/ A false-alarm incident involving Panda Security software leads to three very real CVEs
..an attacker might be able to achieve RCE by chaining CVE-2023-6330 with other vulnerabilities..:
https://news.sophos.com/en-us/2024/01/25/multiple-vulnerabilities-discovered-in-widely-used-security-driver/
..an attacker might be able to achieve RCE by chaining CVE-2023-6330 with other vulnerabilities..:
https://news.sophos.com/en-us/2024/01/25/multiple-vulnerabilities-discovered-in-widely-used-security-driver/
Sophos News
Multiple vulnerabilities discovered in widely used security driver
A false-alarm incident involving Panda Security software leads to three very real CVEs
/ Prevent credential exposure with OIDC for GitHub Actions
Many different CI/CD patterns that cause us to raise our eyebrows. One situation in particular that we encounter relatively often is the unsafe use of AWS credentials.
OpenID Connect is an authentication standard, which when coupled with GitHub Actions, offers a more secure alternative for authentication when compared to utilizing traditional access keys..:
https://blog.cloudsecuritypartners.com/oidc-for-github-actions/
Many different CI/CD patterns that cause us to raise our eyebrows. One situation in particular that we encounter relatively often is the unsafe use of AWS credentials.
OpenID Connect is an authentication standard, which when coupled with GitHub Actions, offers a more secure alternative for authentication when compared to utilizing traditional access keys..:
https://blog.cloudsecuritypartners.com/oidc-for-github-actions/
Cloud Security Partners Blog
OIDC for GitHub Actions
At Cloud Security Partners, we perform a lot of code reviews and Cloud Security Assessments. During these engagements, we see many different CI/CD patterns that cause us to raise our eyebrows. One situation in particular that we encounter relatively often…
/ DarkGate malware delivered via Microsoft Teams - detection and response
https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response
https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response
LevelBlue
DarkGate malware delivered via Microsoft Teams - detection…
Executive summary While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector. Most…
📢 Конкурс от Core 24/7 на 10 ваучеров на бесплатное обучение
Ваучеры дают 100% скидку на курс или экзамен из списка ниже до 17.01.2025:
— Каталог на Linux Foundation
— Сертификационному экзамену (каталог)
— или пакету (курс + сертификация)
Подвод итогов 9 февраля, детали здесь - https://core247.io/cncf
Ваучеры дают 100% скидку на курс или экзамен из списка ниже до 17.01.2025:
— Каталог на Linux Foundation
— Сертификационному экзамену (каталог)
— или пакету (курс + сертификация)
Подвод итогов 9 февраля, детали здесь - https://core247.io/cncf
/ Discovers Important Vulnerabilities in GNU C Library’s syslog()
https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog
https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog
Qualys
Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys
The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in the Linux environment.
/ GitHub Hardening Guide 🛡
Preambula:
Mercedes-Benz Source Code at Risk: GitHub Token Mishap Sparks Major Security Concerns
The story:
It all started during one of our internet scans where we identified a GitHub Token leaked by a Full Time Employee at Mercedez, in his GitHub Repository. The GitHub Token gave ‘unrestricted’ and ‘unmonitored’ access to the entire source code hosted at the Internal GitHub Enterprise Server. Redhunt Says.
Conclusion:
The essence of the story is this: even in large companies, failures happen, always be careful, scan tokens in workflow actions...
Next steps:
GitHub Hardening Guide: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
Preambula:
Mercedes-Benz Source Code at Risk: GitHub Token Mishap Sparks Major Security Concerns
The story:
It all started during one of our internet scans where we identified a GitHub Token leaked by a Full Time Employee at Mercedez, in his GitHub Repository. The GitHub Token gave ‘unrestricted’ and ‘unmonitored’ access to the entire source code hosted at the Internal GitHub Enterprise Server. Redhunt Says.
Conclusion:
The essence of the story is this: even in large companies, failures happen, always be careful, scan tokens in workflow actions...
