What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
GoogleSec.webp 2024-01-11 14:18:14 MiraclePtr: protéger les utilisateurs contre les vulnérabilités sans utilisation sans plateformes
MiraclePtr: protecting users from use-after-free vulnerabilities on more platforms (lien direct)		 Posted by Keishi Hattori, Sergei Glazunov, Bartek Nowierski on behalf of the MiraclePtr team Welcome back to our latest update on MiraclePtr, our project to protect against use-after-free vulnerabilities in Google Chrome. If you need a refresher, you can read our previous blog post detailing MiraclePtr and its objectives. More platforms We are thrilled to announce that since our last update, we have successfully enabled MiraclePtr for more platforms and processes: In June 2022, we enabled MiraclePtr for the browser process on Windows and Android. In September 2022, we expanded its coverage to include all processes except renderer processes. In June 2023, we enabled MiraclePtr for ChromeOS, macOS, and Linux. Furthermore, we have changed security guidelines to downgrade MiraclePtr-protected issues by one severity level! Evaluating Security Impact First let\'s focus on its security impact. Our analysis is based on two primary information sources: incoming vulnerability reports and crash reports from user devices. Let\'s take a closer look at each of these sources and how they inform our understanding of MiraclePtr\'s effectiveness. Bug reports Chrome vulnerability reports come from various sources, such as: Chrome Vulnerability Reward Program participants, our fuzzing infrastructure, internal and external teams investigating security incidents. For the purposes of this analysis, we focus on vulnerabilities that affect platforms where MiraclePtr was enabled at the time the issues were reported. We also exclude bugs that occur inside a sandboxed renderer process. Since the initial launch of MiraclePtr in 2022, we have received 168 use-after-free reports matching our criteria. What does the data tell us? MiraclePtr effectively mitigated 57% of these use-after-free vulnerabilities in privileged processes, exceeding our initial estimate of 50%. Reaching this level of effectiveness, however, required additional work. For instance, we not only rewrote class fields to use MiraclePtr, as discussed in the previous post, but also added MiraclePtr support for bound function arguments, such as Unretained pointers. These pointers have been a significant source of use-after-frees in Chrome, and the additional protection allowed us to mitigate 39 more issues. Moreover, these vulnerability reports enable us to pinpoint areas needing improvement. We\'re actively working on adding support for select third-party libraries that have been a source of use-after-free bugs, as well as developing a more advanced rewriter tool that can handle transformations like converting std::vector into std::vector. We\'ve also made sever Tool Vulnerability Threat Mobile ★★★
SentinelOne.webp 2024-01-11 13:55:59 Explorer FBOT |Des logiciels malveillants basés sur Python ciblant les services de cloud et de paiement
Exploring FBot  | Python-Based Malware Targeting Cloud and Payment Services (lien direct)		 Les acteurs de la menace des armes FBOT avec un outil d'attaque multifonction conçu pour détourner le cloud, le SaaS et les services Web.
FBot arms threat actors with a multi-function attack tool designed to hijack cloud, Saas and web services.		 Malware Tool Threat Cloud ★★
AlienVault.webp 2024-01-11 11:00:00 Histoires du Soc: Blackcat sur le prouvoir
Stories from the SOC: BlackCat on the prowl (lien direct)		 This blog was co-authored with Josue Gomez and Ofer Caspi. Executive summary BlackCat is and has been one of the more prolific malware strains in recent years. Believed to be the successor of REvil, which has links to operators in Russia, it first was observed in the wild back in 2021, according to researchers. BlackCat is written in the Rust language, which offers better performance and efficiencies than other languages previously used.  BlackCat is indiscriminate in how it targets its victims, which range from healthcare to entertainment industries. This blog will cover a recent incident impacting one of the AT&T Managed Detection and Response (MDR) Security Operations Center  SOC’s customers and discuss how in partnering with AT&T Alien Labs, the MDR SOC was able to detect and remediate the incident.  Building the investigation On September 14th, 2023, the AT&T MDR SOC received multiple alarms indicating that lateral movement was occurring for one of our clients. The alarm detections were generated after activity in SentinelOne for multiple users attempting to perform network traversing through the clients’ environment. ­­­­­­BlackCat infection detected Figure 1. Alarm Detection The AT&T SOC immediately generated an investigation that included a call to the client to notify them of the activity as well as escalate the detection to the AT&T MDR Incident Response (IR) Team and the client\'s dedicated Threat Hunter. The IR team and Threat Hunter began the engagement by creating a timeline and searching through SentinelOne Deep Visibility tool. Within its events, they found a user was successfully logged into the client’s internal network on multiple endpoints using lsass.exe..  Additionally, multiple files were logged as being encrypted, which resulted in the team designating the incident a ransomware attack.    lsass activity Figure 2. Lsass Activity in SentinelOne During the review of the lsass.exe activity, a specific file was located with a suspicious process tree. A command line was recorded with the file execution that included an internal IP address and the user ADMIN$. The activity from the suspicious file prompted an immediate blocklist for the SHA 1 file hash to ensure that the file was unable to be executed within the client’s environment. Following the block of the file hash, multiple detections from SentinelOne populated, indicating that the file was successfully killed and quarantined and that the client’s devices were protected. BlackCat command line  Figure 3. File execution command line After initiating the blocklist, the Threat Hunter utilized the SentinelOne “file fetch” feature, which enabled them to download the malicious file and save a copy locally. The AT&T SOC then worked with the AT&T Alien Labs team to perform a deeper analysis of the file in order to more understand  the true nature of the ransomware attack. Technical analyses As previously mentioned, BlackCat ransomware is developed in the Rust programming language, providing the attacker with the versatility to compile and run it on both Windows and Linux operating systems.The ransomware e Ransomware Malware Tool Threat ★★★
TechWorm.webp 2024-01-10 23:15:50 La Chine prétend avoir fissuré la fonction aérienne d'Apple \\
China Claims To Have Cracked Apple\\'s AirDrop Feature (lien direct)		 Une institution chinoise soutenue par l'État aurait élaboré un moyen d'identifier le numéro de téléphone, l'adresse e-mail et le nom des expéditeurs qui partagent du contenu via la fonction de lagramme aérien d'Apple. . Cette décision fait partie des efforts plus larges du gouvernement de Pékin \\ pour éliminer & # 8220; contenu indésirable & # 8221;. Pour ceux qui ne le savent pas, AirDrop est un outil crypté de bout en bout qui permet aux utilisateurs d'envoyer sans fil des photos, des vidéos, des documents, et plus encore aux autres appareils iOS et ordinateurs Mac, ce qui signifie que même Apple ne peut pas décrypter le contenu de laMatériaux que vous transférez. Pendant les transferts, la fonctionnalité ne partage que le nom de l'appareil (qui peut être défini sur n'importe quoi) et ne divulgue pas le numéro de téléphone et l'adresse e-mail associés au téléphone. selon un nouveau bloomberg report , Le Pékin Wangshendongjian, le Pékin de Chine, l'institut d'évaluation judiciaire de Wangshendongjian a développé une méthode pour faire un journal des appareils cryptés d'un iPhone \\ pour identifier les chiffres et les e-mails des expéditeurs qui partagent le contenu Airdrop. «Le cas des informations incorrectes diffusées via« Airdrop »sur les téléphones mobiles a permis les difficultés techniques de la traçabilité anonyme par Airdrop, a amélioré l'efficacité et la précision de la détection de cas, et a empêché la propagation des remarques inappropriées et une mauvaise influence potentielle,"Le Bureau municipal de la justice de Pékin a déclaré dans un Tool Mobile Technical ★★★★
TechWorm.webp 2024-01-10 21:30:08 7 meilleurs calculatrices d'étranglement pour PC en 2024
7 Best Bottleneck Calculators for PC in 2024 (lien direct)		 Looking for the best bottleneck calculator for PC? This article provides concise discussions on them, along with essential information for calculating bottlenecks on your computer. Getting optimal performance on PCs involves considering various factors. One crucial factor to consider is preventing any hardware component from bottlenecking another. For instance, a CPU bottleneck on the GPU can significantly affect the overall performance of the PC especially when you are running a program that requires a lot of  GPU power. To identify potential bottleneck hardware on a PC and address issues like freezing, lag, and crashes caused by bottlenecks, it’s common to examine resource usage during program execution. This analysis can be carried out using utilities like Task Manager or specialized resource monitoring software such as MSI Afterburner. However, using a specialized bottleneck calculator often complements the aforementioned method by employing algorithmic analysis to calculate PC bottlenecks. That’s why we’ve created this article to review the best PC bottleneck calculators for PC including all the methods above, helping you in pinpointing any hardware limitations in your system. Understanding the concept of a bottleneck in a PC Bottleneck is a generic term but when it comes to computing, it refers to a PC component - be it CPU, GPU, RAM or disk driver - that limits or slows down the overall functioning of the computer. This occurs when a particular hardware component struggles to process data requests at a pace comparable to the data reception capacity of the hardware awaiting the information. An instance of CPU bottleneck affecting the GPU arises when the CPU impedes the smooth flow of requests to the GPU, probably when gaming. In such a scenario, the CPU experiences high utilization, while the GPU operates with a utilization below the norm. This bottleneck restricts how the GPU should handle requests for the optimal running of processes, leading to issues like lags, crashes, stuttering, and low FPS. While bottleneck may be a simple term, it is most times the cause of issues faced on PCs. Hence, it is very important to take note of it. And the bottleneck calculator below can be of help in getting bottlenecks on your computer. Best Bottleneck Calculators for PC As previously noted, there are tools available to help in identifying hardware bottlenecks on PCs. This helps pinpoint which components may require overclocking or replacement to enhance data/request processing on your computer. Below are the top options derived from our extensive testing. However, the first four recommendations are best to be used if you are just planning to build a PC and the last three can only be used post PC build. 1. PC Built Bottleneck Calculator  PC Built Bottleneck Calculator is one of the top platforms to calculate PC bottleneck before building a PC. Tool Prediction ★★★
DarkReading.webp 2024-01-10 21:00:00 Nouveaux outils de développeur nécessaires pour stimuler l'adoption de la clé passante
New Developer Tools Necessary to Boost Passkey Adoption (lien direct)		 Il y a beaucoup d'intérêt pour la technologie sans mot de passe pour simplifier l'accès et l'identité en ligne, mais ils doivent d'abord être construits.Les outils des développeurs pour aider à créer des clés de passage dans les applications Web ouvrent la voie.
