Cybersecurity Flow

[GitHub]Detect images that likely exploit CVE-2022-44268

[GitHub]XSS Vulnerability in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B HTTP configuration page

Babylon.js is a powerful, beautiful, simple, and open game and rendering engine packed into a friendly JavaScript framework.

the Open Source and Pure C++ Packer for eXecutables

Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll …

Free Image Hosting solution, Flickr/imgur alternative, make it easy for users to share their images. Using Cloudflare Pages and Telegraph.

Enumdb是一款针对MySQL和MSSQL关系型数据库的安全渗透后利用工具，支持暴力破解和后利用渗透测试。

A sock, with a wire, so you can tunnel all you desire.

An Active Directory audit utility

😺 A tool designed to shorten steps needed to import and optimize models into VRChat. Compatible models are: MMD, XNALara, Mixamo, DAZ/Poser, Blende…

A Dropper POC focusing EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade)…

Article Link: Malware-Traffic-Analysis.net - 2023-02-03 - DEV-0569 activity: Google ad --> FakeBat Loader --> Redline Stealer & Gozi/ISFB/Ursnif
1 post - 1 participant
Read full topic

SBOM作为软件供应链安全治理的重要抓手，其在行业的应用实践速度明显加快。

Auditing for TLS certificates (Go code)

《任务》中指出，推进电力行业网络与信息安全工作。

混沌工程是通过主动制造故障场景并根据系统在各种压力下的行为表现确定优化策略的一种系统稳定性保障手段，简单说就是通过主动注入故障的方式、提前发...

The New York attorney general has ordered a spyware maker whose apps are marketed as tools for surveilling one’s partner to pay a $410,000 fine and amend their business practices.
Under Thursday’s agreement with Patrick Hinchy, a Florida-based man whose 16 companies operate a constellation of spyware apps and services, the entities must alter practices around marketing of their products and inform owners of targeted devices that the app was active on their phones.
“Snooping on a partner and tracking their cell phone without their knowledge isn’t just a sign of an unhealthy relationship, it is against the law,” said New York Attorney General Letitia James, citing the risk of domestic abuse. “Today’s agreement will block these companies from allowing New Yorkers to be monitored without their awareness, and will continue our ongoing fight to protect New Yorkers’ rights, safety, and privacy.”
Hinchy’s companies are behind the apps PhoneSpector, Highster Mobile, Surepoing, Auto Forwards and TurboSpy, among others.

The pro-Russian hacking group Passion has created a flexible new tool to launch distributed denial-of-service (DDoS) attacks against Ukraine and its allies, researchers say.
Passion’s botnet — the collection of malware-infected devices used for the attacks — is available to rent, and it already has been deployed by other well-known pro-Russian hacktivist collectives, including Killnet and Anonymous Russia, according to a report by Radware published earlier this week.
It’s hardly the first or most popular tool of its kind, but the quick adoption by two infamous hacking groups is reason for concern, the researchers said.
For $120 per month, Passion allows customers to “customize” their DDoS incidents by choosing from 10 attack vectors and determining the duration and intensity of the bogus internet traffic, the researchers said.
This customization option and the ability to combine and switch attack vectors make it more difficult for a target to detect and mitigate the onslaught of webpage requests, according to

A zero-day vulnerability affecting Fortra’s GoAnywhere MFT managed file-transfer solution is currently being exploited, according to cybersecurity giant Rapid7.
The web-based file transfer tool is used by dozens of major companies and schools, including the University of Cincinnati, Think Mutual Bank, Nemours, University of Cincinnati and many local government offices.
Fortra did not respond to requests for comment about when a patch will be available or whether it will publish a public advisory about the issue.
File sharing platforms like GoAnywhere MFT are prime targets for nation-states and criminal hackers due to the data they might contain and their wide deployment across organizations.
Vulnerabilities affecting another file transfer provider, Accellion, were used repeatedly to target financial institutions, government agencies, universities and corporations.
Popular file-sharing network appliance FileZen has also been targeted by hackers in recent years.
No public advisory
On Wednesday, Fortra published

The Cybersecurity and Infrastructure Security Agency (CISA) said two vulnerabilities from Oracle and SugarCRM are actively being exploited and ordered federal civilian agencies to patch them before February 23.
On Thursday, CISA added CVE-2022-21587 – affecting Oracle’s E-Business suite – and CVE-2023-22952 – which affects multiple products from SugarCRM – to its Known Exploited Vulnerabilities Catalog. As with all additions to the list, CISA explained that the vulnerabilities are “frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.”
Oracle patched CVE-2022-21587 in October and several experts said the E-Business suite has a broad user base, making it critical for patches to be installed as soon as possible.
The bug has a 9.8 CVSS score out of a possible 10 and was highlighted by the government of Singapore as a particularly dangerous bug because it is “easily exploitable.”
The SugarCRM vulnerability carries a CVSS score of 8.8 but caused more talk among se