Next steps:
GitHub Hardening Guide: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
Please open Telegram to view this post
VIEW IN TELEGRAM
RedHunt Labs
Mercedes-Benz Source Code at Risk: GitHub Token Mishap Sparks Major Security Concerns - RedHunt Labs
Preface In a recent turn of events, RedHunt Labs’ Attack Surface Management (ASM) research team uncovered a potentially disastrous data leak incident involving the automotive giant, Mercedes-Benz. This incident not...
📢 Практикумы DevOps, Linux, Networks, Golang: расписание на Февраль 2024
• 6 февраля DevOps: Проксирование в Nginx и Angie
• 7 февраля Linux: RAID массивы
• 8 февраля Linux: Погружение в VoIP3: Dialplan в Asterisk
• 12 февраля Linux: RAID массивы 2
• 13 февраля DevOps: Балансировка нагрузки в Nginx и Angie
• 14 февраля Linux: DWARF, ELF, ptrace или как работает ваш дебагер. Часть 2
• 15 февраля DevOps: Ментальная модель Kafka
Открытые Февральские практикумы - Все детали
• 6 февраля DevOps: Проксирование в Nginx и Angie
• 7 февраля Linux: RAID массивы
• 8 февраля Linux: Погружение в VoIP3: Dialplan в Asterisk
• 12 февраля Linux: RAID массивы 2
• 13 февраля DevOps: Балансировка нагрузки в Nginx и Angie
• 14 февраля Linux: DWARF, ELF, ptrace или как работает ваш дебагер. Часть 2
• 15 февраля DevOps: Ментальная модель Kafka
Открытые Февральские практикумы - Все детали
/ VajraSpy: A Patchwork of espionage apps
These apps share the same malicious functionality, being capable of exfiltrating the following:
- contacts,
- SMS messages,
- call logs,
- device location,
- a list of installed apps, and
files with specific extensions (.pdf, .doc, .docx, .txt, .ppt, .pptx, .xls, .xlsx, .jpg, .jpeg, .png, .mp3, .Om4a, .aac, and .opus).
Technical review:
https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/
These apps share the same malicious functionality, being capable of exfiltrating the following:
- contacts,
- SMS messages,
- call logs,
- device location,
- a list of installed apps, and
files with specific extensions (.pdf, .doc, .docx, .txt, .ppt, .pptx, .xls, .xlsx, .jpg, .jpeg, .png, .mp3, .Om4a, .aac, and .opus).
Technical review:
https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/
Welivesecurity
VajraSpy: A Patchwork of espionage apps
ESET researchers discovered several Android apps that posed as messaging tools but carried VajraSpy, a RAT used by the Patchwork APT group
/ HeadCrab 2.0: Evolving Threat in Redis Malware Landscape
Technical analysis of HeadCrab 2.0 advanced malware:
https://www.aquasec.com/blog/headcrab-2-0-evolving-threat-in-redis-malware-landscape/
Technical analysis of HeadCrab 2.0 advanced malware:
https://www.aquasec.com/blog/headcrab-2-0-evolving-threat-in-redis-malware-landscape/
Aqua
HeadCrab 2.0: Evolving Threat in Redis Malware Landscape
This is a second blog about HeadCrab, further analysis of the scope of threat, the malware, the techniques etc.
/ AnyDesk - compromised production systems
AnyDesk - compromised any keys:
https://anydesk.com/en/public-statement
AnyDesk - compromised any keys:
https://anydesk.com/en/public-statement
Anydesk
AnyDesk Trust Center
Founded in 2014, AnyDesk is one of the leading providers of remote desktop software worldwide. With more than 200 million sessions per month, AnyDesk empowers IT professionals to establish remote connections with customer devices to resolve technical issues.…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ runc: CVE-2024-21626: high severity container breakout attack
https://www.openwall.com/lists/oss-security/2024/01/31/6
https://www.openwall.com/lists/oss-security/2024/01/31/6
/ QNAP OS command injection vulnerability
Vulnerability in QTS, QuTS hero and QuTScloud (high):
https://www.qnap.com/en/security-advisory/qsa-23-47
Vulnerability in QTS, QuTS hero and QuTScloud (high):
https://www.qnap.com/en/security-advisory/qsa-23-47
QNAP Systems, Inc. - Network Attached Storage (NAS)
Vulnerability in QTS, QuTS hero and QuTScloud - Security Advisory
QNAP designs and delivers high-quality network attached storage (NAS) and professional network video recorder (NVR) solutions to users from home, SOHO to small, medium businesses.