There is a lot of interest for password-less technology to simplify online access and identity, but they need to be built first. Developer tools to help build passkeys into web applications pave the way.		 Tool ★★★
RecordedFuture.webp 2024-01-10 21:00:00 Les clients d'Ivanti ont demandé à corriger les vulnérabilités qui auraient été exploitées par des pirates d'État chinois
Ivanti customers urged to patch vulnerabilities allegedly exploited by Chinese state hackers (lien direct)		 Mercredi, l'Agence de sécurité de la cybersécurité et de l'infrastructure (CISA) a exhorté les clients de la société informatique Ivanti pour corriger deux vulnérabilités qui sont activement exploitées.Cisa \\ 's Avis suit un Avertissement De Ivanti qu'au moins 10 de ses clients ont été touchés par les vulnérabilités.Les problèmes concernent Ivanti Connect Secure - un outil VPN largement utilisé.
The Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday urged customers of IT company Ivanti to patch two vulnerabilities that are being actively exploited. CISA\'s notice follows a warning from Ivanti that at least 10 of its customers were impacted by the vulnerabilities. The issues relate to Ivanti Connect Secure - a widely-used VPN tool.		 Tool Vulnerability ★★
silicon.fr.webp 2024-01-10 14:23:04 Comment Pinterest a monté son PaaS Kubernetes (lien direct) Pinterest a entrepris de moderniser son infrastructure de calcul avec Kubernetes. Des API à la sémantique, il y a greffé ses outils et processus. Tool Cloud ★★★
CS.webp 2024-01-09 16:30:13 L'IA aide les espions nous pour attraper des opérations de piratage chinois furtives, dit le responsable de la NSA
AI is helping US spies catch stealthy Chinese hacking ops, NSA official says (lien direct)		 > Les outils d'apprentissage automatique aident les agences de sécurité américaines pour attraper les opérations qui s'appuient sur des techniques dites de «vivre du terrain».
>Machine learning tools are aiding U.S. security agencies to catch operations relying on so-called "living off the land" techniques. 		Tool ★★
Sekoia.webp 2024-01-09 15:20:24 Comment Sekoia.io habilite la cybersécurité avec plus de 170 intégrations
How Sekoia.io empowers cybersecurity with 170+ integrations (lien direct)		 > Sekoia.io reconnaît l'investissement et les efforts importants que les organisations ont consacrés à leurs infrastructures de sécurité existantes.Nous réalisons également la flexibilité nécessaire pour choisir les meilleurs nouveaux outils pour protéger les actifs et les données critiques.Pour permettre cette flexibilité et rationaliser les opérations de sécurité, Sekoia.io adhère à une approche technologique et offre des intégrations avec plus de 170 outils et [& # 8230;] la publication Suivante comment sekoia.io rend la cybersécurité avec plus de 170 intégrations est un article de blog Sekoia.io .
>Sekoia.io recognizes the significant investment and effort that organizations have put into their existing security infrastructures. We also realize the flexibility needed to choose the best new tools for safeguarding critical assets and data. To enable this flexibility and streamline security operations, Sekoia.io adheres to a technology-agnostic approach and offers integrations with 170+ tools and […] La publication suivante How Sekoia.io empowers cybersecurity with 170+ integrations est un article de Sekoia.io Blog.		 Tool ★★★
Blog.webp 2024-01-09 13:45:52 L'outil AI Mockingbird de McAfee \\ détecte DeepFake Audio avec une précision de 90%
McAfee\\'s Mockingbird AI Tool Detects Deepfake Audio with 90% accuracy (lien direct)		 par deeba ahmed pouvez-vous faire confiance à vos oreilles?Deepfakes se lancent, mais McAfee dit se détendre, nous avons des oiseau moqueur. Ceci est un article de HackRead.com Lire la publication originale: L'outil AI Mockingbird de McAfee détecte de DeepFake Audio avec une précision de 90%
By Deeba Ahmed Can You Trust Your Ears? Deepfakes Run Amok, but McAfee Says Relax, We\'ve Got Mockingbird. This is a post from HackRead.com Read the original post: McAfee’s Mockingbird AI Tool Detects Deepfake Audio with 90% accuracy		 Tool ★★★
ProofPoint.webp 2024-01-09 11:57:12 L'augmentation préoccupante des attaques centrées sur l'identité: tendances et faits
The Concerning Rise in Identity-Centric Attacks: Trends and Facts (lien direct)		 Identity threats are by no means a new type of crime. But in today\'s increasingly digitized world, there are more opportunities for bad actors to steal identities and engage in identity-centric attacks than ever before. Unfortunately, user identities are tough for businesses to protect. The fact that these types of attacks are skyrocketing is evidence of that-in the past year alone the Identity Defined Security Alliance reports that a whopping 84% of companies experienced an identity-related security breach.  In this post, we\'ll take a look at identity attack statistics and trends and provide some recent case studies to illustrate how some attacks work. We\'ll also highlight one of the most important identity threat facts-that the human element plays a crucial role in the success of these attacks.   Understanding identity-centric attacks  There are many types of identity attacks. When most people think of these types of crimes, they often imagine traditional identity theft scenarios:  Financial identity theft, where a criminal gains access to a victim\'s financial data, like their credit card details, bank account numbers or Social Security number, to make unauthorized purchases, withdraw funds or open new accounts.   Tax identity theft, where a bad actor uses a victim\'s personal information to file false tax returns and claim refunds, diverting the money to their own accounts.  Employment identity theft, where a fraudster uses a victim\'s identity to get a job, potentially causing issues for that person when discrepancies arise in their employment and tax records.  But identity-based attacks also target enterprises and their online users. The cybercriminals behind these attacks might aim to steal sensitive data, siphon off funds, damage or disrupt systems, deploy ransomware or worse. Those are the types of identity attacks we\'re covering here.  Identity threat trends and tactics  In short, identity-centric attacks are a practical calculation by bad actors: Why would they invest their time and resources to build exploits to help them get in through a virtual back door when they can just walk through the front door?  But before they reap the rewards, they still have some legwork to do. Here are a few techniques that cybercriminals use to progress identity-based attacks against businesses and their users:  MFA bypass attacks. Many businesses today use multifactor authentication (MFA) to protect the account of their users. It\'s more secure than using passwords alone. But of course, bad actors have found new ways to bypass commonly used MFA methods. MFA fatigue attacks are one example.   People-activated malware. People often give life to malware when they fall for a phishing scam or other social engineering tactics. Malware can appear in the form of a .zip file, QR code, .html link, MS Office file and more-there are at least 60 known techniques to plant people-activated malware on corporate networks.  Active Directory (AD) attacks. Most enterprises today use AD as a primary method for directory services like user authentication and authorization. Cybercriminals are keen to target AD, which touches almost every place, person and device on a network. This approach works very well, too-more than half of identity-related breaches can be traced back to AD.  Cached credentials harvesting. Cached credentials are commonly stored on endpoints, in memory, in the registry, in a browser or on disk. Attackers use various tools and techniques to collect these credentials and gain access to more privileged identities. Once they have harvested these credentials, they can use them to move laterally and log into different applications.   Adversaries are likely to find a good “crop” when they are harvesting cached credentials. Recent research from Proofpoint found that more than one in 10 endpoints have exposed privileged account passwords, making it one of the most common identity risks.  Keep in mind that cybercriminals are always innovating, and they are quick to build or adopt tools that Ransomware Malware Tool Threat Studies Uber ★★
AlienVault.webp 2024-01-09 11:00:00 Histoires du SOC: quelque chose sent Phishy
Stories from the SOC: Something smells phishy (lien direct)		 Executive summary In the current cyber landscape, adversaries commonly employ phishing as the leading technique to compromise enterprise security. The susceptibility of human behavior makes individuals the weakest link in the security chain. Consequently, there is an urgent need for robust cybersecurity measures. Phishing, which capitalizes on exploiting human behavior and vulnerabilities, remains the adversary\'s top choice. To counter this threat effectively, ongoing education and awareness initiatives are essential. Organizations must recognize and address the pivotal role of human vulnerability in cybersecurity. During regular business hours, an alarm was generated due to a customer’s user that had interacted with a potentially malicious phishing link. This prompted a thorough investigation conducted by analysts that involved leveraging multiple Open-Source Intelligence (OSINT) tools such as VirusTotal and URLscan.io. Through a meticulous examination, analysts were able to unveil suspicious scripts within the phishing webpage’s Document Object Model (DOM) that pinpointed an attempt to exfiltrate user credentials. This detailed analysis emphasizes the importance of proactive cybersecurity measures and showcases the effectiveness of analysts leveraging OSINT tools along with their expertise to accurately assess threats within customer’s environments. Investigation The alarm The Managed Detection and Response (MDR) Security Operations Center (SOC) initially received an alarm triggered by a potentially malicious URL that a user received