00:00 – PreShow Banter™ — Woke Up Like This03:20 – BHIS – Talkin’ Bout [infosec] News 2023-01-3005:04 – Story # 1: GoTo says hackers stole customers’ backups and encryption keyhttps://www.bleepingcomputer.com/news/security/goto-says-hackers-stole-customers-backups-and-encryption-key/09:48 […]
The post Talkin’ About Infosec News – 2/3/2023 appeared first on Black Hills Information Security.
Article Link: Talkin’ About Infosec News – 2/3/2023 - Black Hills Information Security
1 post - 1 participant
Read full topic

Using a password manager is an effective way to protect your passwords, but you also need to protect your password manager.
Article Link: How to protect and secure your password manager | ZDNET
1 post - 1 participant
Read full topic

Today we have a fascinating tale of a business email compromise (BEC) group steering clear of targeting executives, in favour of fouling up supply chains instead. The attack, which may sound overly complicated, is a fairly streamlined attack with the intention of making a lot of money.
BEC: What is it?
BEC follows a few different patterns, but primarily revolves around an approach by a criminal who has compromised or spoofed an executive-level email account.
The criminal sends one or more "urgent" emails to a more junior employee about moving money from inside the business to somewhere else entirely. Some attackers perform reconnaissance in advance so they can target people in HR, finance, or accounts.
The criminal is likely to insist the money is moved quickly, and that nobody else is involved.
This technique has been around for a number of years, and some folks are getting wise to it. As a result, attackers are trying to broaden how these scams operate to give them the best chance of flying under the radar.

The Cybersecurity and Infrastructure Security Agency (CISA) maintains a “known exploited vulnerabilities catalog” which can be useful if you need help prioritizing the patching of vulnerabilities. In essence it is a long list of vulnerabilities that are actually being used by criminals to do harm, with deadlines for fixing them.
Many organizations are running a plethora of software and Internet-facing devices and vulnerabilities that can be used to exploit them are found every day. Everybody knows they need to patch, but deciding what to patch when, and then finding time and resources to do it, are a significant challenges.
If you are having difficulty deciding what to patch next whether you use a vulnerability and patch management service or not, the CISA catalog offers useful guidance to help you decide what to focus on.
BOD 22-01
The Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 22-01 in November 2021. The directive established the catalog and bound everyone o

As the reports covering all of 2022 start trickling in, we can see that cybercrime and other types of fraud had a major impact last year.
Take for example the 2022 half year fraud update by UK Finance, which tells us that criminals stole a total of £609.8 million (roughly $750 million) through authorized and unauthorized fraud and scams in the UK alone.
UK Finance is the collective voice for the UK’s banking and finance industry, representing around 300 firms across the industry. Its report states: “As we have warned previously, the level of fraud in the UK has reached a point where it must be considered a national security threat.”
Another report, called the ‘State of cyber security in the UK’, surveyed 500 UK-based cybersecurity strategy decision makers. It showed that financials are at significantly higher risk than the average UK business. More than half (58.2 percent) reporting between 40 and 60 cyber security incidents in the last 12 months.
Businesses
Many financials not only carry the burden of protec

Today we have a ten minute YouTube expedition into the murky world of ransomware.
In the video, "The rise of multi-threat ransomware" (embedded below), I cover a couple of key talking points that always seem to come up in conversation.
Single, double, triple?
The video covers how ransomware made the leap from “just” encrypting your files to double- or even triple-threat ransomware. The threats, the blackmail, the possibility of leaking data, and more.
A timeline of ransomware
It also examines attacks of interest from 2017 to the present day, looking at some of the key incidents from the last couple of years, and the brutal real world impact of ransomware attacks that increasingly affect the spaces and services around us. Schools, hospitals, housing associations, everyone is a potential target.
Keeping the enemy at the gate
The video finishes with a run through some of the ways organisations can avoid the perils of ransomware, and the realisation that cyber insurance may not solve every problem.
The video cove

各位 Buffer 周末好，又到了周报时间，我们总结推荐了本周的热点资讯、安全事件、一周好文和省心工具，保证大家不错过本周的每一个重点！

Official Sentry SDK for Rust