campuscodi

campuscodi, 1 day ago to random

Newsletter: https://riskybiznews.substack.com/p/uk-summons-russian-ambassador-over-hacking
Podcast: https://risky.biz/RBNEWS232/

-UK summons Russian ambassador over hacking campaigns
-US charges two FSB APT members
-Former security exec sues Twitter
-Reuters temporarily removes Appin hacker-for-hire article
-23AndMe activates the lawyers
-Meta rolls out E2EE for Messenger
-Law enforcement have been using push notifications for surveillanec
-VPN users explode in Russia
-Windows 12 to come in June 2024
-Chrome 120 is out
-CISA recommends memory-safe langs

campuscodi, 1 day ago to random

Is Twitch just endless commercials now?

campuscodi, 2 days ago to random

PwC's security team has published a report going over SnappyTCP, a Linux reverse shell used in attacks by the Teal Kurma (Sea Turtle) APT: https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html

Previous reporting linked the group to Türkiye.

campuscodi, 2 days ago to random

Meta has started enabling end-to-end encryption (E2EE) conversations for all Facebook Messenger users.

The company says the roll-out phase will take a few months to complete, but it will cover all of its one billion Messenger users.

https://about.fb.com/news/2023/12/default-end-to-end-encryption-on-messenger/

campuscodi, 2 days ago to random

Atlassian has released four security updates to patch RCE vulnerabilities across several products.

They're all pretty bad, so patch ASAP.

https://confluence.atlassian.com/security/december-2023-security-advisories-overview-1318892103.html

campuscodi, 2 days ago to random

Microsoft has a new CISO in Igor Tsyganskiy

https://www.linkedin.com/feed/update/urn:li:activity:7137827887780438016/

campuscodi, 2 days ago to random

UK summons Russian ambassador over hacking campaigns: https://www.gov.uk/government/news/uk-exposes-attempted-russian-cyber-interference-in-politics-and-democratic-processes

NCSC report on Star Blizzard (ColdRiver) activity is here: https://www.ncsc.gov.uk/news/star-blizzard-continues-spear-phishing-campaigns

PDF: https://www.ncsc.gov.uk/files/Advisory-Russian-FSB-cyber-actor-star-blizzard-continues-worldwide-spear-sphishing-campaigns.pdf

NSA report on the group: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3609889/nsa-uk-national-cyber-security-centre-and-partners-release-update-about-russian/

Microsoft also released IOCs and TTPs: https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/

Sanctions were also levied against two Russians, including an FSB officer, for their role in the APT group

campuscodi, 2 days ago to random

Just a reminder that even if you get the RiskyBizNews newsletter via email, you can always find it on the web at https://riskybiznews.substack.com

The web version is better because I will often update it to fix typos, broken links, or add better links (i.e., English coverage for some articles that appeared in local press).

campuscodi, 2 days ago to random

The amount of Russian propaganda in the social media and news site comments in Romania is absolutely staggering.

Literally everything is about the "evil EU" and the "degenerate left."

It could be an article about sports or cooking, it's still the EU or the left's fault somehow.

campuscodi, 2 days ago to random

Security firm Group-IB has discovered a new Linux malware strain that has been secretly infecting systems since at least 2021.

Named Krasue, the malware is primarily used to serve as initial access for other cybercrime operations.

Group-IB says the botnet appears to have been created by the author of the infamous XorDDoS malware or at least by someone who had access to its original source code.

https://www.group-ib.com/blog/krasue-rat/

campuscodi, 3 days ago to random

The CEO of the Bitzlato cryptocurrency exchange has pleaded guilty to money laundering-related charges

(this is the exchange used by Conti to convert stolen funds to rubles)

https://www.justice.gov/opa/pr/founder-and-majority-owner-cryptocurrency-exchange-pleads-guilty-unlicensed-money

campuscodi, 3 days ago to random

Top exploited CVEs, per Cisco Talos

https://blog.talosintelligence.com/cisco-talos-2023-year-in-review/

campuscodi, 3 days ago to random

CISA has published its second Secure by Design alert, with this one urging software developers to transition to memory-safe programming languages.

https://www.cisa.gov/case-memory-safe-roadmaps

campuscodi, 3 days ago to random

WordPress 6.4.2 is out.

It's a security update that fixes an extremely RCE in the CMS

https://wordpress.org/news/2023/12/wordpress-6-4-2-maintenance-security-release/

campuscodi, 3 days ago to random

DirectDefense have developed a three-exploit jailbreak for Chromecast

https://www.directdefense.com/executing-a-chromecast-exploit-times-three/

campuscodi, 3 days ago to random

SecurityScorecard has identified six IP addresses used by Iranian group CyberAv3ngers to scan the internet for unsecured Unitronics PLCs.

88.135.36[.]82
5.144.130[.]35
217.144.104[.]53
31.7.73[.]176
217.144.107[.]183
185.143.233[.]120

https://securityscorecard.com/blog/iran-linked-attack-on-us-water-treatment-station/

campuscodi, 3 days ago to random

The DOD IG has published a document with 24 recommendations for addressing cybersecurity vulnerabilities among DoD contractors.

https://www.dodig.mil/In-the-Spotlight/Article/3606048/press-release-special-report-common-cybersecurity-weaknesses-related-to-the-pro/

campuscodi, 4 days ago to random

Newsletter: https://riskybiznews.substack.com/p/us-government-agencies-lag-on-logging
Podcast: https://risky.biz/RBNEWS231/

-US government agencies lag on logging compliance
-Windows 10 gets three years of paid security updates
-Andariel steals South Korea's laser weapons secrets
-There are still 23,000 backdoored Cisco IOS XE devices
-New SLAM CPU attack disclosed
-15k Go packages vulnerable to repo-jacking
-1.6k Hugging Face API tokens leak online
-HIBP is 10 years now (Feel old yet?)
-ColdFusion zero-day exploited against US govt

campuscodi, 4 days ago to random

New CPU attack just dropped: SLAM

https://www.vusec.net/projects/slam/

campuscodi, 4 days ago to random

CISA says a threat actor has compromised US govt systems via an Adobe Cold Fusion vulnerability.

The vuln was a zero-day when patched in March, but CISA says the attacks took place in June/July... so apply patches

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a