in their inbox. Office 365\'s threat intelligence feed flagged this URL as potentially malicious. The initial steps in addressing this alarm involve two key actions. First, it is crucial to determine the scope of impact on the customer\'s environment by assessing how many other users received the same URL. Second, a thorough validation process is essential to confirm whether the URL is indeed malicious. These initial steps lay the foundation for a comprehensive response to safeguard the security of the environment. Phishing alarm To determine how many users received the same URL, a comprehensive search within the customer\'s environment revealed that no other users received the same URL. As a result, only one user is affected, suggesting that this is an isolated incident and does not appear to be part of a targeted attack on the customer\'s environment. With this understanding, the focus can now shift to the second step: Validating the reputation of the URL. By employing the OSINT tool VirusTotal and inputting the URL received by the user, we aim to assess its potential threat level. VirusTotal aggregates results from various security vendors to provide a comprehensive analysis. In the current evaluation, 13 out of 90 security vendors classify this URL as malicious. It\'s important to note that while the number of vendors flagging the URL is a key factor, a conclusive determination of malicious intent typically considers a consensus among a significant portion of these vendors. A higher number of detections by diverse security platforms strengthens the confidence in labeling the URL as malicious. VT phising - 13 vendors With a potentially malicious URL identified, it is imperative to delve deeper to ascertain the underlying reasons for its malicious reputation. Analysts will utilize a tool such as URLscan.io for this purpose. URLscan.io serves as a sandbox, providing a risk-free environment for visiting websites. This tool is instrumental in conducting a thorough examination to uncover the nuances contributing to the URL\'s malicious classification. After entering our identified malicious URL into URLscan.io, Data Breach Tool Vulnerability Threat ★★
DarkReading.webp 2024-01-08 23:00:00 Outil de surveillance des cactus enrichi par une vulnérabilité critique d'injection SQL
Cacti Monitoring Tool Spiked by Critical SQL Injection Vulnerability (lien direct)		 Les attaquants peuvent exploiter le problème pour accéder à toutes les données dans la base de données CACTI;Et, il permet RCE lorsqu'il est enchaîné avec une vulnérabilité précédente.
Attackers can exploit the issue to access all data in Cacti database; and, it enables RCE when chained with a previous vulnerability.		 Tool Vulnerability Threat ★★★
zataz.webp 2024-01-08 15:52:58 Kingdom Market : le château pirate pris d\'assaut (lien direct) Le blackmarket Kingdom Market stoppé par les autorités. Ce marché hacker vendait de la drogue, des outils de piratage et de faux documents.... Tool Legislation ★★★
The_Hackers_News.webp 2024-01-08 14:31:00 Webinaire & # 8211;Tirez parti de la sécurité zéro fiducie pour minimiser votre surface d'attaque
Webinar – Leverage Zero Trust Security to Minimize Your Attack Surface (lien direct)		 L'expansion numérique augmente inévitablement la surface d'attaque externe, ce qui vous rend sensible aux cyber-états.Les acteurs de la menace exploitent de plus en plus les vulnérabilités résultant des logiciels et des infrastructures exposés à Internet;Cela comprend ironiquement les outils de sécurité, en particulier les pare-feu et les VPN, qui donnent aux attaquants un accès direct au réseau pour exécuter leurs attaques.En fait, & nbsp; Gartner &
Digital expansion inevitably increases the external attack surface, making you susceptible to cyberthreats. Threat actors increasingly exploit the vulnerabilities stemming from software and infrastructure exposed to the internet; this ironically includes security tools, particularly firewalls and VPNs, which give attackers direct network access to execute their attacks. In fact, Gartner&		 Tool Vulnerability Threat ★★
Veracode.webp 2024-01-08 10:54:45 Présentation de l'analyse dynamique MFA: prise en charge automatisée pour les configurations MFA
Introducing Dynamic Analysis MFA: Automated Support for MFA Setups (lien direct)		 Veracode a récemment introduit une nouvelle fonctionnalité appelée Dynamic Analysis MFA, qui fournit une prise en charge automatisée des configurations d'authentification multi-facteurs (MFA) lors des analyses d'analyse dynamique.Cela élimine la nécessité de désactiver ou de prendre en charge manuellement vos configurations MFA lors de la réalisation de tests de sécurité. Comprendre l'analyse dynamique MFA Lorsque nous nous connectons aux applications, nous utilisons généralement un nom d'utilisateur et un mot de passe, qui est considéré comme une authentification à un facteur.Cependant, pour améliorer la sécurité et réduire le risque que les mots de passe sont perdus ou volés, l'authentification multi-facteurs (MFA) a été introduite.MFA ajoute une couche de sécurité supplémentaire en nécessitant une étape supplémentaire, comme l'utilisation d'une clé matérielle, la réception d'un SMS ou la saisie d'un code à partir d'une application Authenticator. Le MFA est devenu plus courant pour les applications Web car la sécurité Web devient une priorité plus élevée, mais certains outils de test de sécurité obligent les utilisateurs à désactiver ou à prendre en charge manuellement leurs configurations de MFA lors des tests de sécurité des applications.Cela peut être…
Veracode has recently introduced a new feature called Dynamic Analysis MFA, which provides automated support for multi-factor authentication (MFA) setups during dynamic analysis scans. This eliminates the need for you to disable or manually support your MFA configurations when conducting security testing. Understanding Dynamic Analysis MFA When we log into applications, we usually use a username and password, which is considered one-factor authentication. However, to enhance security and reduce the risk of passwords being lost or stolen, multi-factor authentication (MFA) was introduced. MFA adds an extra layer of security by requiring an additional step, such as using a hardware key, receiving a text message, or entering a code from an authenticator app. MFA has become more common for web applications as web security becomes a higher priority, but some security testing tools require users to disable or manually support their MFA setups during application security testing. This can be…		 Tool ★★
Veracode.webp 2024-01-08 09:39:09 Sécuriser JavaScript: meilleures pratiques et vulnérabilités communes
Securing JavaScript: Best Practices and Common Vulnerabilities (lien direct)		 JavaScript est le langage de programmation le plus utilisé, selon la plus récente enquête sur les développeurs Stackoverflow.Bien que JavaScript offre une grande flexibilité et une grande facilité d'utilisation, il présente également des risques de sécurité qui peuvent être exploités par les attaquants.Dans ce blog, nous explorerons les vulnérabilités en JavaScript, les meilleures pratiques pour sécuriser votre code et les outils pour empêcher les attaques. Comprendre les vulnérabilités JavaScript Cet article explore les vulnérabilités communes liées à la sécurité JavaScript et fournit les meilleures pratiques pour sécuriser votre code. Si vous manquez de temps, vous pouvez commencer par utiliser Veracode Dast Essentials, un scanner de sécurité JavaScript, pour identifier les vulnérabilités potentielles.L'exécution de cet outil générera rapidement des rapports, mettra en évidence vos vulnérabilités spécifiques et fournira des instructions claires sur la façon de les résoudre. Vulnérabilités de code source javascript Les développeurs JavaScript s'appuient généralement sur l'intégration de nombreux packages et bibliothèques publiques ou open source contenant…
JavaScript is the most commonly-used programing language, according to the most recent StackOverflow developer survey. While JavaScript offers great flexibility and ease of use, it also introduces security risks that can be exploited by attackers. In this blog, we will explore vulnerabilities in JavaScript, best practices to secure your code, and tools to prevent attacks.   Understanding JavaScript Vulnerabilities  This article explores the common vulnerabilities related to JavaScript security and provides best practices to secure your code. If you\'re short on time, you can begin by using Veracode DAST Essentials, a JavaScript security scanner, to identify potential vulnerabilities. Running this tool will quickly generate reports, highlight your specific vulnerabilities, and provide clear instructions on how to remediate them.  JavaScript Source Code Vulnerabilities JavaScript developers typically rely on integrating numerous public or open-source packages and libraries containing…		 Tool Vulnerability ★★
globalsecuritymag.webp 2024-01-08 08:22:56 McAfee dévoile le " Projet Mockingbird " (lien direct) McAfee dévoile une technologie avancée de détection des Deepfakes audio pour renforcer la protection contre les escroqueries et la désinformation générées par l'IA Connue sous le nom de " Projet Mockingbird ", McAfee présente une solution de détection avancée par intelligence artificielle, offrant aux consommateurs la capacité de discerner le vrai du faux dans un contexte où la prolifération de contenus malveillants générés par l'IA est en constante augmentation • L'innovation de McAfee, boostée par l'IA, est précise à plus de 90 % dans la détection d'un son modifié à des fins malveillantes dans les vidéos • Le " Projet Mockingbird " offrira aux internautes un outil puissant leur permettant de mieux naviguer dans un monde numérique en constante évolution • La combinaison de modèles de détection contextuels, comportementaux et catégoriels alimentés par l'IA établit les bases de la préservation de l'intégrité en ligne, notamment face à l'émergence croissante de pratiques telles que la cyberintimidation, la manipulation de la réputation et les escroqueries à l'investissement basées sur les deepfakes - Produits Tool ★★★
