/ WormGPT – The Generative AI Tool Cybercriminals Are Using to Launch Business Email Compromise Attacks

https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/

/ CISA Develops Factsheet for Free Tools for Cloud Environments

https://www.cisa.gov/news-events/alerts/2023/07/17/cisa-develops-factsheet-free-tools-cloud-environments

/ Massive Targeted Exploit Campaign Against WooCommerce Payments Underway

Tactics, Techniques, and Procedures (TTPs):

https://www.wordfence.com/blog/2023/07/massive-targeted-exploit-campaign-against-woocommerce-payments-underway/

/ Remote Code Execution in OpenSSH's forwarded ssh-agent

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host ... can access the local agent through the forwarded connection… CVE-2023-38408:

— https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt

Открытый практикум Networks by Rebrain: Ethernet over IP
 
• 27 Июля (Четверг), 20:00 по МСК. Детали

Программа:
• Всегда ли нужен L3 VPN
• Как работают EoIP / Layer-2 GRE / L2TPv3
• Примеры конфигураций и сценарии использования

Ведет:
• Ольга Яновская – Руководитель направления Networks by Rebrain. Ph.D. in Information Technology. Cisco NetAcad Instructor / NetAcad Success Lead / Instructor-Trainer.

Compromised Microsoft Key: More Impactful Than We Thought

https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr

/ Atlassian has RCE in Confluence, Bamboo

..vulnerabilities included critical and high severity vulnerabilities which have been fixed in new versions of Atlassian products, released in the last month:

https://confluence.atlassian.com/security/security-bulletin-july-18-2023-1251417643.html

/ Citrix ADC Gateway RCE: CVE-2023-3519 is Exploitable, and 53% of Servers Are Unpatched

https://bishopfox.com/blog/citrix-adc-gateway-rce-cve-2023-3519

/ Apple - sandboxed process may be able to circumvent sandbox restriction

and more fixes/updates:

https://support.apple.com/en-us/HT213843

AMD CPU Sensitive Information Disclosure Vulnerability

https://lock.cmpxchg8b.com/zenbleed.html

🚀 OpenBLD.net DNS and Netdata Anomaly Detection
 
At OpenBLD.net, we believe in the power of collaboration and open-source initiatives. That's why we're thrilled to announce our partnership with Netdata, a leading player in the open-source monitoring solution tool. In the spirit of supporting like-minded projects, Netdata has generously provided free access to the business-grade plan on Netdata Cloud for OpenBLD.net ecosystem.

Now OpenBLD.net DNS has additional opportunity will be proactively Cyber Defence oriented service 😎

⚙️ How Netdata's ML-based Anomaly Detection Works
⚙️ How to agentless setup OpenBLD.net
⚡ Main OpenBLD goals

/ Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points

Attacks Against Windows IIS Web Servers:

https://asec.ahnlab.com/en/55369/

/ Exploiting MikroTik RouterOS Hardware with CVE-2023-30799

Up until version 6.49.8 (July 20, 2023), MikroTik RouterOS Long-term was vulnerable to CVE-2023-30799. Remote and authenticated attackers can use the vulnerability to get a root shell on the router..:

— https://vulncheck.com/blog/mikrotik-foisted-revisited

Открытый практикум Networks by Rebrain: Просто о сложном - FreeSWITCH
 
• 3 Августа (Четверг), 19:00 МСК. Детали

Программа:
• SIP Профили (Internal, External - в чем их отличие)
• Как настроить Gateway
• Рассмотрим Dialplan (regex)
• Настроим маршрутизацию для настроенного Gateway
• Рассмотрим механизм ACL

Ведет:
• Роман Сыртланов – VoIP инженер. Опыт работы с VoIP 7 лет. Работает с Asterisk/FreeSWITCH/Kamailio

/ GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux affect 40% of Ubuntu cloud workloads

https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability

/ Multiple Vulnerabilities in Microsoft Message Queuing Service

Affected platforms: Windows
Impacted parties: Microsoft Windows users with Microsoft Message Queuing service installed
Impact: Remote code execution and denial-of-service
Severity level: Critical and Important

https://www.fortinet.com/blog/threat-research/microsoft-message-queuing-service-vulnerabilities

Йоу 🤘. Open SysConf'23 16 Сентября точно быть!
 
В этом году Open SysConf.io поддержала локацией и всем сопутствующим команда из Kolesa Group

В итоге у нас есть:
— Комфортное пространство на ~100 человек
— Онлайн трансляция и хороший интернет
— Возможность подкрепиться, утолить жажду
— Отличный лофт для знакомств, нетворкинга, приобретения новых связей и возможно даже новой работы
— И конечно возможность для самореализации в отношении докладов и бесед

Форма регистрации посетителя скоро будет готова, если ты 100% уверен, что придешь, то начинай тренировать скорость клика, так как места на оффлайн участие будут ограничены 😎

Скоро будет больше деталей, следите и ждите обновлений:
— https://sysconf.io/ru
 

/ APT Bahamut Targets Individuals with Android Malware Using Spear Messaging

In this specific attack, the threat actor conducted targeted spear messaging attacks on WhatsApp Messenger..:

https://www.cyfirma.com/outofband/apt-bahamut-targets-individuals-with-android-malware-using-spear-messaging/

Top 10 Active Directory Attack Methods

https://www.lepide.com/blog/top-10-active-directory-attack-methods/

/ Canon Printers Disclosure Wi-Fi Sensitive information

Sensitive information on the Wi-Fi connection settings stored in the memories of inkjet printers (home and office/large format) may not be deleted by the usual initialization process.

CP2023-003 Vulnerability Mitigation/Remediation for Inkjet Printers:

— https://psirt.canon/advisory-information/cp2023-003/