Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for The Catcher in the Y ...

 Special Projects

It’s been a long, long time since humanity has had a year like this one. I don’t think I’ve ever known a year with such a high concentration of black swans of various types and forms. And I don’t mean the kind with feathers. I’m talking about unexpected events with far-reaching   show more ...  

consequences, as per the theory of Nassim Nicholas Taleb, published in 2007 in his book The Black Swan: The Impact of the Highly Improbable. One of the main tenets of the theory is that, with hindsight, surprising events that have already occurred seem obvious and predictable; however, before they occur, no one predicts them. Example: this ghastly virus that’s had the world in lockdown since March. It turns out there’s a whole extended family of coronaviridae — several dozen of them — and new ones are found regularly. Cats, dogs, birds, and bats all get them. Humans get them. Some cause common colds. Others manifest … differently. So, surely, we need to develop vaccines for them as we have for other deadly viruses such as smallpox, polio, and others. Sure, but having a vaccine doesn’t always help a great deal. Look at the flu — still no vaccine that inoculates folks after how many centuries? And anyway, even to start developing a vaccine you need to know what you’re looking for, and that is apparently more art than science. So, why am I telling you this? What’s the connection to … well, it’s inevitably gonna be either cybersecurity or exotic travel, right?! Today, it’s the former. Now, one of the most dangerous cyberthreats in existence is zero-days — rare, unknown (to cybersecurity folks et al.) vulnerabilities in software that can do oh-my-grotesque large-scale awfulness and damage — but they tend to remain undiscovered up until (or sometimes after) the moment they’re exploited. However, cybersecurity experts have ways of dealing with ambiguity and predicting black swans. In this post I want to talk about one such means: YARA. Briefly, YARA aids malware research and detection by identifying files that meet certain conditions and providing a rules-based approach to creating descriptions of malware families based on textual or binary patterns. (Ooh, that sounds complicated. Read on for clarification.) Thus, it’s used to search for similar malware by identifying patterns. The aim is to be able to say that certain malicious programs look like they were made by the same folks, with similar objectives. OK, let’s turn to another metaphor — like a black swan, another water-based one: the sea. Let’s say your network is the ocean, which is full of thousands of kinds of fish, and you’re an industrial fisherman out on the ocean in your ship casting off huge drift nets to catch the fish — but only certain breeds of fish (malware created by particular hacker groups) are interesting to you. Now, the drift net is special. It has special compartments, and only fish of a particular breed (malware characteristics) get caught in each compartment. Then, at the end of the shift, what you have is a lot of fish, all compartmentalized, some of which are relatively new, never-before-seen fish (new malware samples) about which you know practically nothing. But if they’re in a certain compartment — say, “Looks like Breed [hacker group] X” or “Looks like Breed [hacker group] Y.” Here’s a case that illustrates the fish/fishing metaphor. In 2015, our YARA guru and head of GReAT, Costin Raiu, went full-on cyber-Sherlock to find an exploit in Microsoft’s Silverlight software. You really should read that article, but, briefly, what Raiu did was carefully examine certain hacker-leaked e-mail correspondence to assemble a YARA rule from practically nothing, but that went on to help find the exploit and thus protect the world from mega-trouble. (The correspondence was from an Italian firm called Hacking Team — hackers hacking hackers!) So, about these YARA rules… We’ve been teaching the art of creating YARA rules for years. The cyberthreats that YARA helps uncover are rather complex, that’s why we always ran the courses in person — offline — and for only a narrow group of top cybersecurity researchers. Of course, since March, offline training has been tricky because of lockdown; however, the need for education has hardly gone away, and indeed we’ve seen no dip in interest in our courses. That’s only natural: Cyber-baddies continue to think up ever-more-sophisticated attacks — even more so under lockdown. Accordingly, keeping our specialized know-how about YARA to ourselves during lockdown would have been just plain wrong. Therefore, we’ve (1) transferred our training format from offline to online, and (2) made it accessible to everyone. It’s not free, but for such a course at such a level (the very highest), the price is very competitive and market-level. Introducing: What else? Ah, yes. Now, given the ongoing virus-related troubles the world over, we’re continuing our assistance to those on the front lines. We started helping out at the start of the whole corona thing by giving free licenses to healthcare organizations. Now we’re adding to that helping out a variety of nonprofit and nongovernmental organizations fighting for rights in various causes or focusing on making cyberspace a better place (the full list is here). For them, our YARA training will be free. Why? Because NGOs work with very sensitive information that can be hacked in targeted attacks, and not all NGOs can afford the luxury of a department of IT experts. A quick run-through of what’s included in the course: 100% online, self-paced training. You can do the course intensely in a few evenings or spread it out over a month. A combination of both theory and hands-on tasks. There’s a virtual lab for training in writing rules and searching for malware samples in our collection. Practical exercises based on examples of real cyberespionage attacks. A module about the art of looking for something about which you’ve no precise knowledge, when intuition tells you cyberevil is lurking somewhere but you don’t know where or which cyberevil in particular. A certificate on completion confirming your new status as a YARA ninja. As previous graduates have told us, it really does help in their career. So, there you have it, folks: another extremely useful potential string in your bow for fighting highly sophisticated cyberthreats. Meanwhile, it’s business as usual here at K, where we continue our cyberdetective work so we’ll be able to share still more of our very latest know-how and practical experience in fighting the good fight.

