/ Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters
Attackers are constantly seeking new vulnerabilities to compromise Kubernetes environments. Microsoft recently uncovered an attack that exploits new critical vulnerabilities in OpenMetadata to gain access to Kubernetes workloads and leverage them for cryptomining activity.
- attack flow
- how to check if your cluster is vulnerable
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/
Attackers are constantly seeking new vulnerabilities to compromise Kubernetes environments. Microsoft recently uncovered an attack that exploits new critical vulnerabilities in OpenMetadata to gain access to Kubernetes workloads and leverage them for cryptomining activity.
- attack flow
- how to check if your cluster is vulnerable
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/
Microsoft News
Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters
An attack exploits new critical vulnerabilities in OpenMetadata to gain access to Kubernetes workloads for cryptomining.
Sys-Admin InfoSec
🚀 Викторина на розыгрыш билетов на AppSecFest Almaty 2024 AppSecFest Almaty 2024 официально открыл продажу билетов, у тебя уважаемый username есть возможность попасть на конференцию бесплатно поучаствовав в розыгрыше от нашего Sys-Admin InfoSec канала. …
Всем привет, выгрузив имена с правильными ответами в файл
Парни, я свяжусь с вами. Организаторы оставили форму, где стоит отметиться с комментарием "Викторина от Sys-Adm.in", беслпатный проход готов! Done! Поздравляю! 🎉
quiz.txt и использовав команду shuf -n 5 quiz.txt я получил следующий список победителей:@r_***37
@az*********ov
@pe***1e
@je*****_0
@ni***********in
Парни, я свяжусь с вами. Организаторы оставили форму, где стоит отметиться с комментарием "Викторина от Sys-Adm.in", беслпатный проход готов! Done! Поздравляю! 🎉
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
MagicDot: A Hacker’s Magic Show of Disappearing Dots and Spaces
This action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:
🔹 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows’s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.
🔹 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.
With Demo..:
https://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/
This action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:
With Demo..:
https://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
MITRE Response to Cyber Attack in One of Its R&D Networks
MITRE was Hacked?)🤦♂️
https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks
MITRE was Hacked?)
https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks
Please open Telegram to view this post
VIEW IN TELEGRAM
MITRE
MITRE Response to Cyber Attack in One of Its R&D Networks
To offer learnings from its experience, MITRE has published initial details about the incident via the Center for Threat-Informed Defense, found here.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
CVE-2024-20356: Jailbreaking a Cisco appliance to run DOOM
https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/
P.S. Thx for link dear subscriber ✌️
https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/
P.S. Thx for link dear subscriber ✌️
📢 Networks практикум: VRRP. Отказоустойчивость и балансировка нагрузки
Программа:
• Основы теории надежности
• Резервирование маршрутизаторов в группе
• Virtual Router (VR) ID, приоритет, master, backup
• Примеры настройки и схемы использования
• Время: 25 Апреля (Четверг) 20:00 (МСК)
• Детали: ↘ Здесь
Программа:
• Основы теории надежности
• Резервирование маршрутизаторов в группе
• Virtual Router (VR) ID, приоритет, master, backup
• Примеры настройки и схемы использования
• Время: 25 Апреля (Четверг) 20:00 (МСК)
• Детали: ↘ Здесь
/ ToddyCat is making holes in your infrastructure
ToddyCat is an APT group that predominantly targets governmental organizations, some of them defense related, located in the Asia-Pacific region. One of the group’s main goals is to steal sensitive information from hosts.
In most cases, the adversary connected, transferred and run all required tools with the help of PsExec or Impacket..:
https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/
ToddyCat is an APT group that predominantly targets governmental organizations, some of them defense related, located in the Asia-Pacific region. One of the group’s main goals is to steal sensitive information from hosts.
In most cases, the adversary connected, transferred and run all required tools with the help of PsExec or Impacket..:
https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
Экосистема сервиса, основанная на философии блокировки интернет-шума, показала превосходную защиту от вредоносных доменов и навязчивой рекламы. 💪
Согласно статистике URLhaus,
OpenBLD.net обгоняет таких Топ-гигантов, как AdGuard, Cloudflare и Quad9, в блокировке малвари и нежелательных доменов OpenBLD.net не просто предлагает защиту - он создает чувство безопасности для Вашего онлайн пространства.Ваши пожертвования и спонсорство могут помочь стать сервису еще лучше и обеспечить стабильное развитие сервиса.