ProofPoint.webp 2024-01-08 06:00:19 ProofPoint reconnu en 2023 Gartner & Reg;Guide du marché pour les solutions de gestion des risques d'initiés
Proofpoint Recognized in 2023 Gartner® Market Guide for Insider Risk Management Solutions (lien direct)		 It\'s easy to understand why insider threats are one of the top cybersecurity challenges for security leaders. The shift to remote and hybrid work combined with data growth and cloud adoption has meant it\'s easier than ever for insiders to lose or steal data. Legacy systems simply don\'t provide the visibility into user behavior that\'s needed to detect and prevent insider threats. With so much potential for brand and financial damage, insider threats are now an issue for the C-suite. As a result, businesses are on the lookout for tools that can help them to better manage these threats.  To help businesses understand what to look for, Gartner has recently released Market Guide for Insider Risk Management Solutions. In this report, Gartner explores what security and risk leaders should look for in an insider risk management (IRM) solution. It also provides guidance on how to implement a formal IRM program. Let\'s dive into some of its highlights. Must-have capabilities for IRM tools Gartner states that IRM “refers to the use of technical solutions to solve a fundamentally human problem.” And it defines IRM as “a methodology that includes the tools and capabilities to measure, detect and contain undesirable behavior of trusted accounts in the organization.” Gartner identifies three distinct types of users-careless, malicious and compromised.  That, we feel, is in line with our view at Proofpoint. And the 2022 Cost of Insider Threats Global Report from Ponemon Institute notes that most insider risks can be attributed to errors and carelessness, followed by malicious and compromised users.  In its Market Guide, Gartner identifies the mandatory capabilities of enterprise IRM platforms:  Orchestration with other cybersecurity tooling  Monitoring of employee activity and assimilating into a behavior-based risk model Dashboarding and alerting of high-risk activity Orchestration and initiation of intervention workflows This is the third consecutive year that Proofpoint is a Representative Vendor in the Market Guide.  Proofpoint was an early and established leader in the market for IRM solutions. Our platform: Integrates with a broad ecosystem of cybersecurity tools. Our API-driven architecture means it\'s easy for you to feed alerts into your security tools. That includes security information and event management (SIEM) as well as SOAR and service management platforms, such as Splunk and ServiceNow. That, in turn, helps you gain a complete picture of potential threats. Provides a single lightweight agent with a dual purpose. With Proofpoint, you get the benefit of data loss prevention (DLP) and ITM in a single solution. This helps you protect against data loss and get deep visibility into user activities. With one agent, you can monitor everyday users. That includes low-risk and regular business users, risky users, such as departing employees, privileged users and targeted users.  Offers one centralized dashboard. This saves you time and effort by allowing you to monitor users, correlate alerts and triage investigations from one place. You no longer need to waste your time switching between tools. You can quickly see your riskiest users, top alerts and file exfiltration activity in customizable dashboards.  Includes tools to organize and streamline tasks. Proofpoint ITM lets you change the status of events with ease, streamline workflows and better collaborate with team members. Plus, you can add tags to help group and organize your alerts and work with more efficiency. DLP and IRM are converging In its latest Market Guide, Gartner says: “Data loss prevention (DLP) and insider risk strategies are increasingly converging into a unified solution. The convergence is driven by the recognition that preventing data loss and managing insider risks are interconnected goals.” A legacy approach relies on tracking data activity. But that approach is no longer sufficient because the modern way of working is more complex. Employees and third parties have access to more data than ever before. And ex Tool Threat Cloud Technical ★★★
DarkReading.webp 2024-01-05 20:00:00 La Corée du Nord fait ses débuts \\ 'spectralblur \\' malware au milieu de l'assaut macOS
North Korea Debuts \\'SpectralBlur\\' Malware Amid macOS Onslaught (lien direct)		 La porte dérobée post-exploitation est la dernière d'une série d'outils personnalisés visant à espionner les utilisateurs d'Apple.
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.		 Malware Tool ★★★
DarkReading.webp 2024-01-05 19:19:00 Le groupe de menaces syriennes colporte un argent destructeur
Syrian Threat Group Peddles Destructive SilverRAT (lien direct)		 Les développeurs du Moyen-Orient prétendent construire une nouvelle version de l'outil d'attaque à télécommande antivirus.
The Middle Eastern developers claim to be building a new version of the antivirus-bypassing remote access Trojan (RAT) attack tool.		 Tool Threat ★★
The_Hackers_News.webp 2024-01-05 15:33:00 Les secrets exposés sont partout.Ici \\ est comment les aborder
Exposed Secrets are Everywhere. Here\\'s How to Tackle Them (lien direct)		 Imaginez ceci: vous tombez sur un secret dissimulé dans le code source de votre entreprise.Instantanément, une vague de panique frappe lorsque vous saisissez les conséquences possibles.Ce secret caché a le pouvoir de ouvrir la voie à une entrée non autorisée, à des violations de données et à une réputation endommagée.Comprendre le secret n'est que le début;L'action rapide et résolue devient impérative.Cependant, sans le
Picture this: you stumble upon a concealed secret within your company\'s source code. Instantly, a wave of panic hits as you grasp the possible consequences. This one hidden secret has the power to pave the way for unauthorized entry, data breaches, and a damaged reputation. Understanding the secret is just the beginning; swift and resolute action becomes imperative. However, lacking the		 Tool ★★★★
globalsecuritymag.webp 2024-01-05 11:59:23 Gestion des secrets : maturité ne rime pas seulement avec outil (lien direct) Gestion des secrets : maturité ne rime pas seulement avec outils. Par Dwayne McDaniel, Security Advocate chez GitGuardian - Points de Vue Tool ★★
AlienVault.webp 2024-01-05 11:00:00 Chardeur asyncrat: obscurcissement, DGA, leurres et Govno
AsyncRAT loader: Obfuscation, DGAs, decoys and Govno (lien direct)		 Executive summary AT&T Alien Labs has identified a campaign to deliver AsyncRAT onto unsuspecting victim systems. During at least 11 months, this threat actor has been working on delivering the RAT through an initial JavaScript file, embedded in a phishing page. After more than 300 samples and over 100 domains later, the threat actor is persistent in their intentions. Key takeaways: The victims and their companies are carefully selected to broaden the impact of the campaign. Some of the identified targets manage key infrastructure in the US. The loader uses a fair amount of obfuscation and anti-sandboxing techniques to elude automatic detections. As part of the obfuscation, the attacker also uses a lot of variable’s names and values, which are randomly generated to harden pivot/detection by strings. DGA domains are recycled every week and decoy redirections when a VM is identified to avoid analysis by researchers. The ongoing registration of new and active domains indicates this campaign is still active. There is an OTX pulse with more information. Analysis AsyncRAT is an open-source remote access tool released in 2019 and is still available in Github. As with any remote access tool, it can be leveraged as a Remote Access Trojan (RAT), especially in this case where it is free to access and use. For that reason, it is one of the most commonly used RATs; its characteristic elements include: Keylogging, exfiltration techniques, and/or initial access staging for final payload delivery. Since it was initially released, this RAT has shown up in several campaigns with numerous alterations due to its open-sourced nature, even used by the APT Earth Berberoka as reported by TrendMicro. In early September, AT&T Alien Labs observed a spike in phishing emails, targeting specific individuals in certain companies. The gif attachment led to a svg file, which also led to a download of a highly obfuscated JavaScript file, followed by other obfuscated PowerShell scripts and a final execution of an AsyncRAT client. This peculiarity was also reported by some users in X (formerly Twitter), like reecDeep and Igal Lytzki. Certain patterns in the code allowed us to pivot and look for more samples in this campaign, resulting in samples going back to February 2023. The registration of domains and subsequent AsyncRAT samples is still being observed at the time of writing this blog. AsyncRAT samples Figure1: Number of samples observed by Alien Labs in this campaign. The modus operandi of the loader involves several stages which are further obfuscated by a Command and Control (C&C) server checking if the victim could be a sandbox prior to deploying the main AsyncRAT payload. In particular, when the C&C server doesn’t rely on the parameters sent, usually after stage 2, or when it is not expecting requests on a particular domain at that time, the C&C redirects to a benign page. AsyncRAT execution flow Figure 2. Execution flow. During the whole campaign, JavaScript files have been delivered to targete Malware Tool Threat Technical ★★
ProofPoint.webp 2024-01-05 06:00:31 2023 Année en revue: versions de contenu axées sur les menaces pour la sensibilisation à la sécurité
