Hasty Briefsbeta

All tags

#cybersecurity

651 stories total

Bilingual

Billions of login credentials have been leaked online
10 months ago
- Billions of login credentials leaked online, totaling 16 billion compromised credentials.
- Leaked data includes credentials for platforms like Google, Facebook, and Apple.
- Data likely stolen via multiple breaches over time, compiled into exposed datasets.
- Infostealers, a type of malware, are suspected to be the primary culprits.
- Experts recommend changing passwords, using password managers, and enabling multifactor authentication.
Amazon issues urgent warning to all Prime users over hack stealing accounts
10 months ago
- Amazon warns Prime users about a surge in cyber scams ahead of Prime Day 2024.
- Scammers use fake emails, texts, and phone calls pretending to be Amazon to steal personal information.
- Amazon reports an 80% increase in impersonation scams during Prime Day 2024 in the US.
- Phone scams in the UK surged by 71% between February and March, often involving fake order alerts.
- Amazon removed over 55,000 phishing websites and 12,000 fraudulent phone numbers in 2023.
- Scammers exploit urgency, claiming accounts will be locked or charged unless immediate action is taken.
- 94% of global impersonation scams occur via email, text, or phone calls, with two-thirds focusing on fake account issues.
- Amazon advises users to verify communications through the official app or website and enable two-factor authentication.
- Payment fraud became the most reported scam by May 2025, accounting for 38% of cases.
- Amazon recommends buying directly from them to avoid delivery scams and ensure product authenticity.
Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic
10 months ago
- Largest DDoS attack reported at 7.3 terabits per second, hitting a target with 37.4 terabytes of junk traffic in 45 seconds.
- Attackers 'carpet bombed' an average of nearly 22,000 destination ports of a single IP address, targeting a total of 34,500 ports.
- Majority of the attack used User Datagram Protocol (UDP) packets, which do not require a handshake, making it easier to flood the target.
- UDP flood attacks overwhelm the target by sending high volumes of packets, saturating the Internet link or internal resources.
- The target system is forced to respond to unreachable ports, eventually buckling under the strain and denying legitimate traffic.
Bot or human? Creating an invisible Turing test for the internet
10 months ago
- AI systems have detectable behavioral signatures that can improve bot detection.
- Roundtable's Proof-of-Human API verifies human presence invisibly, continuously, and instantly.
- Behavioral methods leverage unique human interaction patterns with computers.
- Behavioral biometrics are robust against adversarial attacks due to cost complexity.
- Traditional credentials like passwords are static and easily replayed, unlike behavioral signatures.
- AI agents struggle to replicate human cognitive processes, such as in the Stroop task.
- The Boston Temperature Test distinguishes humans from bots based on predictable errors.
- Behavioral patterns like mouse movement and scroll tracking can aid bot detection.
- Roundtable's approach focuses on economic challenges rather than invasive biometric scans.
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
10 months ago
- XBOW, an autonomous AI-driven penetration tester, reached the top spot on the US HackerOne leaderboard.
- Initial testing involved CTF challenges and custom benchmarks before moving to real-world zero-day vulnerability discovery in open-source projects.
- XBOW operates without human input, scaling rapidly to complete penetration tests in hours.
- The transition to real-world environments was challenging due to the diversity of systems, from modern to legacy.
- XBOW participated in public and private bug bounty programs on HackerOne, treating it like any external researcher.
- Scaling involved strategic target prioritization using a scoring system based on various signals like WAF presence and HTTP status codes.
- Domain deduplication was essential to avoid redundant testing of similar environments.
- XBOW uses validators to ensure the accuracy of vulnerabilities, reducing false positives.
- Over time, XBOW reported thousands of validated vulnerabilities, many affecting high-profile targets.
- XBOW climbed to the top position on the HackerOne US leaderboard, submitting over 1,060 vulnerabilities.
- Vulnerabilities included Remote Code Execution, SQL Injection, XXE, SSRF, and more, with many still awaiting resolution.
- A notable discovery was a vulnerability in Palo Alto’s GlobalProtect VPN, affecting over 2,000 hosts.
- XBOW’s findings were confirmed by program owners, demonstrating its real-world impact and adaptability.
