Открытый практикум: Configuration drift – управляем конфигурацией приложений
13 Июня (Вторник) 19:00 по МСК. Детали
Программа:
• Что такое configuration drift?
• Какая может быть архитектура configuration drift?
• Рассмотрим пример реализации configuration drift
Ведет:
Александр Крылов – Опыт работы в DevOps более 7 лет. Постоянный спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.
13 Июня (Вторник) 19:00 по МСК. Детали
Программа:
• Что такое configuration drift?
• Какая может быть архитектура configuration drift?
• Рассмотрим пример реализации configuration drift
Ведет:
Александр Крылов – Опыт работы в DevOps более 7 лет. Постоянный спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.
/ Cisco AnyConnect for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM (High)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw
Cisco
Cisco Security Advisory: Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows…
A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM.…
/ Update. Barracuda Email Security Gateway Appliance (ESG) Vulnerability
ACTION NOTICE: Impacted ESG appliances must be immediately replaced regardless of patch version level.
Barracuda’s remediation recommendation at this time is full replacement of the impacted ESG:
https://www.barracuda.com/company/legal/esg-vulnerability
Prev post:
https://news.1rj.ru/str/sysadm_in_channel/4655
ACTION NOTICE: Impacted ESG appliances must be immediately replaced regardless of patch version level.
Barracuda’s remediation recommendation at this time is full replacement of the impacted ESG:
https://www.barracuda.com/company/legal/esg-vulnerability
Prev post:
https://news.1rj.ru/str/sysadm_in_channel/4655
/ MFA is no protection against this critical new Fortinet vulnerability, CVE-2023-27997
https://www.thestack.technology/fortinet-vulnerability-vpn-cve-2023-27997/
https://www.thestack.technology/fortinet-vulnerability-vpn-cve-2023-27997/
The Stack
MFA no protection against new Fortinet bug CVE-2023-27997
"It is a pre-auth RCE [and] has been proven to be exploitable in a consistent manner; we found it during a Red Team engagement and have exploited it remotely..."
15, 20 в Алматы пройдет несколько ИБ-ивента
- 15 июня проведет Trend Micro в рамках мирового роадшоу Risk to Resilience: https://resources.trendmicro.com/R2R-WT23-Almaty-Russian.html
- 20 июня - впервые в Казахстане состоится Positive Security Day (будет даже А.Лукацкий): https://psdaykz.ptsecurity.com/
- 15 июня проведет Trend Micro в рамках мирового роадшоу Risk to Resilience: https://resources.trendmicro.com/R2R-WT23-Almaty-Russian.html
- 20 июня - впервые в Казахстане состоится Positive Security Day (будет даже А.Лукацкий): https://psdaykz.ptsecurity.com/
/ Elastic Security Labs has discovered the SPECTRALVIPER malware
https://www.elastic.co/security-labs/elastic-charms-spectralviper
https://www.elastic.co/security-labs/elastic-charms-spectralviper
www.elastic.co
Elastic charms SPECTRALVIPER — Elastic Security Labs
Elastic Security Labs has discovered the P8LOADER, POWERSEAL, and SPECTRALVIPER malware families targeting a national Vietnamese agribusiness. REF2754 shares malware and motivational elements of the REF4322 and APT32 activity groups.
/ UI Bug in Visual Studio Lets Attackers Impersonate Publishers
https://www.varonis.com/blog/visual-studio-bug
https://www.varonis.com/blog/visual-studio-bug
Varonis
Imposter Syndrome: UI Bug in Visual Studio Lets Attackers Impersonate Publishers
Varonis Threat Labs found a bug in Microsoft Visual Studio installer that allows an attacker to impersonate a publisher and issue a malicious extension to compromise a targeted system
🚀 Experience the Power of AI-Powered Anomaly Detection in Netdata!
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
/ Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
Microsoft News
Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
A multi-stage adversary-in-the-middle (AiTM) and business email compromise (BEC) attack targets banking and financial services organizations.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Skuld: The Infostealer that Speaks Golang
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
Trellix
Skuld: The Infostealer that Speaks Golang
In May 2023, the Trellix Advanced Research Center discovered a new Golang stealer, known as Skuld, that compromised systems worldwide. The malware targets sensitive information stored in certain applications, such as Discord and web browsers, and the Windows…
Открытый практикум Networks by Rebrain: Основы построения Wi-Fi сетей
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
Open SysConf'23 ⚡ День Х: 16 сентября (Суббота)
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️
/ Two XSS Vulnerabilities in Azure with Embedded postMessage IFrames
https://orca.security/resources/blog/examining-two-xss-vulnerabilities-in-azure-services/
https://orca.security/resources/blog/examining-two-xss-vulnerabilities-in-azure-services/
/ MOVEit Transfer Critical Vulnerability – CVE Pending (June 15, 2023)
Dedcriptions. Mitigation Steps:
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
Dedcriptions. Mitigation Steps:
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
Progress
MOVEit Transfer Critical Vulnerability – CVE-2023-35708 (June 15, 2023) - Progress Community
Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted…
/ VMware ESXi Zero-Day Used by Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors
https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass
https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass
Google Cloud Blog
VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant…
/ Mystic Stealer – Evolving “stealth” Malware
Mystic Stealer has begun to establish a stronger foothold in the threat landscape, as evidenced by the rising number of command and control (C2) panels observed in the wild... 50 active command and control (C2) servers, indicating the growing prevalence of this threat..
Denoscriptions. Mitigation steps:
https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware/
Mystic Stealer has begun to establish a stronger foothold in the threat landscape, as evidenced by the rising number of command and control (C2) panels observed in the wild... 50 active command and control (C2) servers, indicating the growing prevalence of this threat..
Denoscriptions. Mitigation steps:
https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware/
CYFIRMA
Mystic Stealer - Evolving "stealth" Malware - CYFIRMA
EXECUTIVE SUMMARY Information stealers pose an ongoing and dynamic threat to the security of both individuals and organizations. CYFIRMA’s Research...
/ Microsoft Response to Layer 7 Distributed Denial of Service (DDoS) Attacks
https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/
https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/
/ Massive phishing company with many faked websites
Of course.. which marked in OpenBLD.net DNS :)
https://bolster.ai/blog/brand-impersonation-scam
Of course.. which marked in OpenBLD.net DNS :)
https://bolster.ai/blog/brand-impersonation-scam
Bolster AI
Brand Impersonation Campaign Targeting Big Brands
Bolster's threat research team uncovered a widespread brand impersonation scam campaign targeting 100+ clothing, footwear, and apparel brands.