Risk Discovery

Phil Venables

The Daily Swig

We’re going teetotal: It’s goodbye to The Daily Swig

Bug Bounty Radar // The latest bug bounty programs for March 2023

Indian transport ministry flaws potentially allowed creation of counterfeit driving licenses

Password managers: A rough guide to enterprise secret platforms

Chromium bug allowed SameSite cookie bypass on Android devices

Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption

NIST plots biggest ever reform of Cybersecurity Framework

Cisco ClamAV anti-malware scanner vulnerable to serious security flaw

CVSS system criticized for failure to address real-world impact

‘Most web API flaws are missed by standard security tests’ – Corey J Ball on securing a neglected attack vector

AWS Security Blog

Securing the RAG ingestion pipeline: Filtering mechanisms

Important changes to CloudTrail events for AWS IAM Identity Center

Threat modeling your generative AI workload to evaluate security risk

Secure by Design: AWS enhances centralized security controls as MFA requirements expand

Updated whitepaper: Architecting for PCI DSS Segmentation and Scoping on AWS

Discover duplicate AWS Config rules for streamlined compliance

Maximize your cloud security experience at AWS re:Invent 2024: A comprehensive guide to security sessions

Amazon Inspector suppression rules best practices for AWS Organizations

Implement effective data authorization mechanisms to secure your data used in generative AI applications

Unauthorized tactic spotlight: Initial access through a third-party identity provider

Darknet - The Darkside

Best EDR Of The Market (BEOTM) – Endpoint Detection and Response Testing Tool

AgentSmith HIDS – Host Based Intrusion Detection

padre – Padding Oracle Attack Exploiter Tool

Privacy Implications of Web 3.0 and Darknets

DataSurgeon – Extract Sensitive Information (PII) From Logs

Pwnagotchi – Maximize Crackable WPA Key Material For Bettercap

HardCIDR – Network CIDR and Range Discovery Tool

Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage

CFRipper – CloudFormation Security Scanning & Audit Tool

CredNinja – Test Credential Validity of Dumped Credentials or Hashes

Least Privilege

My next Step

What’s going on?

The Future of IdentityServer

Flexible Access Token Validation in ASP.NET Core

Refresh Tokens in IdentityServer4 v4

Announcing IdentityServer4 v4.0

Resource Access in IdentityServer4 v4 and going forward

I don’t like Identity Tokens

The JWT Profile for OAuth 2.0 Access Tokens (and IdentityServer)

Updates on our Workshops

Fox-IT Blog

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Sifting through the spines: identifying (potential) Cactus ransomware victims

From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager

CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet

Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm

SnapMC skips ransomware, steals data

StreamDivert: Relaying (specific) network connections

WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group

LDAPFragger: Command and Control over LDAP attributes

Office 365: prone to security breaches?

Positive Technologies

PHDays 10 IDS Bypass contest: writeup and solutions

APT31 new dropper. Target destinations: Mongolia, Russia, the U.S., and elsewhere

How to detect a cyberattack and prevent money theft

Troy Hunt

Weekly Update 426

Inside the DemandScience by Pure Incubation Data Breach

The Data Breach Disclosure Conundrum

The Hacker Factor Blog

SEAL of Approval

C2PA and the All Adobe Show

Account Payable Phishing Attacks

C2PA and Authenticated Disinformation

Repeat Offenders

The Security Skeptic

Interisle Study Reveals Alarming Rise in Online Abuse and Identifies Exploitable Links in Cybercriminal Supply Chains

CyberSecPolitics

Mythical Beasts

A quick research overview of the Research Handbook on Cyberwarfare

Automated LLM Bugfinders

What Open Source projects are unmaintained and should you target for takeover ?