Deploy unikernels to any cloud in seconds with no DevOps
10 months ago
- Unikernels offer significant performance improvements, running up to 300% faster on AWS and 200% faster on GCP.
- They enhance security by design, preventing many remote code execution attacks and eliminating unnecessary tools hackers use.
- Unikernels increase server density, allowing thousands to run on commodity hardware, and boot much faster than Docker.
- NanoVMs provides a promising unikernel implementation, making applications easier to maintain, more secure, and performant.
- Unikernels are considered the next generation of cloud infrastructure, reducing attack surfaces and improving efficiency.
- They work with existing infrastructure like AWS, VSphere, and Azure, requiring no changes to get started.
- NanoVMs' unikernel technology has helped pass PCI DSS Level 1 compliance, showcasing its security benefits.
Hacking TLD EPP registry servers (2023)
10 months ago
- Researchers investigated the security of ccTLD/TLD registries and found vulnerabilities allowing control over DNS zones of several ccTLDs.
- EPP (Extensible Provision Protocol) servers are critical for domain management, facilitating communication between registries and registrars.
- A critical vulnerability in the CoCCA Registry Software allowed XXE (XML External Entity) attacks, leading to unauthorized file access and potential control over domain zones.
- The vulnerabilities were chained to access sensitive files, including SSH keys and database backups, compromising entire ccTLD zones.
- Google's Nomulus registry software was found to be secure against XXE attacks due to defensive programming.
- The research highlights the brittleness of internet infrastructure and the importance of securing registry software.
Canadian telecom hacked by suspected China state group
10 months ago
- Hackers linked to the Chinese government exploited a patched vulnerability to target a Canadian telecom provider.
- The vulnerability, CVE-2023-20198, had a maximum severity rating of 10 and affected Cisco devices.
- Salt Typhoon, a PRC state-sponsored group, is suspected to be behind the attack.
- The group previously compromised US telecom companies like Verizon and AT&T, monitoring wiretap systems.
- Cisco released a patch a week after the vulnerability was disclosed by security firm VulnCheck.
Actively exploited vulnerability gives extraordinary control over server fleets
10 months ago
- Hackers are exploiting a maximum-severity vulnerability (CVE-2024-54085) in AMI MegaRAC firmware.
- The vulnerability has a severity rating of 10/10 and allows complete control over servers via BMCs.
- BMCs (Baseboard Management Controllers) enable remote server management, even when powered off or OS is down.
- Compromising a single BMC can pivot attackers into internal networks to compromise other BMCs.
- The vulnerability permits authentication bypass via a simple HTTP web request to the BMC.
- Discovered by Eclypsium in March, PoC exploit code allows creating admin accounts without credentials.
- No known active exploits were reported at the time of disclosure.
Android phones could soon warn you of "Stingrays" snooping on your communicatio
10 months ago
- Smartphones hold valuable personal data, making them prime targets for hackers and law enforcement.
- Stingrays (cell site simulators) trick phones into connecting to fake towers, enabling tracking and interception of communications without the user's knowledge.
- Law enforcement widely uses Stingrays due to the ubiquity of cell phones among persons of interest.
- Stingrays can inadvertently collect data from non-target phones in the vicinity, raising privacy concerns.
- There are reports of non-law enforcement groups using cell simulators, highlighting broader security risks.
- Google has been working on security measures against Stingrays, with Android 16 introducing detection capabilities for such malicious activities.
US Defense Department will stop providing satellite weather data
10 months ago
- The U.S. Department of Defense will stop providing crucial satellite weather data, impacting hurricane forecasting and sea ice monitoring.
- The data has been used for over 40 years for real-time hurricane tracking and understanding atmospheric and oceanic conditions.
- The decision to stop sharing data is attributed to cybersecurity concerns, though specifics are not disclosed.
- Hurricane forecasters rely on this data to monitor storm structures and predict intensification, which is critical for early warnings and evacuations.
- The loss of this data may lead to gaps in real-time monitoring, potentially causing surprises in hurricane behavior.
- Sea ice monitoring will also be affected, with six key datasets interrupted, impacting climate research and shipping routes.
