Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
CVE-2024-20356: Jailbreaking a Cisco appliance to run DOOM
https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/
P.S. Thx for link dear subscriber ✌️
https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/
P.S. Thx for link dear subscriber ✌️
📢 Networks практикум: VRRP. Отказоустойчивость и балансировка нагрузки
Программа:
• Основы теории надежности
• Резервирование маршрутизаторов в группе
• Virtual Router (VR) ID, приоритет, master, backup
• Примеры настройки и схемы использования
• Время: 25 Апреля (Четверг) 20:00 (МСК)
• Детали: ↘ Здесь
Программа:
• Основы теории надежности
• Резервирование маршрутизаторов в группе
• Virtual Router (VR) ID, приоритет, master, backup
• Примеры настройки и схемы использования
• Время: 25 Апреля (Четверг) 20:00 (МСК)
• Детали: ↘ Здесь
/ ToddyCat is making holes in your infrastructure
ToddyCat is an APT group that predominantly targets governmental organizations, some of them defense related, located in the Asia-Pacific region. One of the group’s main goals is to steal sensitive information from hosts.
In most cases, the adversary connected, transferred and run all required tools with the help of PsExec or Impacket..:
https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/
ToddyCat is an APT group that predominantly targets governmental organizations, some of them defense related, located in the Asia-Pacific region. One of the group’s main goals is to steal sensitive information from hosts.
In most cases, the adversary connected, transferred and run all required tools with the help of PsExec or Impacket..:
https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/
Forwarded from OpenBLD.net (Yevgeniy Goncharov)
Экосистема сервиса, основанная на философии блокировки интернет-шума, показала превосходную защиту от вредоносных доменов и навязчивой рекламы. 💪
Согласно статистике URLhaus,
OpenBLD.net обгоняет таких Топ-гигантов, как AdGuard, Cloudflare и Quad9, в блокировке малвари и нежелательных доменов OpenBLD.net не просто предлагает защиту - он создает чувство безопасности для Вашего онлайн пространства.Ваши пожертвования и спонсорство могут помочь стать сервису еще лучше и обеспечить стабильное развитие сервиса.
Присоединяйтесь к OpenBLD.net уже сегодня и вместе мы сделаем интернет безопаснее и тише! Peace ✌️
Please open Telegram to view this post
VIEW IN TELEGRAM
/ ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
Cisco Talos Blog
ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVEs related to the event. We assess with high confidence this activity is related to same threat actor as ArcaneDoor in 2024.
/ IBM acquire HashiCorp
..IBM today announced its intent to acquire HashiCorp, Inc. for $35 per share in cash, representing an enterprise value of $6.4 billion..:
https://newsroom.ibm.com/2024-04-24-IBM-RELEASES-FIRST-QUARTER-RESULTS
..IBM today announced its intent to acquire HashiCorp, Inc. for $35 per share in cash, representing an enterprise value of $6.4 billion..:
https://newsroom.ibm.com/2024-04-24-IBM-RELEASES-FIRST-QUARTER-RESULTS
IBM Newsroom
IBM RELEASES FIRST-QUARTER RESULTS
Accelerated Software revenue growth; Strong gross margin expansion and cash generation. Announces strategic acquisition of HashiCorp, Inc.
📢 Открытые практикумы by Rebrain: Расписание на неделю
🔹 2 мая Networks: Мастер-класс по собеседованиям для сетевых инженеров и не только
🔹 6 мая Golang: Prometheus метрики в Golang-приложении
🔹 7 мая DevOps: Повесть о том, как найм идёт в ИТ
🔹 8 мая Linux: С Windows на Linux
Детали: ↘ Здесь
Детали: ↘ Здесь
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Autodesk hosting PDF files used in Microsoft phishing attacks
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...
https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...
https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/
Netcraft
Autodesk hosting PDF files used in Microsoft phishing attacks | Netcraft
Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen. The elaborate phishing campaign ...