2023 Year in Review: Threat-Driven Content Releases for Security Awareness (lien direct)		 As a new year approaches, it is natural to reflect on recent accomplishments. At Proofpoint, we are reflecting on our work to deliver security awareness content and updated features in line with our ongoing goal to drive behavior change.   Proofpoint Security Awareness integrates our rich threat intelligence, which means it taps into current and emerging attacks. Our threat analysts surface threat trends, such as artificial intelligence (AI)-enhanced vishing, malicious QR codes and remote IT support scams. And then we work quickly to release new training features and awareness material to ensure inform security administrators and educate employees about ever-evolving attacks.  In 2023, our content releases focused on three areas:  Delivering a threat-driven program  Improving how security awareness administrators work   Enhancing how people learn  Let\'s review the past year and explore how Proofpoint used content releases to respond to the changing threat landscape.   Image from AI Chatbot Threats training (play video).  Quick turnaround for threat trends  Proofpoint Security Awareness alerts customers to threats in two powerful ways-Threat Alerts and Attack Spotlights. It also continuously trains employees with threat-driven training modules.   Threat Alerts   These weekly releases focus on a specific and current ongoing attack. They explain what the threat is and who it might target. And they describe a specific lure, if applicable.   Each alert is linked to activity that our threat analysts see happening in the wild. We recommend applicable training like simulated phishing and awareness material and include suggested email messaging.   In 2023, we released Threat Alerts on:  IRS-themed phishing lures for tax season (February, March, April)  AI-enhanced vishing calls that impersonate loved ones (March)   Malicious QR codes for credential phishing (May, August)  Telephone-oriented attack delivery (TOAD) using a Geek Squad PDF lure (July, October)   Charity donation scams around the Israel-Palestine crisis (October)  Christmas party lures for credential phishing (November)   Attack Spotlights   These monthly releases cast a wider lens on attack types. They focus on a time-based or reoccurring threat that is expected to trend, typically related to holidays, travel seasons or shopping events. Each spotlight is released a month in advance with a campaign plan, awareness material and training modules, and is available in 12 core languages.   In 2023, Proofpoint published these Attack Spotlight campaigns:  Smishing with package delivery lures (February)  Business email compromise (BEC) phishing with requests for quotations (RFQs) (April)   LinkedIn phishing lures (May)   Amazon phishing lures (June)  Remote IT support scams (September)  Gift card scams (December)  Image from Attack Spotlight video (play video).  Threat modules  These training videos are relevant to the changing threat landscape. They are inspired by our threat intelligence and our team\'s threat landscape research. These micro-learning modules are grounded in learning science principles that are designed to drive behavior change.   Each module has a concise and specific learning objective. The delivery of content is tailored to individual factors such as a person\'s role, learning style, vulnerability level and preferred language.   In 2023, we covered these topics in our new threat training modules:  Data loss protection   AI chatbot threats  Amazon phishing scams  Cryptocurrency investment scams   QR code dangers  Multifactor authentication (MFA)  Image from Threat Module video (play video).  Staying ahead of generative AI attacks  AI-powered systems are promoted as tools to help us work faster, and they are transforming businesses and industries. This wide-reaching access can create security risks from potential data breaches to concerns over user privacy. Your employees need to be aware of the limitations and risks of using AI-powered tools, especiall Ransomware Tool Vulnerability Threat Studies Prediction Cloud ★★★★
Pirate.webp 2024-01-04 23:59:56 Meilleur EDR du marché (Beotm) & # 8211;Outil de détection de point de terminaison et de réponse à la réponse
Best EDR Of The Market (BEOTM) – Endpoint Detection and Response Testing Tool (lien direct)		 BestDroftheMarket est un outil EDR (détection et réponse de point de terminaison) conçu pour servir de terrain de test
BestEDROfTheMarket is a naive user-mode EDR (Endpoint Detection and Response) tool designed to serve as a testing ground		 Tool ★★★
RecordedFuture.webp 2024-01-04 18:15:00 Les pirates utilisant des logiciels malveillants Remcos pour espionner l'Ukraine sont devenus furtifs, les chercheurs trouvent
Hackers using Remcos malware to spy on Ukraine have become stealthier, researchers find (lien direct)		 Un groupe de pirates lié aux opérations de cyber-espionnage contre l'Ukraine améliore ses tactiques pour devenir plus secrètes et efficaces, selon un nouveau rapport.Suivi en tant que UAC-0050, le groupe déploie principalement l'outil de surveillance à distance Remcos pour cibler les agences gouvernementales en Ukraine.Les chercheurs de la société de cybersécurité Uptycs ont découvert une nouvelle méthode que
A hacker group linked to cyber espionage operations against Ukraine is improving its tactics to become more secretive and effective, according to a new report. Tracked as UAC-0050, the group primarily deploys the remote surveillance tool Remcos to target government agencies in Ukraine. Researchers at the cybersecurity firm Uptycs have discovered a new method that		 Malware Tool ★★
silicon.fr.webp 2024-01-04 17:32:51 L\'approche d\'Apple pour des LLM frugaux en mémoire (lien direct) Des chercheurs d'Apple proposent un modèle d'inférence adapté aux environnements dont les ressources mémoire sont restreintes. Tool ★★★
globalsecuritymag.webp 2024-01-04 17:00:49 InfoSec Global Federal ajouté à la liste de produits approuvés du Département de la sécurité intérieure et de la liste des produits approuvés
InfoSec Global Federal Added to Department of Homeland Security Continuous Diagnostics and Mitigation Approved Product List (lien direct)		 Federal mondial Infosec ajouté au diagnostic continu du ministère de la Sécurité intérieure et à la liste des produits approuvés - nouvelles commerciales
InfoSec Global Federal Added to Department of Homeland Security Continuous Diagnostics and Mitigation Approved Product List - Business News		 Tool Vulnerability ★★★
silicon.fr.webp 2024-01-04 14:25:04 Observabilité : comment Odigo a engagé son virage " as a Service " (lien direct) Parallèlement à une migration de ses ressources vers AWS, Odigo - éditeur de logiciels CCaaS - a rationalisé ses sept outils d'APM pour se concentrer sur la solution d'observabilité de Dynatrace. Tool ★★★
Veracode.webp 2024-01-04 13:35:17 Que rechercher dans un scanner de vulnérabilité open source
What To Look For in an Open Source Vulnerability Scanner (lien direct)		 L'une des principales préoccupations de sécurité que nous entendons des leaders de la technologie concerne la sécurité des logiciels open source (OSS) et le développement de logiciels cloud.Un scanner de vulnérabilité open source (pour la numérisation OSS) vous aide à découvrir le risque dans le code tiers que vous utilisez.Cependant, ce n'est pas parce qu'une solution scanne l'open source que vous réduisez finalement le risque de sécurité.Voici ce qu'il faut rechercher dans un scanner de vulnérabilité open source et une solution de test de sécurité pour trouver et corriger les vulnérabilités dans l'OSS. Contexte sur les vulnérabilités en open source et à quoi ressemble le risque Avant de pouvoir parler de ce qu'il faut rechercher dans une solution de numérisation, nous devons parler des vulnérabilités que les outils recherchent.Né en 1999, la base de données nationale de vulnérabilité (NVD) était un produit de l'Institut national des normes et de la technologie (NIST) conçu pour être «le référentiel du gouvernement américain des données de gestion de la vulnérabilité basées sur les normes».Il représente un indice des vulnérabilités connues…
One of the top security concerns we hear from technology leaders is about the security of open source software (OSS) and cloud software development. An open source vulnerability scanner (for scanning OSS) helps you discover risk in the third-party code you use. However, just because a solution scans open source does not mean you are ultimately reducing security risk with it. Here is what to look for in an open source vulnerability scanner and security testing solution to find and fix vulnerabilities in OSS.   Background on Vulnerabilities in Open Source and What the Risk Looks Like  Before we can talk about what to look for in a scanning solution, we need to talk about the vulnerabilities the tools are looking for. Born in 1999, the National Vulnerability Database (NVD) was a product of the National Institute of Standards and Technology (NIST) made to be “the U.S. government repository of standards based vulnerability management data.” It represents an index of known vulnerabilities…		 Tool Vulnerability Cloud ★★★
AlienVault.webp 2024-01-04 11:00:00 VR et AR: risques de sécurité potentiels à préparer