The Open Source Problem

Jia Tan and SocialCyber

The Atlantic Council Paper and Defending Forward

FORECASTING

Guest Post: HostileSpectrum’s futures: Looking back on 2021’s estimative signposts

Pride Month

Schneier on Security

Steve Bellovin’s Retirement Talk

Why Italy Sells So Much Spyware

Most of 2023’s Top Exploited Vulnerabilities Were Zero-Days

Friday Squid Blogging: Female Gonatus Onyx Squid Carrying Her Eggs

Good Essay on the History of Bad Password Policies

New iOS Security Feature Makes It Harder for Police to Unlock Seized Phones

Mapping License Plate Scanners in the US

Criminals Exploiting FBI Emergency Data Requests

Friday Squid Blogging: Squid-A-Rama in Des Moines

AI Industry is Trying to Subvert the Definition of “Open Source AI”

SANS Inernet Storm Center

Increase In Phishing SVG Attachments, (Thu, Nov 21st)

ISC Stormcast For Wednesday, November 20th, 2024 https://isc.sans.edu/podcastdetail/9226, (Wed, Nov 20th)

Apple Fixes Two Exploited Vulnerabilities, (Tue, Nov 19th)

Detecting the Presence of a Debugger in Linux, (Tue, Nov 19th)

ISC Stormcast For Tuesday, November 19th, 2024 https://isc.sans.edu/podcastdetail/9224, (Tue, Nov 19th)

Exploit attempts for unpatched Citrix vulnerability, (Mon, Nov 18th)

ISC Stormcast For Monday, November 18th, 2024 https://isc.sans.edu/podcastdetail/9222, (Mon, Nov 18th)

Ancient TP-Link Backdoor Discovered by Attackers, (Sun, Nov 17th)

ISC Stormcast For Wednesday, November 13th, 2024 https://isc.sans.edu/podcastdetail/9220, (Wed, Nov 13th)

Microsoft November 2024 Patch Tuesday, (Tue, Nov 12th)

Red Hat Security

Managed Identity and Workload Identity support in Azure Red Hat OpenShift

Security of LLMs and LLM systems: Key risks and safeguards

Hardening your operating system? Red Hat Enterprise Linux to the rescue!

AI meets security: POC to run workloads in confidential containers using NVIDIA accelerated computing

OpenSSL in Red Hat Enterprise Linux 10: From engines to providers

Recent improvements in Red Hat Enterprise Linux CoreOS security data

Secure cloud bursting: Leveraging confidential computing for peace of mind

Strengthening security of the software supply chain for LLVM

Pentest Partners

How we helped expose a £12 million rental scam

Did security gaps at Antwerp port enable drug smuggling operations?

BEC-ware the Phish (part 2): Respond and Remediate Incidents in M365

You lost your iPhone, but it’s locked. That’s fine, right?

Maritime lawyers assemble!

What goes into testing a ship?

Mounting memory with MemProcFS for advanced memory forensics

Testing the security of CCTV systems

Using Volatility for advanced memory forensics

BEC-ware the phish (part 1). Investigating incidents in M365

Pedro Felix's Shared Memory

Reactive streams: a play in multiple acts

RFC 8252 and OAuth 2.0 for Native Apps

Accessing the HTTP Context on ASP.NET Core

Should I PUT or should I POST? (Darling you gotta let me know)

Health check APIs, 500 status codes and media types

On contracts and HTTP APIs

Focus on the representation semantics, leave the transfer semantics to HTTP

Client-side development on OS X using Windows hosted HTTP Web APIs

Using multiple IIS server certificates on Windows 7

The OpenID Connect Cast of Characters

Google Online Security Blog

Leveling Up Fuzzing: Finding more vulnerabilities with AI

Retrofitting spatial safety to hundreds of millions of lines of C++

Safer with Google: New intelligent, real-time protections on Android to keep you safe

5 new protections on Google Messages to help keep you safe

Safer with Google: Advancing Memory Safety

Bringing new theft protection features to Android users around the world

Using Chrome's accessibility APIs to find security bugs

Pixel's Proactive Approach to Security: Addressing Vulnerabilities in Cellular Modems