/ Brokewell: do not go broke from new banking malware
..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
ThreatFabric
Brokewell: do not go broke from new banking malware!
Explore the new malware family, Brokewell, with Device Takeover capabilities. Understand the risks it poses to financial institutions and how to stay protected.
Организаторы AppSecFest.kz, предоставили OpenBLD.net, как открытому проекту на безвозмездной основе стенд 🔥
3 Мая, в Алматы, на стенде, у нас будет монитор, команда из трех человек, и мы научим, расскажем, покажем, как:
И самое главное оставаться собой и быть в фокусе!
Приходите, подходите. Будут олдскул-стайл стикерпаки, пару футболок, пушечный заряд и тонна мотивации.
Информация о конференции доступна Здесь
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers
..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:
https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:
https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
Securonix
Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors
The Securonix Threat Research Team has been monitoring an ongoing social engineering attack campaign from North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT. Read more.
/ Coordinated attacks on Docker Hub that planted millions of malicious repositories
https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/
https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/
JFrog
JFrog Security research discovers coordinated attacks on Docker Hub that planted millions of malicious repositories
Attackers are using Docker Hub for malicious campaigns of various types, including spreading malware, phishing and scams. Read the analysis of 3 malware campaigns.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Common-System-Hacking.pdf
9.9 MB
System Hacking: Common Windows, Linux & Web Server Hacking Techniques
/ Detecting browser data theft using Windows Event Logs
This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:
https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html
This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:
https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html
Google Online Security Blog
Detecting browser data theft using Windows Event Logs
Posted by Will Harris, Chrome Security Team Chromium's sandboxed process model defends well from malicious web content, but...
📢 Открытый практикум Linux by Rebrain: С Windows на Linux
Время:
• 8 Мая (Среда) 20:00 МСК
Программа:
• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux
Детали ↘ Здесь
Ведет:
Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.
Время:
• 8 Мая (Среда) 20:00 МСК
Программа:
• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux
Детали ↘ Здесь
Ведет:
Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.
/ Hackers breached its Sign production environment and accessed customer email addresses and hashed Dropbox passwords
The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:
https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign
The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:
https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign
Dropbox
A recent security incident involving Dropbox Sign - Dropbox Sign
Information on a security incident involving Dropbox Sign.
/ Analysis of ArcaneDoor
The zero day vulnerabilities identified are tracked as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358 – of these, only CVE-2024-20353 and CVE-2024-20359 were exploited in the ArcaneDoor campaign.
The campaign, dubbed “ArcaneDoor,” targeted government-owned perimeter network devices from various vendors as part of a global effort..:
https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/
The zero day vulnerabilities identified are tracked as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358 – of these, only CVE-2024-20353 and CVE-2024-20359 were exploited in the ArcaneDoor campaign.
The campaign, dubbed “ArcaneDoor,” targeted government-owned perimeter network devices from various vendors as part of a global effort..:
https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/
Censys
Analysis of ArcaneDoor Threat Infrastructure Suggests Potential Ties to Chinese-based Actor
/ Eight Arms To Hold You: The Cuttlefish Malware
https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/
https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/
Lumen Blog
Eight arms to hold you: The Cuttlefish malware
Learn about the latest evolution in malware designed to infect SOHO routers, and Black Lotus Labs' discovery of a highly targeted campaign.
/ GitLab Vulnerability Allows Intercept Accounts Management
https://nvd.nist.gov/vuln/detail/CVE-2023-7028
https://nvd.nist.gov/vuln/detail/CVE-2023-7028
/ Graph: Growing number of threats leveraging Microsoft API
An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud.
BirdyClient or OneDriveBirdyClient malware revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats
An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud.
BirdyClient or OneDriveBirdyClient malware revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats
Security
Graph: Growing number of threats leveraging Microsoft API
Graph API is often used for inconspicuous communications to cloud-based command-and-control servers.