Forwarded from OpenBLD.net (Yevgeniy Goncharov)
🚀 Exciting October'23 Upgrades at OpenBLD.net!
We're thrilled to unveil the latest enhancements in our OpenBLD.net ecosystem. Here's what's new:
🔹 New Filtering Routine Server
Strengthening the core of OpenBLD.net with a brand new filtering routine server.
🔹 Enhanced Performance
Boosted RAM and CPU power on select servers for even smoother operation.
🔹 German Server Addition
Testing out a new server in Germany for ada.openbld.net frontend scoping.
🔹 Rule Tweaks
Updated blocking rules to better combat abused IPs and CIDRs.
🔹 Improved Resource Handling
Optimized performance for web resources like
🔹 New site: With GitHub collaboration opportunities: https://openbld.net
🚫 Reducing Threats: We've successfully blocked Kazakhstan-associated YoroTrooper attacks and the threat of spying on your iPhone. Plus, we've thwarted Keepass faked malware.
📢 Stay Connected:
- Join our official Telegram
- Follow us on LinkedIn
OpenBLD.net is your go-to service for a cleaner, distraction-free online experience.
Help us make the internet a better place for all! 💪
#OpenBLD #InternetSecurity #Upgrade2023
We're thrilled to unveil the latest enhancements in our OpenBLD.net ecosystem. Here's what's new:
Strengthening the core of OpenBLD.net with a brand new filtering routine server.
Boosted RAM and CPU power on select servers for even smoother operation.
Testing out a new server in Germany for ada.openbld.net frontend scoping.
Updated blocking rules to better combat abused IPs and CIDRs.
Optimized performance for web resources like
Krisha, IvI, and Yandex Maps.🚫 Reducing Threats: We've successfully blocked Kazakhstan-associated YoroTrooper attacks and the threat of spying on your iPhone. Plus, we've thwarted Keepass faked malware.
- Join our official Telegram
- Follow us on LinkedIn
OpenBLD.net is your go-to service for a cleaner, distraction-free online experience.
Help us make the internet a better place for all! 💪
#OpenBLD #InternetSecurity #Upgrade2023
Please open Telegram to view this post
VIEW IN TELEGRAM
openbld.net
OpenBLD.net - fast, free DNS that blocks ads, trackers, malware — with DoH, DoT, GeoDNS | OpenBLD.net DNS - Block advertising,…
OpenBLD.net — ultra-fast DNS with ad blocking and proactive cybersecurity. Be yourself, be focused.
/ SYSTEM MANAGEMENT MODE SPECULATIVE EXECUTION ATTACKS
https://eclypsium.com/blog/system-management-mode-speculative-execution-attacks/
https://eclypsium.com/blog/system-management-mode-speculative-execution-attacks/
Eclypsium | Supply Chain Security for the Modern Enterprise
System Management Mode Speculative Execution Attacks - Eclypsium
Eclypsium researchers have discovered a new application of speculative execution attacks, bypassing hardware-based memory protections.
/ Active Directory Advanced Threat Hunting - Identify vulnerabilities before others do
https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting
https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting
/ CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/
https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/
Unit 42
CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
We analyze an attack path starting with GitHub IAM exposure and leading to creation of AWS Elastic Compute instances — which TAs used to perform cryptojacking.
/ Dealing with MITRE ATT&CK®’s different levels of detail
- https://www.lacework.com/blog/dealing-with-mitre/
- https://www.lacework.com/blog/dealing-with-mitre/
Fortinet
Cloud-Native Application Protection Platform (CNAPP)
Lacework FortiCNAPP is the most comprehensive cloud-native application protection platform available. AI-driven and organically developed, it empowers organizations to easily secure everything from code to cloud.
/ Affected Apache
Official announcement:
🔹 https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
🔹 https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/
ActiveMQOfficial announcement:
Please open Telegram to view this post
VIEW IN TELEGRAM
Rapid7
Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 | Rapid7 Blog
/ YouTube is getting serious about blocking ad blockers
https://www.theverge.com/2023/10/31/23940583/youtube-ad-blocker-crackdown-broadening
https://www.theverge.com/2023/10/31/23940583/youtube-ad-blocker-crackdown-broadening
The Verge
YouTube is getting serious about blocking ad blockers
YouTube wants users to allow ads or sign up for Premium.
New BiBi-Linux Wiper Malware
https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group
Security Joes
BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group
Security Joes Incident Response team volunteered to assist Israeli companies during the times of war between the state of Israel and the terrorist organization Hamas. During the forensics investigation, we found what appears to be a new Linux Wiper malware…
CVE-2023-4911 and Looney Tunables Vulnerability
Utilizing a rudimentary yet typical PHPUnit vulnerability exploit attack:
https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kinsing
P.S. IoC; Exploit download site sended to OpenBLD.net
Utilizing a rudimentary yet typical PHPUnit vulnerability exploit attack:
https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kinsing
P.S. IoC; Exploit download site sended to OpenBLD.net
Aqua
Looney Tunables Vulnerability Exploited by Kinsing
We intercepted Kinsing's experimental incursions into cloud environments and have uncovered their efforts to manipulate the Looney Tunables vulnerability.
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
Время идет, количество пользователей растет, мощности серверов растут, это требует большего количества серверов и денег, бюджет которых уже расписан и распределен.
Так как сервис еще является защитой от вредоносов, то и авторы вредоносов пытаются активно
В виду вышесказанного планируется внести некоторые изменения в архитектуру OpenBLD.net:
DNS 53DoT, DoHКто может внести вклад в проект OpenBLD.net не стесняйтесь. Как это можно сделать и какой бенефит Вас может ждать от этого. можно посмотреть здесь - https://openbld.net/docs/donation/
🤝 Спасибо всем кто помогал и помогает. Благ вам по жизни!