VR and AR: Potential security risks to be prepared for (lien direct)		 The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  Virtual reality (VR) and augmented reality (AR) technologies capture everyone’s imagination with use cases and an unlimited potential for future implementations. While these concepts have been around for decades, they continue to be buzzwords with a fascinating flavor of science fiction. The truth is that the VR and AR combination is close to mainstream adoption these days, with plenty of examples of successful projects creating ripples in ecommerce, entertainment, and many other industries. According to Statista, the global virtual reality and augmented reality market is worth $32.1 billion in 2023, and analysts predict it will exceed $58 billion by 2028. These appear to be conservative estimates, with another study forecasting growth up to a whopping $252 billion in the next four years. Whereas these technologies aren’t susceptible to major malicious exploitation at this point, their skyrocketing popularity might encourage threat actors to come up with viable attack vectors in the near future. This article highlights some of the current security and privacy concerns that stem from the rising adoption of VR and AR technologies. 1. Eye tracking Many people consider eye tracking in VR to be truly revolutionary. The logic of such a perspective is clear: this tech enhances the accuracy of virtual interaction and takes the user experience to a new level by helping interpret people’s emotions. It is also believed to give the security of VR systems a boost because eye scanning can refine biometric verification in the login workflows. As useful as it is, glance tracking could also expose users to hidden monitoring and other privacy risks. For example, VR game makers may be tempted to embed advertisements in their products, similar to how sponsored information is shown in mobile games. If this is the case, eye tracking would be a perfect instrument for advertisers to figure out which ads draw your attention and which ones you ignore. As per analysts’ findings, 95% of decisions to buy a product occur in the subconscious mind. By snooping on a user’s visual response, marketers may be able to derive conclusions regarding their preferences and dislikes. The flip side is that such a technology could potentially play into unscrupulous parties’ hands as a powerful surveillance instrument. 2. Blackmail and harassment Adult entertainment is one of the most popular areas of the virtual reality industry. According to a relevant study, the VR adult content market will see a staggering rise from $716 million in 2021 to $19 billion in 2026. Cybercriminals may try to cash in on this hype by engaging in what’s known as “sextortion”. The idea is to deceive users into thinking that the malefactors have some embarrassing evidence of their private pastimes and instruct them to send money in exchange for not disclosing this information. In some cases, the scammers may even include a valid password for one of the user’s web accounts so that the blackmail message appears true. Bear in mind that they obtained these authentication details from a large-scale data breach that occurred in the past. While these emails contain Data Breach Hack Tool Threat Mobile Prediction ★★★
Korben.webp 2024-01-04 08:00:00 WSA System Control – Gérez facilement votre sous système Android sous Windows (lien direct) Voici le scoop: WSA System Control est l'assistant idéal pour tous ceux qui jonglent avec le Windows Subsystem for Android (WSA). Irritant les complexités techniques, il optimise la gestion du WSA. De plus, le logiciel compte sur une icône dédiée pour filer des infos en temps réel. Il est aussi simple à installer qu'un post-it sur un frigo ! Tool Mobile ★★★
ProofPoint.webp 2024-01-04 06:00:10 Cybersecurity Stop of the Month: MFA Manipulation (lien direct) This blog post is part of a monthly series exploring the ever-evolving tactics of today\'s cybercriminals. Cybersecurity Stop of the Month focuses on the critical first three steps in the attack chain in the context of email threats.  The series is designed to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape.    The critical first three steps of the attack chain: reconnaissance, initial compromise and persistence.  So far in this series, we have covered the following types of attacks:   Supplier compromise   EvilProxy   SocGholish   eSignature phishing  QR code phishing  Telephone-oriented attack delivery (TOAD)    Payroll diversion  In this post, we examine an attack technique called multifactor (MFA) manipulation. This malicious post-compromise attack poses a significant threat to cloud platforms. We cover the typical attack sequence to help you understand how it works. And we dive deeper into how Proofpoint account takeover capabilities detected and prevented one of these threats for our customer.   Background  MFA manipulation is an advanced technique where bad actors introduce their own MFA method into a compromised cloud account. These attackers are used after a cloud account takeover attack, or ATO. ATOs are an insidious threat that are alarmingly common. Recent research by Proofpoint threat analysts found that in 2023 almost all businesses (96%) were targeted by cloud-based attacks. What\'s more, a whopping 60% were successfully compromised and had at least one account taken over. MFA manipulation attacks can work several ways with bad actors having multiple options for getting around MFA. One way is to use an adversary-in-the-middle (AiTM) attack. This is where the bad actor inserts a proxy server between the victim and the website that they\'re trying to log into. Doing so enables them to steal that user\'s password as well as the session cookie.   There\'s no indication to the user that they\'ve been attacked-it just seems like they\'ve logged into their account as usual. However, the attackers have what they need to establish persistence, which means they can maintain access even if the stolen MFA credentials are revoked or deemed invalid.  The scenario  Recently, Proofpoint intercepted a series of MFA manipulation attacks on a large real estate company. In one case, the bad actors used an AiTM attack to steal the credentials of the firm\'s financial controller as well as the session cookie. Once they did that, they logged into that user\'s business account and generated 27 unauthorized access activities.   The threat: How did the attack happen?   Here is a closer look at how this MFA manipulation attack played out:  1. Bad actors used the native “My Sign-Ins” app to add their own MFA methods to compromise Microsoft 365 accounts. We observed that the attackers registered their own authenticator app with notification and code. They made this move right after they gained access to the hijacked account as part of an automated attack flow execution. This, in turn, allowed them to secure their foothold within the targeted cloud environment.  The typical MFA manipulation flow using Microsoft\'s “My Sign-Ins” app.  2. After the compromise, the attackers demonstrated a sophisticated approach. They combined MFA manipulation with OAuth application abuse.    With OAuth abuse, an attacker authorizes and/or uses a third-party app to steal data, spread malware or execute other malicious activities. Attackers also use the abused app to maintain persistent access to specific resources even after their initial access to a compromised account has been cut off.  3. The attackers authorized the seemingly benign application, “PERFECTDATA SOFTWARE,” to gain persistent access to the user\'s account and the systems, as well as the resources and applications that the user could access. The permissions the attackers requested for this app included:  Malware Tool Vulnerability Threat Cloud ★★★
RiskIQ.webp 2024-01-03 19:16:54 APT28: de l'attaque initiale à la création de menaces à un contrôleur de domaine en une heure
APT28: From Initial Attack to Creating Threats to a Domain Controller in an Hour (lien direct)		 #### Description Entre le 15 et 25 décembre, 2023, une série de cyberattaques a été identifiée impliquant la distribution des e-mails contenant des liens vers des «documents» présumés parmi les organisations gouvernementales. Cliquer sur ces liens a entraîné une infection des logiciels malveillants.L'enquête a révélé que les liens ont redirigé les victimes vers un site Web où un téléchargement basé sur JavaScript a lancé un fichier de raccourci.L'ouverture de ce fichier a déclenché une commande PowerShell pour télécharger et exécuter un document de leurre, un interprète Python et un fichier Masepie classifié nommé client.py.Par la suite, divers outils, notamment OpenSSH, Steelhook PowerShell Scripts et la porte dérobée OceanMap ont été téléchargés, avec des outils supplémentaires comme Impacket et SMBEXEC créés pour la reconnaissance du réseau et le mouvement latéral.Les tactiques globales, les techniques et les outils utilisés ont indiqué le groupe APT28.Notamment, la stratégie d'attaque a indiqué un plan plus large pour compromettre l'ensemble du système d'information et de communication de l'organisation, mettant l'accent sur la menace potentielle pour l'ensemble du réseau.Des attaques similaires ont également été signalées contre des organisations polonaises. #### URL de référence (s) 1. https://cert.gov.ua/article/6276894 #### Date de publication 3 janvier 2024 #### Auteurs) Certificat
#### Description Between December 15-25, 2023, a series of cyberattacks were identified involving the distribution of emails containing links to purported "documents" among government organizations. Clicking on these links resulted in malware infecting computers. Investigation revealed that the links redirected victims to a website where a JavaScript-based download initiated a shortcut file. Opening this file triggered a PowerShell command to download and execute a decoy document, a Python interpreter, and a classified MASEPIE file named Client.py. Subsequently, various tools including OPENSSH, STEELHOOK PowerShell scripts, and the OCEANMAP backdoor were downloaded, with additional tools like IMPACKET and SMBEXEC created for network reconnaissance and lateral movement. The overall tactics, techniques, and tools used pointed to the APT28 group. Notably, the attack strategy indicated a broader plan to compromise the entire organization\'s information and communication system, emphasizing the potential threat to the entire network. Similar attacks were also reported against Polish organizations. #### Reference URL(s) 1. https://cert.gov.ua/article/6276894 #### Publication Date January 3, 2024 #### Author(s) CERT-UA 		Malware Tool Threat APT 28 ★★★★
DarkReading.webp 2024-01-03 16:46:00 \\ 'Black Basta Buster \\' exploite le bogue du ransomware pour la récupération de fichiers
\\'Black Basta Buster\\' Exploits Ransomware Bug for File Recovery (lien direct)		 Un outil permet désormais que les fichiers de victime chiffrés par le gang Black Basta Cybercriminal soient entièrement ou partiellement récupérables, selon leur taille.