Evaluating Mitigations & Vulnerabilities in Chrome

Eliminating Memory Safety Vulnerabilities at the Source

Netlabs.360.com

僵尸网络911 S5的数字遗产

Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges

警惕：魔改后的CIA攻击套件Hive进入黑灰产领域

快讯：使用21个漏洞传播的DDoS家族WSzero已经发展到第4个版本

P2P Botnets: Review - Status - Continuous Monitoring

P2P 僵尸网络：回顾·现状·持续监测

Fodcha Is Coming Back, Raising A Wave of Ransom DDoS

卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙

PureCrypter is busy pumping out various malicious malware families

PureCrypter Loader持续活跃，已经传播了10多个其它家族

MS Cyber Security

AI innovations for a more secure future unveiled at Microsoft Ignite

Microsoft Data Security Index annual report highlights evolving generative AI security needs

DoD Zero Trust Strategy proves security benchmark years ahead of schedule with Microsoft collaboration

More value, less risk: How to implement generative AI across the organization securely and responsibly

Zero Trust Workshop: Advance your knowledge with an online resource

How Microsoft Defender for Office 365 innovated to address QR code phishing attacks

Microsoft now a Leader in three major analyst reports for SIEM

Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network

7 cybersecurity trends and tips for small and medium businesses to stay protected

Microsoft Ignite: Sessions and demos to improve your security strategy

The Last Watchdog

LW ROUNDTABLE: Wrist slap or cultural shift? SEC fines cyber firms for disclosure violations

GUEST ESSAY: The promise and pitfalls of using augmented reality– ‘AR’ — in cybersecurity

News alert: Sweet Security rolls out its advanced runtime detection and response platform for AWS

MY TAKE: Technology breakthroughs, emerging standards are coalescing to assure IoT integrity

Shared Intel Q&A: Foreign adversaries now using ‘troll factories’ to destroy trust in U.S. elections

News alert: Cybersecurity, AI priorities for 2025 highlighted at ATPC Cyber Forum in Atlanta

Guest Essay: Wallarm report shows API exposures rose steeply across all industries in Q3 2024

News alert: INE shares guidance to help companies invest in year-end cybersecurity, networking training

News alert: INE Security shares cyber hygiene guidance for small- and medium-sized businesses

GUEST ESSAY: Achieving end-to-end data security with the right ‘fully homomorphic encryption’

The Security Catalyst

Why we must develop ourselves before we can elevate our team

Ease change by painting a picture of a better tomorrow

Deliver value faster by asking what they know… that you don’t (yet)

Why I love asking “What if I’m wrong?”

The surprising reason you need to record yourself rehearsing before your next presentation

Security needs more sizzle, less steakhouse

Why we always restate the problem

How you get disconnected from your value (and your story)

Do you see the progress you made this week?

How to use percolation and incubation to solve problems

Krebs on Security

Fintech Giant Finastra Investigating Data Breach

An Interview With the Target & Home Depot Hacker

Microsoft Patch Tuesday, November 2024 Edition

FBI: Spike in Hacked Police Emails, Fake Subpoenas

Canadian Man Arrested in Snowflake Data Extortions

Booking.com Phishers May Leave You With Reservations

Change Healthcare Breach Hits 100M Americans

The Global Surveillance Free-for-All in Mobile Ad Data

Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach

Sudanese Brothers Arrested in ‘AnonSudan’ Takedown

tl;dr sec

[tl;dr sec] #256 - AI SOC Analyst, Detection Engineering, How to Ransomware in AWS

Systems Thinking for Cybersecurity Professionals

[tl;dr sec] #255 - AI finds 0day in SQLite, Cloud Security Tools, Auto-generate Terraform Secure Guardrails

[tl;dr sec] #254 - Cloud CTFs, AI + AppSec, Awesome Threat Detection

[tl;dr sec] #253 - State of Cloud Security, Applying AI to Cybersecurity, Living Off The Land ESXi

[tl;dr sec] #252 - Perfecting Ransomware on AWS, Kubernetes-native Threat Detection, MITRE Caldera Bounty Hunter

[tl;dr sec] #251 - Vuln Discovery at Scale, Multi-Cloud Testing Tool, AI-powered Container Scanning