Всем Peace ✌️
Please open Telegram to view this post
VIEW IN TELEGRAM
openbld.net
Donation and Contribution | OpenBLD.net DNS - Block advertising, tracking, telemetry, malicious domains and more for free
You can support the OpenBLD DNS Project through various activities:
Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.
This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.
Ande next: CVE-2023-38548
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service..:
https://www.veeam.com/kb4508
This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.
Ande next: CVE-2023-38548
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service..:
https://www.veeam.com/kb4508
Veeam Software
KB4508: CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723
Security update regarding: CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723
Открытый практикум Linux by Rebrain: Обнаружение и просмотр устройств в Linux
Время:
↘ 15 Ноября (Среда) 19:00 МСК. Детали
Программа:
• Утилиты для просмотра устройств: lspci, lsusb, dmidecode...
• Интерфейсы ядра в /proc и /sys
• Именование дисков и сетевых устройств
• Просмотр свойств сетевых устройств с ethtool
Ведёт:
• Даниил Батурин – Основатель проекта VyOS, системы для корпоративных и провайдерских маршрутизаторов с открытым исходным кодом.
Время:
↘ 15 Ноября (Среда) 19:00 МСК. Детали
Программа:
• Утилиты для просмотра устройств: lspci, lsusb, dmidecode...
• Интерфейсы ядра в /proc и /sys
• Именование дисков и сетевых устройств
• Просмотр свойств сетевых устройств с ethtool
Ведёт:
• Даниил Батурин – Основатель проекта VyOS, системы для корпоративных и провайдерских маршрутизаторов с открытым исходным кодом.
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
Последнее время я дебажил проблему, исходя из полученных сведений, мне удалось нивелировать часть вредоносного трафика, примерно на 50%.
Ближайшие сутки процент увеличится, а время ответа серверов сократится...
Трафик шел из разных стран, из разных сред облачных провайдеров (как пример Linode)...
Сейчас готов скрипт который вычленяет циклы запросов и отдает их в специльный DROP пулл.
В общем пока справляемся, конечные пользователи OpenBLD.net практически не ощутили флуд-эффекта и это радует.
Не будучи пальцем деланы. Развивайтесь друзья мои ✊️️️️️️️
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Google ad distributes malicious CPU-Z
One common technique used by threat actors to evade detection is to employ cloaking. Anyone clicking on the ad and who’s not the intended victim will see a standard blog with a number of articles..:
https://www.malwarebytes.com/blog/threat-intelligence/2023/11/malvertiser-copies-pc-news-site-to-deliver-infostealer
One common technique used by threat actors to evade detection is to employ cloaking. Anyone clicking on the ad and who’s not the intended victim will see a standard blog with a number of articles..:
https://www.malwarebytes.com/blog/threat-intelligence/2023/11/malvertiser-copies-pc-news-site-to-deliver-infostealer
/ Detecting “Effluence”, An Unauthenticated Confluence Web Shell
Confluence under attack... vulnerability allows an attacker to gain unauthorized access to the administrative areas of a Confluence server:
https://www.aon.com/cyber-solutions/aon_cyber_labs/detecting-effluence-an-unauthenticated-confluence-web-shell/
Confluence under attack... vulnerability allows an attacker to gain unauthorized access to the administrative areas of a Confluence server:
https://www.aon.com/cyber-solutions/aon_cyber_labs/detecting-effluence-an-unauthenticated-confluence-web-shell/
Aon
Detecting
Discovering Effluence, a unique web shell accessible on every page of an infected Confluence
/ Uncovering thousands of unique secrets in PyPI packages
...PyPi packages and surfaced thousands of hardcoded credentials.
Let’s start with article authors, with the big reveal of what them found:
- 3.938 total unique secrets across all projects
- 768 of those unique secrets were found to be valid
- 2.922 projects contained at least one unique secret
https://blog.gitguardian.com/uncovering-thousands-of-unique-secrets-in-pypi-packages/
...PyPi packages and surfaced thousands of hardcoded credentials.
Let’s start with article authors, with the big reveal of what them found:
- 3.938 total unique secrets across all projects
- 768 of those unique secrets were found to be valid
- 2.922 projects contained at least one unique secret
https://blog.gitguardian.com/uncovering-thousands-of-unique-secrets-in-pypi-packages/
GitGuardian Blog - Take Control of Your Secrets Security
Uncovering thousands of unique secrets in PyPI packages
Security Researcher Tom Forbes worked with the GitGuardian team to analyze all the code committed to PyPi packages and surfaced thousands of hardcoded credentials.
/ StopRansomware: Royal Ransomware
Remort from CISA. According to third-party reporting, Royal actors most commonly (in 66.7% of incidents) gain initial access to victim networks via successful phishing emails:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
Remort from CISA. According to third-party reporting, Royal actors most commonly (in 66.7% of incidents) gain initial access to victim networks via successful phishing emails:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
/ Windows DWM Core Library Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036
/ Microsoft guidance regarding credentials leaked to GitHub Actions Logs through Azure CLI
Vulnerability where Azure Command-Line Interface (CLI) could expose sensitive information, including credentials, through GitHub Actions logs:
🔹 https://msrc.microsoft.com/blog/2023/11/microsoft-guidance-regarding-credentials-leaked-to-github-actions-logs-through-azure-cli/
Vulnerability where Azure Command-Line Interface (CLI) could expose sensitive information, including credentials, through GitHub Actions logs:
Please open Telegram to view this post
VIEW IN TELEGRAM