📢 Открытый практикум DevOps by Rebrain: IT-Quiz
⁠
↘ Регистрация

Время:

26 Декабря (Вторник) в 19:00 по МСК

Программа:

• Решаем 3 задачки в онлайн-формате
• Получаем подарки за выполнение заданий
• Проводим розыгрыш New Year Sale by Rebrain

Ведёт:

Василий Озеров – Co-Founder REBRAIN. Руководит международной командой в рамках своего агентства Fevlake. Более 8 лет Devops практик.

/ Android Banking Trojan Chameleon can now bypass any Biometric Authentication

https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action

/ The Rising Threat Of Phishing Attacks With Crypto Drainers

Unmasking Deceptive Tactics: A recent investigation by Check Point Research exposes a troubling trend in the cryptocurrency landscape. The cryptocurrency community has been witnessing an alarming increase in sophisticated phishing attacks..:

https://research.checkpoint.com/2023/the-rising-threat-of-phishing-attacks-with-crypto-drainers/

/ use-after-free vulnerability in the implementation in Linux kernel nf_tables

Openwall note: https://www.openwall.com/lists/oss-security/2023/12/22/6

Exploit prototype - https://www.openwall.com/lists/oss-security/2023/12/22/6/1

🚀 Glad to present the new release zDNS v0.1.3! 🎉

Following Zero Trust practices, I recently wrote and am slowly beginning to introduce new “blackhole” functionality into the OpenBLD.net DNS ecosystem

zDNS is a DNS server that puts security and control over DNS queries at the center. With new functionality, zDNS now supports regular expressions in hosts.txt files, allowing more flexibility in configuring allowed queries. Now you can use the power of regular expressions to precisely control permissions, including subdomains and patterns.

Main features:

🛑 Denies all DNS queries by default.
✅ Allows you to configure allowed requests through the hosts.txt file.
🔄 Uses balancing strategies to ensure reliable operation with DNS servers.
🛠Easily customizable via YAML configuration.
🔜 Prometheus metrics coming soon

Additional protection of your infrastructure or testing requests with zDNS is possible and may be useful to you! Download the latest version here and start using a DNS server with powerful customization options:

https://github.com/m0zgen/zdns/tree/dev

#zDNS #DNS #Security #Release #News

/ RAR SFX with LNK Infection Vector

https://www.deepinstinct.com/blog/threat-actor-uac-0099-continues-to-target-ukraine

/ Compromising Google Accounts: Malwares Exploiting Undocumented OAuth2 Functionality for session hijacking

https://cloudsek.com/blog/compromising-google-accounts-malwares-exploiting-undocumented-oauth2-functionality-for-session-hijacking

Open Thank You Message.

First of all, thanks to all users of the OpenBLD.net service. Thank you for trusting, service using, contributing and providing feedback.

Some companies, like the people in them, also trust the service and support it with system resources and OSS licenses, which allows the service to grow, be faster, and expand points of presence around the world.

Thanks everyone. I also wrote an Open Tnak You Letter in my blog post to everyone who supported.

Everyone who wants to support, add their logo or name to the project website, support the OpenBLD.net project and receive this benefits.

Peace to all ✌️

/ Hyper-V RCE and Kerberos Bypass

MS released two fixes for..:

Windows Kerberos Security Feature Bypass Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674

Windows Hyper-V Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20700

📢 Открытый практикум DevOps by Rebrain: Запуск Nginx и Angie в Docker
⁠
↘ Регистрация

Время:

16 Января (Вторник) 19:00 МСК

Программа:

• Основы контейнеризации веб-сервера
• Зачем использовать контейнер для Nginx
• Особенности веб-сервера Angie и сравнение с Nginx
• Запуск Nginx и Angie в Docker-контейнерах
• Настройка конфигурации
• Работа с логами
• Хранение данных веб-приложения

Ведёт:

• Николай Лавлинский – Технический директор. Веб-разработчик более 15 лет. Спикер конференций HighLoad++, РИТ++. Специализация: ускорение сайтов и веб-приложений

/ The malware is spread over SSH protocol using a custom Mirai botnet that was modified by the threat actors.

https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining

/ Hundreds of Thousands of Dollars Worth of Solana Cryptocurrency Assets Stolen in Recent CLINKSINK Drainer Campaigns

- Overview of CLINKSINK Drainer Campaigns
- Initial Analysis of CLINKSINK
- Distribution of Stolen Solana Cryptocurrency Funds
- Multiple DaaS Offerings Use CLINKSINK
- Outlook and Implications
- YARA Rules

https://www.mandiant.com/resources/blog/solana-cryptocurrency-stolen-clinksink-drainer-campaigns

JunOS RCE (critical status)

https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Security-Vulnerability-in-J-web-allows-a-preAuth-Remote-Code-Execution-CVE-2024-21591?language=en_US

/ CVE-2023-4001: a vulnerability in the (downstream) GRUB boot manager

https://dfir.ru/2024/01/15/cve-2023-4001-a-vulnerability-in-the-downstream-grub-boot-manager/

/ CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign

This blog delves into the Phemedrone Stealer campaign's exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion and investigates the malware's payload:

https://www.trendmicro.com/en_us/research/24/a/cve-2023-36025-exploited-for-defense-evasion-in-phemedrone-steal.html