/ UI Bug in Visual Studio Lets Attackers Impersonate Publishers
https://www.varonis.com/blog/visual-studio-bug
https://www.varonis.com/blog/visual-studio-bug
Varonis
Imposter Syndrome: UI Bug in Visual Studio Lets Attackers Impersonate Publishers
Varonis Threat Labs found a bug in Microsoft Visual Studio installer that allows an attacker to impersonate a publisher and issue a malicious extension to compromise a targeted system
🚀 Experience the Power of AI-Powered Anomaly Detection in Netdata!
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
Revolutionize your infrastructure monitoring with Netdata's cutting-edge AI/ML capabilities. Discover the next level of automated anomaly detection and prediction, setting new standards for open-source monitoring tools 💪️️️️
Prepare to be amazed by Netdata's anomaly features and unlock these remarkable qualities:
— Anomaly Advisor: Quickly surface potentially anomalous metrics and charts
— Predictive Analytics: Leverage AI and ML to predict future trends and potential issues
— Real-Time Anomaly Detection: With ML predictions for each collected metric
— Alerting and Remediation: Intelligent alerting with AI and ML to create context-aware alerts
— Non-stop Research and Development: Developers actively explore and develop new AI and ML-driven features
🔧 How It Works: See detailed article
Whether you're involved in metric collection, monitoring, or observability, Netdata.cloud is your ultimate destination ✨ Peace ✌️
/ Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
Microsoft News
Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
A multi-stage adversary-in-the-middle (AiTM) and business email compromise (BEC) attack targets banking and financial services organizations.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Skuld: The Infostealer that Speaks Golang
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
This new malware strain tries to steal sensitive information from its victims..:
https://www.trellix.com/en-us/about/newsroom/stories/research/skuld-the-infostealer-that-speaks-golang.html
Trellix
Skuld: The Infostealer that Speaks Golang
In May 2023, the Trellix Advanced Research Center discovered a new Golang stealer, known as Skuld, that compromised systems worldwide. The malware targets sensitive information stored in certain applications, such as Discord and web browsers, and the Windows…
Открытый практикум Networks by Rebrain: Основы построения Wi-Fi сетей
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
• 22 Июня (Четверг), 20:00 по МСК. Детали
Программа:
• Физические основы передачи радиосигналов
• Планирование и развёртывание WLAN
• Расширенная настройка точек доступа и радиомостов
• Тестирование производительности и защита от атак
Ведет:
• Ольга Яновская – Ph.D. in Information Technology. Cisco NetAcad Instructor/Instructor-Trainer. Ведущий сетевой инженер.
Open SysConf'23 ⚡ День Х: 16 сентября (Суббота)
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️
Парни и девочки, день Open SysConf'23 встречи - 16 сентября (суббота) 2023.
Подтягиваем ширинки, блузки, гладим шнурки и волосы (у кого есть) и намереваемся на встречу в этот прекрасный и уверен солнечный во всех отношениях день ☀️
Возможно нашей встрече не хватает именно твоего доклада..?
— Форма регистрации докладчика
Место проведения: выбирается. Локация: Казахстан, г.Алматы.
Всем Peace ✌️
/ Two XSS Vulnerabilities in Azure with Embedded postMessage IFrames
https://orca.security/resources/blog/examining-two-xss-vulnerabilities-in-azure-services/
https://orca.security/resources/blog/examining-two-xss-vulnerabilities-in-azure-services/
/ MOVEit Transfer Critical Vulnerability – CVE Pending (June 15, 2023)
Dedcriptions. Mitigation Steps:
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
Dedcriptions. Mitigation Steps:
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
Progress
MOVEit Transfer Critical Vulnerability – CVE-2023-35708 (June 15, 2023) - Progress Community
Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted…
/ VMware ESXi Zero-Day Used by Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors
https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass
https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass
Google Cloud Blog
VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant…
/ Mystic Stealer – Evolving “stealth” Malware
Mystic Stealer has begun to establish a stronger foothold in the threat landscape, as evidenced by the rising number of command and control (C2) panels observed in the wild... 50 active command and control (C2) servers, indicating the growing prevalence of this threat..
Denoscriptions. Mitigation steps:
https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware/
Mystic Stealer has begun to establish a stronger foothold in the threat landscape, as evidenced by the rising number of command and control (C2) panels observed in the wild... 50 active command and control (C2) servers, indicating the growing prevalence of this threat..
Denoscriptions. Mitigation steps:
https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware/
CYFIRMA
Mystic Stealer - Evolving "stealth" Malware - CYFIRMA
EXECUTIVE SUMMARY Information stealers pose an ongoing and dynamic threat to the security of both individuals and organizations. CYFIRMA’s Research...
