахстане состоится Positive Security Day (будет даже А.Лукацкий): https://psdaykz.ptsecurity.com/
- 15 июня проведет Trend Micro в рамках мирового роадшоу Risk to Resilience: https://resources.trendmicro.com/R2R-WT23-Almaty-Russian.html
- 20 июня - впервые в Казахстане состоится Positive Security Day (будет даже А.Лукацкий): https://psdaykz.ptsecurity.com/
/ Elastic Security Labs has discovered the SPECTRALVIPER malware
https://www.elastic.co/security-labs/elastic-charms-spectralviper
https://www.elastic.co/security-labs/elastic-charms-spectralviper
www.elastic.co
Elastic charms SPECTRALVIPER — Elastic Security Labs
Elastic Security Labs has discovered the P8LOADER, POWERSEAL, and SPECTRALVIPER malware families targeting a national Vietnamese agribusiness. REF2754 shares malware and motivational elements of the REF4322 and APT32 activity groups.
/ UI Bug in Visual Studio Lets Attackers Impersonate Publishers
https://www.varonis.com/blog/visual-studio-bug
https://www.varonis.com/blog/visual-studio-bug
Varonis
Imposter Syndrome: UI Bug in Visual Studio Lets Attackers Impersonate Publishers
Varonis Threat Labs found a bug in Microsoft Visual Studio installer that allows an attacker to impersonate a publisher and issue a malicious extension to compromise a targeted system
🚀 Experience the Power of AI-Powered Anomaly Detection in Netdata!
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
/ Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
Microsoft News
Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
A multi-stage adversary-in-the-middle (AiTM) and business email compromise (BEC) attack targets banking and financial services organizations.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Skuld: The Infostealer that Speaks Golang
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
Trellix
Skuld: The Infostealer that Speaks Golang
In May 2023, the Trellix Advanced Research Center discovered a new Golang stealer, known as Skuld, that compromised systems worldwide. The malware targets sensitive information stored in certain applications, such as Discord and web browsers, and the Windows…
Открытый практикум Networks by Rebrain: Основы построения Wi-Fi сетей
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
Open SysConf'23 ⚡ День Х: 16 сентября (Суббота)
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️