A tool now allows for victim files encrypted by the Black Basta cybercriminal gang to be fully or partially recoverable, depending on their size.		 Ransomware Tool ★★
AlienVault.webp 2024-01-03 11:00:00 Décodage du piratage éthique: une exploration complète des pratiques de chapeau blanc
Decoding ethical hacking: A comprehensive exploration of white hat practices (lien direct)		 The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  In era of digital devices, where the specter of data breaches and cyber threats looms large, the role of ethical hackers, colloquially known as white hat hackers, has become paramount. This article embarks on an in-depth journey into the realm of ethical hacking, illuminating its profound significance in identifying vulnerabilities and fortifying the intricate tapestry of overall cybersecurity. Ethical hacking, at its core, entails authorized and legal endeavors to infiltrate computer systems, networks, or applications. The primary objective is to unveil vulnerabilities. Diverging from their malevolent counterparts, ethical hackers leverage their skills to fortify security rather than exploit weaknesses. The strategic importance of ethical hacking: Proactive defense: Ethical hacking adopts a proactive stance, aiming to unearth and neutralize potential threats before malicious actors can exploit them. Vulnerability assessment: Systematic assessments conducted by ethical hackers pinpoint weaknesses in systems, networks, and applications, enabling organizations to address vulnerabilities in a timely manner. Compliance and risk management: Ethical hacking aligns seamlessly with regulatory compliance requirements, facilitating effective risk management. This ensures organizations adhere to industry standards and safeguard sensitive information. The crucial role of ethical hackers 1. Identifying vulnerabilities: Ethical hackers employ an array of techniques, including penetration testing, code review, and network analysis, to uncover vulnerabilities. By replicating the tactics of malicious hackers, they unveil potential entry points and weaknesses susceptible to exploitation. 2. Penetration testing: A cornerstone of ethical hacking, penetration testing involves simulating real-world cyber-attacks to evaluate the security posture of a system. This practice assesses how well an organization\'s defenses can withstand various threats. 3. Code Review: Analyzing source code for security flaws is fundamental. Ethical hackers scrutinize the codebase to identify vulnerabilities such as injection flaws, buffer overflows, and insecure dependencies. Navigating the ethical hacking process 1. Planning: Ethical hacking commences with meticulous planning. The ethical hacker collaborates with the organization to define the scope, goals, and methodologies of the assessment. 2. Reconnaissance: Gathering information about the target system is a critical phase. Ethical hackers employ both passive and active reconnaissance techniques to understand the environment they are assessing. 3. Scanning: The scanning phase involves identifying live hosts, open ports, and services on a network. Tools like Nmap and Nessus are commonly employed to assess the target\'s attack surface comprehensively. 4. Gaining access: Ethical hackers attempt to exploit identified vulnerabilities, gaining access to systems or sensitive data. This phase provides organizations insights into the potential impact of a suc Tool Vulnerability Threat ★★★
The_State_of_Security.webp 2024-01-03 02:51:07 Sécurité CI / CD: meilleures pratiques avancées pour sécuriser vos pipelines
CI/CD Security: Advanced Best Practices to Secure Your Pipelines (lien direct)		 L'intégration continue et la sécurité continue (CI / CD) sont devenues cruciales pour les pratiques de développement logiciel modernes.À mesure que la vitesse du développement de logiciels augmente avec DevOps et les méthodologies agiles, il est de plus en plus nécessaire d'assurer l'intégrité des logiciels sur l'ensemble du pipeline de développement.La sécurité CI / CD englobe les pratiques, les outils et les méthodologies qui protègent le pipeline de livraison du logiciel contre les menaces potentielles.Essentiellement, il s'agit de garantir que le code que nous réintégrons et déploie et le logiciel comprenant le pipeline lui-même est aussi sécurisé que possible.Ce...
Continuous Integration and Continuous Delivery (CI/CD) security has become crucial to modern software development practices. As the speed of software development increases with DevOps and Agile methodologies, there is a growing need to ensure the integrity of software across the entire development pipeline. CI/CD security encompasses the practices, tools, and methodologies that protect the software delivery pipeline from potential threats. In essence, it\'s about ensuring that the code we\'re integrating and deploying and the software comprising the pipeline itself is as secure as possible. This...		 Tool ★★
RecordedFuture.webp 2024-01-02 21:20:00 L'Ukraine dit que la Russie a piraté des caméras Web pour espionner des cibles à Kyiv
Ukraine says Russia hacked web cameras to spy on targets in Kyiv (lien direct)		 Les agents de sécurité de l'Ukraine \\ ont déclaré avoir éliminé deux caméras de surveillance en ligne qui auraient été piratées par la Russie pour espionner les forces aériennes de défense et les infrastructures critiques dans la capitale de l'Ukraine \\, Kiev.Les caméras ont été installées sur des bâtiments résidentiels de Kiev et ont été initialement utilisés par les résidents pour surveiller les environs et le parking.Après piratage
Ukraine\'s security officers said they took down two online surveillance cameras that were allegedly hacked by Russia to spy on air defense forces and critical infrastructure in Ukraine\'s capital, Kyiv. The cameras were installed on residential buildings in Kyiv and were initially used by residents to monitor the surrounding area and parking lot. After hacking		 Tool Threat ★★★
InfoSecurityMag.webp 2024-01-02 09:30:00 Black Basta Ransomware Decryptor publié
Black Basta Ransomware Decryptor Published (lien direct)		 Les chercheurs de SRLABS ont révélé une nouvelle suite d'outils de décryptage pour Black Basta Ransomware
Researchers at SRLabs have revealed a new suite of decryption tools for Black Basta ransomware		 Ransomware Tool ★★
ProofPoint.webp 2024-01-02 08:41:00 6 Exigences d'assurance cybersécurité Votre entreprise doit être prête à répondre
6 Cybersecurity Insurance Requirements Your Business Should Be Ready To Meet (lien direct)		 Every year, more companies are finding out firsthand how damaging a cyberattack can be. Research for the 2023 State of the Phish report from Proofpoint found that 30% of companies that were successfully attacked experienced a direct monetary loss. That\'s an increase of 76% year over year. And costs for these attacks are rising. IBM reports that the global average cost of a data breach went up by 15% over the last three years, hitting $4.45 million in 2023.   Concerns about costs and risks mean that more companies than ever are buying cyber insurance. A World Economic Forum survey found that 71% of organizations have cyber insurance. And Allied Market Research projects that the global cyber insurance market, which is currently valued at $12.5 billion, will reach $116.7 billion by 2032.  Investing in cyber insurance for your business can be a wise strategy. For one, it helps you to transfer some of the financial risks of a cybersecurity event to your insurance provider. But the cyber insurance landscape is changing. You should know that getting the coverage you want might be a challenge, and you will need to meet an array of cybersecurity insurance requirements. In this blog post, we\'ll cover six of the most common requirements you\'ll likely need to fulfill.  What is cyber insurance-and what does it cover?  But first, let\'s take a closer look at what cyber insurance is and why it is important. Also known as cyber liability insurance, this relatively new type of insurance helps to protect businesses and individuals from the negative impacts of cybersecurity events. It generally covers:  Loss of data and the associated recovery  Loss of revenue due to business interruption   Loss of transferred funds from cyberattacks, like business email compromise (BEC) and phishing  Loss of funds from ransomware and extortion  Many policies also cover the aftermath and follow-up events associated with a data breach. This includes the costs associated with identifying and notifying victims, credit monitoring for victims and forensics expertise, to name a few.  Why is cyber insurance important?  For many companies, cyber insurance is an essential part of their risk management strategy. It covers many costs related to cyber events, such as legal expenses and fees for compliance violations. Depending on the policy, it might also cover:  Ransomware attacks. If your business is hit with a ransomware attack, you may face demands for payment to unlock your systems. Or you may need to pay a ransom to prevent the release of sensitive data. In certain cases, cyber insurance can help cover ransom payments.  Incident response and recovery. Cybersecurity insurance can help with the cost of investments you may need to make after an attack. For example, you may need to hire experts, conduct forensic investigations, and implement tools and measures to prevent future attacks.  Business disruption. This may include lost revenue during downtime. This coverage can help your business stay afloat financially and continue operating in the wake of a cyber event.  Want more details on the benefits of cyber insurance? Download the Proofpoint presentation, “Cyber Insurance: Facts, Figures and Policy Fundamentals.”  Examples of common cyber insurance requirements  As noted earlier, getting coverage is more complicated than it used to be. Because security breaches are so costly and cybercrime is so common, many insurers have become more stringent in their underwriting processes. Some have lowered caps for payouts and narrowed their coverage offerings as well. This means that the requirements your business may be expected to meet will be fairly complex.   Every provider will likely conduct a risk assessment to determine if you qualify for cyber insurance. The process will help them to determine how much coverage they can offer you, and what you\'ll need to pay for it. The risk assessment might be as quick and simple as a questionnaire or as complex and time-consuming as a third-party audit.  Here are six examples Ransomware Data Breach Tool Threat ★★★