- Alternative data sources, like Japanese satellites, are being considered, but the transition requires time and calibration.
- The change comes during a record-breaking year for low Arctic sea ice and ahead of an above-average Atlantic hurricane season.
Notorious hacker group is now targeting the aviation industry, the FBI says
10 months ago
- Scattered Spider, a cybercriminal group, is targeting the US and Canadian aviation industry.
- The group uses social engineering to deceive IT help desks into granting access, bypassing MFA.
- Large corporations and third-party IT providers in the airline ecosystem are at risk.
- Once inside, the group steals sensitive data and deploys ransomware.
- Cybersecurity firms like Mandiant and Unit 42 confirm similar incidents in the airline sector.
- Recommendations include tightening help desk identity verification processes.
- Recent incidents affected WestJet and Hawaiian Airlines, though flight operations remain unaffected.
- Southwest Airlines confirmed no system compromise.
Beyond the Hook: A Technical Deep Dive into Modern Phishing Methodologies
10 months ago
- Phishing remains the most prevalent cyber attack in 2025, with 3.4 billion phishing emails sent daily.
- Advanced phishing techniques include HTML page spoofing, Browser-in-The-Browser (BITB), and Adversary-in-The-Middle (AITM) attacks.
- BITB technique mimics browser pop-ups with fake URLs to bypass URL checks.
- Fake CAPTCHA tricks users into executing malicious code via keyboard shortcuts.
- AITM attacks use reverse proxies like Evilginx to capture credentials and bypass MFA.
- Frameless BITB combines BITB with proxified authentication pages for enhanced realism.
- Heavy techniques like noVNC and WebRTC involve streaming browsers to victims for session hijacking.
- Phishing infrastructure requires robust hosting, domain reputation management, and protection against bots.
- Delivery methods include spoofing, third-party mailing services, and exploiting open redirect vulnerabilities.
- Cloud provider domains are increasingly abused for phishing due to their trusted reputation.
Many ransomware strains will abort if they detect a Russian keyboard installed
10 months ago
- Ransomware strains often avoid installing on systems with certain virtual keyboards, like Russian or Ukrainian, to evade local law enforcement scrutiny.
- DarkSide ransomware, linked to the Colonial Pipeline attack, avoids CIS countries to minimize legal risks, reflecting a common tactic among Russian cybercriminals.
- Installing a CIS language keyboard can act as a 'vaccine' against some ransomware by tricking malware into thinking the system is in an off-limits region.
- Cybercriminals balance profitability and legal risks; widespread adoption of language-based defenses could force them to choose between income and safety.
- Other defenses, like faking a VM or adding researcher tools, may offer temporary protection but are not foolproof against evolving malware tactics.
Finding former Australian Prime Minister Tony Abbott's passport number (2020)
10 months ago
- Former Australian Prime Minister Tony Abbott posted his boarding pass on Instagram, which contained sensitive information.
- The boarding pass's barcode and booking reference can be used to access personal details like passport numbers and phone numbers via the airline's website.
- The author investigated the security issue, finding Abbott's passport number, phone number, and internal Qantas staff comments in the webpage's HTML.
- The author contacted the Australian Signals Directorate (ASD) and Qantas to report the security vulnerability.
- After months of effort, Qantas fixed the issue, and the author obtained permission from Tony Abbott to publish the findings.
- The post highlights the risks of sharing boarding passes online and the importance of digital security awareness.
Sinaloa cartel hacked security cameras to track and kill FBI informants, US says
10 months ago
- A hacker working for the Sinaloa drug cartel accessed an FBI official’s phone records and used Mexico City’s surveillance cameras to track and kill FBI informants in 2018.
- The hacker identified an FBI assistant legal attaché in Mexico City, obtaining call logs, geolocation data, and using city cameras to monitor the official and their contacts.
- The cartel used the gathered information to intimidate and kill potential sources or witnesses.
- The incident highlights vulnerabilities in global surveillance systems exploited by criminal organizations.
- The FBI is developing a strategic plan to address these vulnerabilities, including enhanced training for personnel.
Defending Savannah from DDoS Attacks
10 months ago
- Savannah is under a massive DDoS attack since January 2025, with IP blocklist metrics reaching five million by February 2025.