Присоединяйтесь к OpenBLD.net уже сегодня и вместе мы сделаем интернет безопаснее и тише! Peace ✌️
Please open Telegram to view this post
VIEW IN TELEGRAM
/ ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
Cisco Talos Blog
ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVEs related to the event. We assess with high confidence this activity is related to same threat actor as ArcaneDoor in 2024.
/ IBM acquire HashiCorp
..IBM today announced its intent to acquire HashiCorp, Inc. for $35 per share in cash, representing an enterprise value of $6.4 billion..:
https://newsroom.ibm.com/2024-04-24-IBM-RELEASES-FIRST-QUARTER-RESULTS
..IBM today announced its intent to acquire HashiCorp, Inc. for $35 per share in cash, representing an enterprise value of $6.4 billion..:
https://newsroom.ibm.com/2024-04-24-IBM-RELEASES-FIRST-QUARTER-RESULTS
IBM Newsroom
IBM RELEASES FIRST-QUARTER RESULTS
Accelerated Software revenue growth; Strong gross margin expansion and cash generation. Announces strategic acquisition of HashiCorp, Inc.
📢 Открытые практикумы by Rebrain: Расписание на неделю
🔹 2 мая Networks: Мастер-класс по собеседованиям для сетевых инженеров и не только
🔹 6 мая Golang: Prometheus метрики в Golang-приложении
🔹 7 мая DevOps: Повесть о том, как найм идёт в ИТ
🔹 8 мая Linux: С Windows на Linux
Детали: ↘ Здесь
Детали: ↘ Здесь
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Autodesk hosting PDF files used in Microsoft phishing attacks
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...
https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...
https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/
Netcraft
Autodesk hosting PDF files used in Microsoft phishing attacks | Netcraft
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen. The elaborate phishing campaign ...
/ Brokewell: do not go broke from new banking malware
..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
ThreatFabric
Brokewell: do not go broke from new banking malware!
Explore the new malware family, Brokewell, with Device Takeover capabilities. Understand the risks it poses to financial institutions and how to stay protected.
Организаторы AppSecFest.kz, предоставили OpenBLD.net, как открытому проекту на безвозмездной основе стенд 🔥
3 Мая, в Алматы, на стенде, у нас будет монитор, команда из трех человек, и мы научим, расскажем, покажем, как:
И самое главное оставаться собой и быть в фокусе!
Приходите, подходите. Будут олдскул-стайл стикерпаки, пару футболок, пушечный заряд и тонна мотивации.
Информация о конференции доступна Здесь
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers
..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:
https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:
https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
Securonix
Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors
The Securonix Threat Research Team has been monitoring an ongoing social engineering attack campaign from North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT. Read more.
/ Coordinated attacks on Docker Hub that planted millions of malicious repositories
https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/
https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/
JFrog
JFrog Security research discovers coordinated attacks on Docker Hub that planted millions of malicious repositories
Attackers are using Docker Hub for malicious campaigns of various types, including spreading malware, phishing and scams. Read the analysis of 3 malware campaigns.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Common-System-Hacking.pdf
9.9 MB
System Hacking: Common Windows, Linux & Web Server Hacking Techniques
/ Detecting browser data theft using Windows Event Logs
This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:
https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html
This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:
https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html
Google Online Security Blog
Detecting browser data theft using Windows Event Logs
Posted by Will Harris, Chrome Security Team Chromium's sandboxed process model defends well from malicious web content, but...
📢 Открытый практикум Linux by Rebrain: С Windows на Linux
Время:
• 8 Мая (Среда) 20:00 МСК
Программа:
• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux
Детали ↘ Здесь
Ведет:
Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.
Время:
• 8 Мая (Среда) 20:00 МСК
Программа:
• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux
Детали ↘ Здесь
Ведет:
Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.
/ Hackers breached its Sign production environment and accessed customer email addresses and hashed Dropbox passwords
The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:
https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign
The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:
https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign
Dropbox
A recent security incident involving Dropbox Sign - Dropbox Sign
Information on a security incident involving Dropbox Sign.