[tl;dr sec] #250 - CNAPP Guide, OpenAI's o1 vs CTFs, Cloud Logging Tips

[tl;dr sec] #249 - Atomic Cloud IOCs, Russian APT Tool Matrix, Netflix Paved Road Webinar

[tl;dr sec] #248 - 10X Your Cloud Security, Secure by Design, AI OffSec Benchmarks

Security Intelligence

Project Zero

From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code

The Windows Registry Adventure #4: Hives and the registry layout

Effective Fuzzing: A Dav1d Case Study

The Windows Registry Adventure #3: Learning resources

Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models

Driving forward in Android drivers

The Windows Registry Adventure #2: A brief history of the feature

The Windows Registry Adventure #1: Introduction and research results

First handset with MTE on the market

An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit

Mozilla Security

Behind the Scenes: Fixing an In-the-Wild Firefox Exploit

Firefox will upgrade more Mixed Content in Version 127

Rapidly Leveling up Firefox Security

Mozilla VPN Security Audit 2023

Version 2.9 of the Mozilla Root Store Policy

Updated GPG key for signing Firefox Releases

Upgrading Mozilla’s Root Store Policy to Version 2.8

Revocation Reason Codes for TLS Server Certificates

Preventing secrets from leaking through Clipboard

Improving the Quality of Publicly Trusted Intermediate CA Certificates with Enhanced Oversight and Automation

CyberWatch

It’s Cybersecurity Awareness Month!

Welcome Back

Hackfest 2021 N1ghtmar3s Edition

What I did on my Pandemic Summer Vacation 2021

Comparing Chinese APTs in Software Supply Chain Attacks

The Diana Initiative 2021

Let the truth be told

Today is for them

My Happy 2nd Dose Day!

Zero Day

Why I recommend the Blink Mini 2 security camera over the Wyze Cam (and it's only $30 right now)

Update your iPhone, iPad, and Mac now to patch these serious zero-day security flaws

'Scam yourself' attacks just increased over 600% - here's what to look for

Microsoft offers $4 million in AI and cloud bug bounties - how to qualify

Microsoft to tighten Windows security dramatically in 2025 - here's how

How to clear your Google search cache on Android (and why you should)

The best password manager for Mac in 2024: Expert tested

Gen AI could speed up coding, but businesses should still consider risks

Proton VPN review: A very solid free VPN with robust leak protection

The best secure browsers for privacy in 2024: Expert tested

PhishMe

The Security Ledger

KIA KO! Web Hackers Vs. The Auto Industry Round 2

Report Finds Lack of Talent, Tools Frustrates Cyber Investigations

Episode 258: Broken Brokers – Optery’s Fight To Claw Back Your Personal Data

A Digital Lock Maker Tried To Squash A DEF CON Talk. It Happened Anyway. Here’s Why.

At Nebraska Event, FBI Calls Out Cyber Threats To Agriculture

Security Teams Lean Into AI As Cyber Worker Shortage Persists

Spotlight Podcast: OT Is Under Attack. Now What?

Spotlight Podcast: CSO Chris Walcutt on Managing 3rd Party OT Risk

Screening Your Supply Chain: How Far Will You Go For Cybersecurity?

Spotlight Podcast: How AI Is Reshaping The Cyber Threat Landscape

CISA Blog

USDA Stops Credential Phishing with FIDO Authentication

CISA’s Vulnerability Management goes “Big” on Interns and the Results are Staggering!

CISA’s ScubaGear Tool Improves Security for Organizations Using M365 and Surpasses 30,000 Downloads

Engaging with Security Researchers: Embracing a “See Something, Say Something” Culture

A Message to Election Officials from CISA Director Jen Easterly

Region 8 Invites You to Secure Our World

CISA Director Jen Easterly Remarks at the Election Center 39th Annual National Conference in Detroit

Learn with Region 8’s Webinar Program

Shaping the legacy of partnership between government and private sector globally: JCDC

SAFECOM and NCSWIC Develop Global Positioning System (GPS) for Public Safety Location Services: Use Cases and Best Practices