- GNU Savannah is a software development forge operated by the GNU Project and hosted by the FSF, hosting both GNU and non-GNU free software packages.
- Savannah's infrastructure is split across multiple virtual machines for different functionalities, with HTTP/HTTPS hosts for source code reading being the primary target of abuse.
- Analysis of log files revealed that the DDoS attacks involve many different user agents overlapping simultaneously, complicating mitigation efforts.
- Ipset was introduced as a tool to manage large collections of IP addresses, effectively handling over five million unique IPv4 addresses without significant performance degradation.
- Carrier-Grade NAT (CG-NAT) posed a new challenge, leading to the creation of allowlists for confirmed 'real user' behaviors to exempt them from bans.
- The continuous defense against DDoS attacks is resource-intensive but remains a high priority for the Savannah team.
- Companies are urged to use version control tools for cloning repositories instead of scanning them over the web, follow robots.txt rules, and identify their bots properly.
Vulnerability Advisory: Sudo Chroot Elevation of Privilege
10 months ago
- Services offered include Governance, Risk, & Compliance (GRC), Network Security Architecture, Identity & Zero Trust, Hybrid Cloud Security, and Managed Services.
- The Kipling Method is highlighted as a way to enhance Zero Trust by providing a comprehensive view of access requests.
- Various vulnerability advisories are listed, including issues related to Sudo, Ubuntu Apport, and Microsoft Defender for Endpoint on Linux.
- Articles and guides cover topics like Continuous Cloud Security, Zero Trust, SOC (Security Operations Center), and securing supply chains.
- Insights on cybersecurity trends, such as AI-enabled threats, offensive security, and the importance of attack surface management.
- Strategic advice for IT leaders, including funding innovation, combating tool sprawl, and post-ransomware attack steps.
FBI Warning Issued as 2FA Bypass Attacks Surge – Get Prepared
10 months ago
- FBI warns about Scattered Spider threat group expanding attacks to the transportation sector, particularly aviation.
- Scattered Spider uses social engineering techniques, impersonating employees or contractors to bypass multi-factor authentication (MFA).
- The group collaborates with ransomware operators like ALPHV, RansomHub, and DragonForce, and has ties to Russia-aligned threat actors.
- Scattered Spider recruits social engineers with specific qualifications, including fluency in English and no accent, to refine impersonation tactics.
- The group is expected to adopt AI-powered attack methodologies to manipulate trust-based systems like IT help desks.
- Scattered Spider has also targeted the insurance industry, with Google Threat Intelligence Group confirming multiple intrusions.
- Businesses in the supply chain are at risk, as Scattered Spider exploits lateral movement to compromise larger targets.
- The FBI urges organizations to follow strict security protocols and report any suspected targeting to their local FBI office.
Cyberattack on Radix: Federal Administration data also affected
10 months ago
- Radix foundation hit by a ransomware attack.
- Data was stolen and encrypted during the attack.
- Radix's customers include various federal offices.
- Stolen data has been published on the dark web.
- Relevant offices will now analyze the published data.

first prev9next

About|Login

#cybersecurity

Billions of login credentials have been leaked online

Amazon issues urgent warning to all Prime users over hack stealing accounts

Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic

Bot or human? Creating an invisible Turing test for the internet

XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

Deploy unikernels to any cloud in seconds with no DevOps

Hacking TLD EPP registry servers (2023)

Canadian telecom hacked by suspected China state group

Actively exploited vulnerability gives extraordinary control over server fleets

Android phones could soon warn you of "Stingrays" snooping on your communicatio

US Defense Department will stop providing satellite weather data

Notorious hacker group is now targeting the aviation industry, the FBI says

Beyond the Hook: A Technical Deep Dive into Modern Phishing Methodologies

Many ransomware strains will abort if they detect a Russian keyboard installed

Finding former Australian Prime Minister Tony Abbott's passport number (2020)

Sinaloa cartel hacked security cameras to track and kill FBI informants, US says

Defending Savannah from DDoS Attacks

Vulnerability Advisory: Sudo Chroot Elevation of Privilege

FBI Warning Issued as 2FA Bypass Attacks Surge – Get Prepared

Cyberattack on Radix: Federal Administration data also affected