 Threat Intel & Info Sharing

Hackers are scanning the Internet for vulnerable network-attached storage (NAS) devices running multiple QNAP firmware versions vulnerable to an RCE vulnerability addressed by the vendor 3 years ago.

 Malware and Vulnerabilities

A global phishing campaign that purports to offer information about personal protective equipment for use during the COVID-19 pandemic is infecting victims' devices with the AgentTesla malware.

 Malware and Vulnerabilities

A new trojan malware family has been identified by researchers that targets cryptocurrency. ESET named the threat KryptoCibule, and it primarily targets users in the Czech Republic and Slovakia.

 Breaches and Incidents

The Norwegian parliament has been hit by a cyber attack, and the e-mail accounts of several elected members were hacked, the national assembly said in a statement on Tuesday.

 Feed

sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database   show more ...  

management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

 Feed

This paper explains how the Nos-Santos-Izquierdo Field (NSIF) works, focusing in the similarities between the RSA problem, factorization, and the calculation decimal expansions.

 Feed

Sagemcom F@ST 5280 routers using firmware version 1.150.61, and possibly others, have an insecure deserialization vulnerability that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie,   show more ...  

an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise.

 Feed

Red Hat Security Advisory 2020-3588-01 - LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2020-3587-01 - Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat A-MQ is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat Fuse 6.3 and Red   show more ...  

Hat A-MQ 6.3. It includes bug fixes, which are documented in the patch notes accompanying the package on the download page. Issues addressed include file disclosure and server-side request forgery vulnerabilities.

 Feed

Ubuntu Security Notice 4481-1 - It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 4471-2 - USN-4471-1 fixed a vulnerability in Net-SNMP. The updated introduced a regression making nsExtendCacheTime not settable. This update fixes the problem adding the cacheTime feature flag. Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks. An attacker could possibly use this issue to access sensitive information. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4480-1 - It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with   show more ...  

OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4479-1 - It was discovered that Django, when used with Python 3.7 or higher, incorrectly handled directory permissions. A local attacker could possibly use this issue to obtain sensitive information, or escalate permissions.

 Feed

Red Hat Security Advisory 2020-3586-01 - The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Issues addressed include information leakage and out of bounds read vulnerabilities.

 Feed

Ubuntu Security Notice 4478-1 - It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.

 Feed

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

 Feed

Starting today, the lifespan of new TLS certificates will be limited to 398 days, a little over a year, from the previous maximum certificate lifetime of 27 months (825 days). In a move that's meant to boost security, Apple, Google, and Mozilla are set to reject publicly rooted digital certificates in their respective web browsers that expire more than 13 months (or 398 days) from their

 Feed

Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device," Cisco said in an advisory posted over the weekend. "A successful

 Security threats

Running a security blog means that I’m always interested in receiving tips about data breaches, vulnerabilities, malware attacks, and the like. But I do explain that I’m not available to help troubleshoot PC problems or provide technical support – there simply aren’t enough hours in the day, and it doesn’t   show more ...  

put any crumbs on the dining room table. This morning, however, I received a very polite message from a reader of the blog.

2020-09
Aggregator history
Tuesday, September 01
TUE
WED
THU
FRI
SAT
SUN
MON
SeptemberOctoberNovember