/ SmartScreen Vulnerability CVE-2023-36025 - Exploring the Latest Mispadu Stealer Variant
https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/
https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/
Unit 42
Exploring the Latest Mispadu Stealer Variant
Evaluation of a new variant of Mispadu, a banking Trojan, highlights how infostealers evolve over time and can be hard to pin to past campaigns.
/ ResumeLooters gang infects websites with XSS noscripts and SQL injections to vacuum up job seekers' personal data and CVs
https://www.group-ib.com/blog/resumelooters/
https://www.group-ib.com/blog/resumelooters/
Group-IB
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks
ResumeLooters gang infects websites with XSS noscripts and SQL injections to vacuum up job seekers' personal data and CVs.
/ Critical Security Issue Affecting TeamCity On-Premises (CVE-2024-23917)
https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/
https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/
📢 Открытый практикум Linux by Rebrain: RAID массивы 2
• 12 Февраля (Понедельник) 20:00 МСК
Программа:
• Для чего нужна очистка метаданных mdadm?
• Как перенести данные с обычного диска на RAID1?
• Как понять был ли диск в RAID массиве mdadm?
• Как получить данные с диска из RAID1?
• Увеличение размера RAID массива
↘ Детали
Ведёт:
Андрей Буранов – Системный администратор VK Play. 10+ лет опыта работы с ОС Linux. 8+ лет опыта преподавания.
• 12 Февраля (Понедельник) 20:00 МСК
Программа:
• Для чего нужна очистка метаданных mdadm?
• Как перенести данные с обычного диска на RAID1?
• Как понять был ли диск в RAID массиве mdadm?
• Как получить данные с диска из RAID1?
• Увеличение размера RAID массива
↘ Детали
Ведёт:
Андрей Буранов – Системный администратор VK Play. 10+ лет опыта работы с ОС Linux. 8+ лет опыта преподавания.
/ Fake LastPass in AppStore
Official warning:
https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating-lastpass-currently-available-in-apple-app-store/
Official warning:
https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating-lastpass-currently-available-in-apple-app-store/
Lastpass
Warning: Fraudulent App Impersonating LastPass Currently Available in Apple App Store - The LastPass Blog
UPDATE The fraudulent app was removed from the Apple App Store on February 8. We will continue to monitor for fraudulent applications and take appropriate action as necessary.
/ After a tip, ExpressVPN acts swiftly to protect customers
Express disclosure VPN users browsing data..
https://www.expressvpn.com/blog/windows-app-dns-requests/
Express disclosure VPN users browsing data..
https://www.expressvpn.com/blog/windows-app-dns-requests/
ExpressVPN Blog
Split-Tunneling Fix on Our App for Windows | ExpressVPN Blog
We've deployed a fix to our Version 12 app for Windows after receiving a tip about how the app handles DNS requests when split tunneling is enabled.
/ Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
Internet Shortcut Files Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
Internet Shortcut Files Security Feature Bypass Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412
Trend Micro
CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
The APT group Water Hydra has been exploiting the Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by…
/ Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System
https://www.aquasec.com/blog/snap-trap-the-hidden-dangers-within-ubuntus-package-suggestion-system/
https://www.aquasec.com/blog/snap-trap-the-hidden-dangers-within-ubuntus-package-suggestion-system/
Aqua
Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System
Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu's command-not-found package and the snap package repository.