/ Microsoft Response to Layer 7 Distributed Denial of Service (DDoS) Attacks
https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/
https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/
/ Massive phishing company with many faked websites
Of course.. which marked in OpenBLD.net DNS :)
https://bolster.ai/blog/brand-impersonation-scam
Of course.. which marked in OpenBLD.net DNS :)
https://bolster.ai/blog/brand-impersonation-scam
Bolster AI
Brand Impersonation Campaign Targeting Big Brands
Bolster's threat research team uncovered a widespread brand impersonation scam campaign targeting 100+ clothing, footwear, and apparel brands.
KazHackStan 2023: 13-15 Сентября
Масштабная конфа, где в течении трех дней будет представлена масса полезной инфы из разделов тематик:
• Government & Business - примеры взаимодействия, мастер-классы
• Secure Development - принципы безопасной разработки ПО
• Hacking - окажутся практические навыки и техники хакерства
Все 3 дня будет происходит кибер-битва CyberKumbez, где команды хакеров будут соревноваться за звание лучшей хакерской группы, а также взламывать новейший кибер-полигон
Все детали на сайте: kazhackstan.com
Тизер: https://www.youtube.com/watch?v=3eMuJZ8hN4s
Масштабная конфа, где в течении трех дней будет представлена масса полезной инфы из разделов тематик:
• Government & Business - примеры взаимодействия, мастер-классы
• Secure Development - принципы безопасной разработки ПО
• Hacking - окажутся практические навыки и техники хакерства
Все 3 дня будет происходит кибер-битва CyberKumbez, где команды хакеров будут соревноваться за звание лучшей хакерской группы, а также взламывать новейший кибер-полигон
Все детали на сайте: kazhackstan.com
Тизер: https://www.youtube.com/watch?v=3eMuJZ8hN4s
OpenBLD.net DNS - Settings Updation Notice
- Who uses DoH/DoT
- Change/Update ✨️️️️️️iOS, macOS Profile
- If you are using DNS IP
~~~
• How to EN - https://lab.sys-adm.in/wiki/getting-started/setup
• How to RU - https://lab.sys-adm.in/ru/wiki/getting-started/setup
- Who uses DoH/DoT
bld.sys-adm.in (will deprecated) please switch to 🚀️️️️ ada.openbld.net- Change/Update ✨️️️️️️iOS, macOS Profile
- If you are using DNS IP
109.234.39.72 (will deprecated) switch to 46.151.29.15~~~
• How to EN - https://lab.sys-adm.in/wiki/getting-started/setup
• How to RU - https://lab.sys-adm.in/ru/wiki/getting-started/setup
Открытый практикум Networks by Rebrain: Дизайн multi-area OSPF
• 29 Июня (Четверг, 19:00 МСК). Детали
Программа:
• Преимущества и недостатки разбития OSPF на area
• Принципы работы stub/nssa area в OSPF
• Какие плюсы можно получить и когда стоит применять различные типы area
Ведет:
• Дмитрий Радчук – Team Lead Вконтакте. CCIE x4. Опыт работы с сетями больше 12 лет.
• 29 Июня (Четверг, 19:00 МСК). Детали
Программа:
• Преимущества и недостатки разбития OSPF на area
• Принципы работы stub/nssa area в OSPF
• Какие плюсы можно получить и когда стоит применять различные типы area
Ведет:
• Дмитрий Радчук – Team Lead Вконтакте. CCIE x4. Опыт работы с сетями больше 12 лет.
/ How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover
https://www.descope.com/blog/post/noauth
https://www.descope.com/blog/post/noauth
Descope
nOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover
This blog will cover an authentication implementation flaw Descope discovered in Microsoft Azure AD OAuth applications that, when exploited, could lead to full account takeover.
/ IoT devices and Linux-based systems targeted by OpenSSH trojan campaign
https://www.microsoft.com/en-us/security/blog/2023/06/22/iot-devices-and-linux-based-systems-targeted-by-openssh-trojan-campaign/
https://www.microsoft.com/en-us/security/blog/2023/06/22/iot-devices-and-linux-based-systems-targeted-by-openssh-trojan-campaign/
Microsoft News
IoT devices and Linux-based systems targeted by OpenSSH trojan campaign
Microsoft discovered an attack using a patched version of OpenSSH to take control of impacted devices and install cryptomining malware.
/ Advisory: IDOR in Microsoft Teams Allows for External Tenants to Introduce Malware
https://labs.jumpsec.com/advisory-idor-in-microsoft-teams-allows-for-external-tenants-to-introduce-malware/
https://labs.jumpsec.com/advisory-idor-in-microsoft-teams-allows-for-external-tenants-to-introduce-malware/
JUMPSEC Labs
Advisory: IDOR in Microsoft Teams Allows for External Tenants to Introduce Malware
TL;DR
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
BlackLotus Mitigation Guide from NSA
https://media.defense.gov/2023/Jun/22/2003245723/-1/-1/0/CSI_BlackLotus_Mitigation_Guide.PDF
https://media.defense.gov/2023/Jun/22/2003245723/-1/-1/0/CSI_BlackLotus_Mitigation_Guide.PDF