Korben.webp 2024-01-02 08:00:00 View Rendered Source – Une extension Chrome pour explorer les entrailles des pages web (lien direct) "View Rendered Source" est une extension Chrome qui permet aux développeurs de comprendre comment le navigateur transforme le code source HTML en Document Object Model (DOM) fonctionnel. Il donne une vue en temps réel des modifications apportées par JavaScript et offre une solution pour émuler le code source pour les appareils mobiles. L'extension est gratuite et facile à utiliser. Tool ★★★★
Blog.webp 2024-01-01 16:39:46 Les chercheurs fissurent le pilote automatique de Tesla avec le mode \\ 'elon, \\' accéder aux données critiques
Researchers Crack Tesla Autopilot with \\'Elon Mode,\\' Access Critical Data (lien direct)		 par deeba ahmed Rechercheurs allemands de cybersécurité de Technische Universit & Auml; t Berlin a utilisé un outil A & Euro; 600 (& Pound; 520 - 660 $) pour accéder à Root accès à la carte de circuit circuit basée sur ARM64 de l'autopilote de Tesla \\. Ceci est un article de HackRead.com Lire la publication originale: Les chercheurs fissurent le pilote automatique de Tesla avec & # 8216; Mode Elon, & # 8217;Accéder aux données critiques
By Deeba Ahmed German cybersecurity researchers from Technische Universität Berlin employed a €600 (£520 - $660) tool to gain root access to the ARM64-based circuit board of Tesla\'s autopilot. This is a post from HackRead.com Read the original post: Researchers Crack Tesla Autopilot with ‘Elon Mode,’ Access Critical Data		 Tool ★★★
Korben.webp 2024-01-01 08:00:00 Whisper Web – La reconnaissance vocale directement accessible depuis votre navigateur (lien direct) Whisper Web est une version en ligne de l'outil d'OpenAI, Whisper, qui transcrit l'audio en texte sans installer de lourd modèle IA. Compatible avec plusieurs langues, il offre la possibilité de traduire en temps réel et convient parfaitement à la transcription d'interviews, de podcasts ou à la création de sous-titres. Son accès gratuit via un site web le rend facilement accessible. Tool Threat ★★★
ddosecrets.webp 2023-12-31 21:26:05 Gardez l'histoire vivante pour Ddosecrets
Keep the story alive for DDoSecrets (lien direct)		 Soutenez notre collecte de fonds pour conserver la plus grande bibliothèque de fuites en ligne
Support our fundraiser to keep the largest library of leaks online		 Tool ★★★
Blog.webp 2023-12-31 19:14:22 Microsoft désactive l'installateur de l'application après que la fonctionnalité est abusée pour les logiciels malveillants
Microsoft Disables App Installer After Feature is Abused for Malware (lien direct)		 > Par deeba ahmed Selon l'équipe Microsoft Threat Intelligence, les acteurs de la menace étiquetés comme \\ 'motivé financièrement \' utilisent le schéma URI MS-Appinstaller pour la distribution de logiciels malveillants. Ceci est un article de HackRead.com Lire le post original: Microsoft désactive l'installateur de l'application après que la fonctionnalité est abusée pour les logiciels malveillants
>By Deeba Ahmed According to the Microsoft Threat Intelligence Team, threat actors labeled as \'financially motivated\' utilize the ms-appinstaller URI scheme for malware distribution. This is a post from HackRead.com Read the original post: Microsoft Disables App Installer After Feature is Abused for Malware		 Malware Tool Threat ★★★
The_Hackers_News.webp 2023-12-29 14:39:00 Des pirates Kimsuky déploient Appleseed, Meterpreter et Tinynuke dans les dernières attaques
Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks (lien direct)		 Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines. South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as Kimsuky. “A notable point about attacks that
Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines. South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as Kimsuky. “A notable point about attacks that		 Tool Threat APT 43 ★★★
Chercheur.webp 2023-12-29 12:03:53 L'IA est effrayante pour deviner l'emplacement des photos aléatoires
AI Is Scarily Good at Guessing the Location of Random Photos (lien direct)		 wow: Pour tester les performances de Pigeon, je lui ai donné cinq photos personnelles d'un voyage que j'ai fait à travers l'Amérique il y a des années, dont aucune n'a été publiée en ligne.Certaines photos ont été prises dans les villes, mais quelques-unes ont été prises dans des endroits nulle part près des routes ou d'autres points de repère facilement reconnaissables. qui ne semble pas avoir beaucoup d'importance. Il a deviné un camping à Yellowstone à environ 35 miles de l'emplacement réel.Le programme a placé une autre photo, prise dans une rue de San Francisco, à quelques blocs de ville. Toutes les photos ne correspondaient pas faciles: le programme a lié à tort une photo prise sur le frontal du Wyoming à un endroit le long de la gamme de frontaux du Colorado, à plus de cent kilomètres.Et il a deviné qu'une photo du canyon de la rivière Snake en Idaho était de la gorge de Kawarau en Nouvelle-Zélande (en toute honnêteté, les deux paysages sont remarquablement similaires) ...
Wow: To test PIGEON’s performance, I gave it five personal photos from a trip I took across America years ago, none of which have been published online. Some photos were snapped in cities, but a few were taken in places nowhere near roads or other easily recognizable landmarks. That didn’t seem to matter much. It guessed a campsite in Yellowstone to within around 35 miles of the actual location. The program placed another photo, taken on a street in San Francisco, to within a few city blocks. Not every photo was an easy match: The program mistakenly linked one photo taken on the front range of Wyoming to a spot along the front range of Colorado, more than a hundred miles away. And it guessed that a picture of the Snake River Canyon in Idaho was of the Kawarau Gorge in New Zealand (in fairness, the two landscapes look remarkably similar)...		 Tool Threat ★★★★
ProofPoint.webp 2023-12-29 08:35:15 Pointpoint de preuve nommé fournisseur représentatif en 2023 Gartner & Reg;Guide du marché pour la gouvernance des communications numériques
Proofpoint Named as a Representative Vendor in 2023 Gartner® Market Guide for Digital Communications Governance (lien direct)		 It has been more than a year since Gartner retired its Magic Quadrant for Enterprise Information Archiving, which it had published for many years. When it first happened, many of us from the compliance, e-discovery and archiving world wondered what research would come next.   Now the wait is over. On November 13, 2023, Gartner unveiled its new Market Guide for Digital Communications Governance (DCG). And it named Proofpoint as a Representative DCG solution Vendor.  Gartner says, “Gartner retired the Magic Quadrant for Enterprise Information Archiving in 2022. This DCG research recognizes the rise in communication tool complexity and demand from clients to seek guidance on the selection of vendors and solutions that specialize in communications governance.” The Gartner Market Guide presents a “definition, rationale and dynamics” for the DCG market and a list of Representative Vendors.   It is now up to clients to download the Market Guide so that they can learn more about digital communications governance. And they can refer to Gartner recommendations as they look into DCG solutions that will work best for their business.   In this blog post, I go over some of initial coverage of DCG by Gartner. I also provide insights into some of the key points that are made in the new report.  Assessing a strategic planning assumption  Gartner specifies two strategic planning assumptions in the Market Guide. Here is a look at the first one:  “By 2027, 40% of enterprise customers will proactively assess workstream collaboration and meeting solution content for corporate policy and general business insights, up from less than 5% in 2023.”  We believe this seems reasonable at face value if you apply it to businesses that operate in regulated industries like financial services. But I question its validity if the intent is to expand it to all verticals.   Customers that use a DCG solution as a way to improve their litigation readiness will likely find the deployment of a supervision/surveillance solution for “corporate policy and general business insights” to be a “nice to have,” not a “must have.”   I suspect that, in general, these customers will agree to the value in principle. But they will struggle to gain executive sponsors and budget in the absence of:  Regulatory mandates that compel relevant action, like the Financial Industry Regulatory Authority (FINRA) or the U.S. Securities and Exchange Commission (SEC) for financial services  Widely accepted performance statistics, such as archive search performance or archive system availability  It will be interesting to revisit this assumption in 2027. At that point, we\'ll see how much progress has been made on the regulatory and statistics fronts-and the percentage of enterprise customers.  Compliance risk versus security risk  In the Market Direction section of the report, under “Compliance risk versus security,” Gartner states, “Most frequently used for adherence to compliance use cases, solutions are expanding to broader uses in security risk.”   No vendor will do integrations simply because they are cool ideas. They need compelling use cases and business cases. However, with Proofpoint you have a single vendor that offers leading technology for both digital communications governance and security. To learn more about these platforms, check out Proofpoint Aegis threat protection and the Proofpoint Sigma information protection.  For more than 15 years, we have provided innovative solutions to address compliance use cases as well as security use cases. Most of the customers we work with who use Proofpoint Intelligent Compliance offerings are Proofpoint security customers, as well.  The use of machine learning to improve supervision and surveillance  Gartner addresses the use of these technologies in the Market Analysis section of the Market Guide, under “Supervision and surveillance capabilities.” It says, “The results can be used for improved automated monitoring/tagging, and accuracy and efficiency outcomes Tool Threat Commercial ★★
Last update at: 2024-05-08 21:08:27
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter