Found 1407 bookmarks
Custom sorting
The Hidden Treasures of Crash Reports
The Hidden Treasures of Crash Reports
Sadly, nobody really loves crash reports, but I’m here to change that! This research, a crash course on crash reports, will highlight how these often overlooked files are an invaluable source of information, capable of revealing malware infections, exploitation attempts, or even buggy (exploitable?) system code. Such insights are critical for defense and offense, empowering us to either protect or exploit macOS systems.
#objective-see#EN#2024#crash-report#course#Hidden#analysis#macos
·objective-see.org·
The Hidden Treasures of Crash Reports
Troy Hunt: Inside the "3 Billion People" National Public Data Breach
Troy Hunt: Inside the "3 Billion People" National Public Data Breach
I decided to write this post because there's no concise way to explain the nuances of what's being described as one of the largest data breaches ever. Usually, it's easy to articulate a data breach; a service people provide their information to had someone snag it through an act of unauthorised access and publish a discrete corpus of information that can be attributed back to that source. But in the case of National Public Data, we're talking about a data aggregator most people had never heard of where a "threat actor" has published various partial sets of data with no clear way to attribute it back to the source. And they're already the subject of a class action, to add yet another variable into the mix. I've been collating information related to this incident over the last couple of months, so let me talk about what's known about the incident, what data is circulating and what remains a bit of a mystery.
#troyhunt#EN#2024#3billion#National#Public#Data#Breach#data-breach#USDoD
·troyhunt.com·
Troy Hunt: Inside the "3 Billion People" National Public Data Breach
Extension Trojan Malware Campaign
Extension Trojan Malware Campaign
Malwares make no distinction between corporate and personal devices. Therefore, past perceptions of different levels of antivirus for businesses and households must be challenged. ReasonLabs is the first endpoint protection based on a multilayered machine-learning engine, that provides enterprise-grade security for all your personal devices.
#reasonlabs#EN#2024#Extension#Trojan#Malware#Campaign
·reasonlabs.com·
Extension Trojan Malware Campaign
Exploiting pfsense Remote Code Execution – CVE-2022-31814
Exploiting pfsense Remote Code Execution – CVE-2022-31814
Greetings everyone, In this write-up, we will be exploring the interesting exploitation that has been done against the pfsense CVE-2022-31814. What is pfsense? pfSense software is a FreeBSD-based operating system designed to install and configure a firewall that can be easily configured via the web interface and installed on any PC. With all of the
#laburity.com#en#2024#pfsense#Remote#Code#Execution#CVE-2022-31814
·laburity.com·
Exploiting pfsense Remote Code Execution – CVE-2022-31814
NIST's Post-Quantum Cryptography Standards Are Here - IEEE Spectrum
NIST's Post-Quantum Cryptography Standards Are Here - IEEE Spectrum
Today, the National Institute of Standards and Technology (NIST) announced the first standardization of three cryptography schemes that are immune against the threat of quantum computers, known as post-quantum cryptography (PQC) schemes. With these standards in hand, NIST is encouraging computer system administrators to begin transitioning as soon as possible.
#ieee.org#en#2024#quantum-computing#nist#standards#security#cryptography
·spectrum.ieee.org·
NIST's Post-Quantum Cryptography Standards Are Here - IEEE Spectrum
60 Hurts per Second – How We Got Access to Enough Solar Power to Run the United States
60 Hurts per Second – How We Got Access to Enough Solar Power to Run the United States
  • Bitdefender researchers have identified a series of vulnerabilities in PV plant management platforms operated by Solarman and Deye. This platform is responsible for coordinating production operations of millions of solar installations worldwide generating a whopping output of approximately 195 GW of solar power (20% of the global solar production) If exploited, these vulnerabilities could allow an attacker to control inverter settings that could take parts of the grid down, potentially causing blackouts. * These vulnerabilities have been communicated to the affected vendors and fixed.
#bitdefender#EN#2024#Solar#Power#plant#management#IoT#Solarman#Deye
·bitdefender.com·
60 Hurts per Second – How We Got Access to Enough Solar Power to Run the United States
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
  • In collaboration with renowned security researcher Orange Tsai and DEVCORE, Akamai researchers have issued early-release remediations to Apache CVEs for our Akamai App & API Protector customers. Tsai presented his research at Black Hat USA 2024 and outlined the details for many Apache HTTP Server (httpd) vulnerabilities that were recently patched. Before his Black Hat presentation, the Akamai Security Intelligence Group (SIG) proactively contacted Tsai to facilitate the sharing of technique details for proactive defense for our customers. * App & API Protector customers who are in automatic mode have existing and updated protections.
#akamai#OrangeTsai#EN#2024#DEVCORE#vulnerabilities#Apache#httpd#CVE-2024-38475#CVE-2024-38472#CVE-2024-39573#CVE-2024-38477
·akamai.com·
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
Microsoft researchers found multiple vulnerabilities in OpenVPN that could lead to an attack chain allowing remote code execution and local privilege escalation. This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information.
#microsoft#EN#2024#OpenVPN#vulnerabilities#discovered#RCE#CVE-2024-27459#CVE-2024-27903
·microsoft.com·
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
A Dive into Earth Baku’s Latest Campaign
A Dive into Earth Baku’s Latest Campaign
Since late 2022, Earth Baku has broadened its scope from the Indo-Pacific region to Europe, the Middle East, and Africa. Their latest operations demonstrate sophisticated techniques, such as exploiting public-facing applications like IIS servers for initial access and deploying the Godzilla webshell for command and control.
#trendmicro#EN#2024#APT41#malware#apt-&-targeted-attacks#research#EarthBaku#reports
·trendmicro.com·
A Dive into Earth Baku’s Latest Campaign
Hackers leak 2.7 billion data records with Social Security numbers
Hackers leak 2.7 billion data records with Social Security numbers
Almost 2.7 billion records of personal information for people in the United States were leaked on a hacking forum, exposing names, social security numbers, all known physical addresses, and possible aliases.
#bleepingcomputer#EN#2024#Class-Action-Lawsuit#Data-Breach#National-Public-Data#Personal-Information#Social-Security-Number#US
·bleepingcomputer.com·
Hackers leak 2.7 billion data records with Social Security numbers
Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts
Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts
  • In early December of 2023, we discovered an open directory filled with batch scripts, primarily designed for defense evasion and executing command and control payloads. These scripts execute various actions, including disabling antivirus processes and stopping services related to SQL, Hyper-V, security tools, and Exchange servers. This report also highlights scripts responsible for erasing backups, wiping event logs, and managing the installation or removal of remote monitoring tools like Atera. Our investigation uncovered the use of additional tools, including Ngrok for proxy services, SystemBC, and two well-known command and control frameworks: Sliver and PoshC2. The observed servers show long term usage by the threat actors, appearing in The DFIR Report Threat Feeds as far back as September 2023. They have been active intermittently since then, with the most recent activity detected in August 2024. Ten new sigma rules were created from this report and added to our private sigma ruleset
#thedfirreport#EN#2024#Toolkit#investigation#open-directory#PoshC2#Batch-Scripts
·thedfirreport.com·
Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts