Sys-Admin InfoSec

23 May 2024 10:24

/ Invisible miners: unveiling GHOSTENGINE’s crypto mining operations

https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine

Sys-Admin InfoSec

21 May 2024 10:30

🟢OpenBLD.net Implemented OISD blocklist

OISD is a one of better projects aimed to reduce internet noise.

What is this oisd blocklist?

The blocklist prevents your devices from connecting to unwanted or harmful domains. It reduces ads, decreases the risk of malware, and enhances privacy.

You can use OISD without exclusions, without additional blocklist - just only OISD in OpenBLD.net as DoH link in RIC mode:

https://ric.openbld.net/dns-query/oisd

See details here:

- https://openbld.net/docs/get-started/third-party-filters/oisd/

Happy Internet surfing! ✌️

Sys-Admin InfoSec

20 May 2024 08:19

/ New Antidot Android Banking Trojan Masquerading as Fake Google Play Updates

https://cyble.com/blog/new-antidot-android-banking-trojan-masquerading-as-google-play-updates/

Sys-Admin InfoSec

17 May 2024 07:04

The incident response cycle, applied to ransomware

Sys-Admin InfoSec

16 May 2024 09:45

📢 DevOps, Linux, Networks и Golang by Rebrain: Расписание практикумов на неделю
⁠
• 21 мая Networks: Глубокое погружение в VoIP: Kamailio (Часть 2)
• 22 мая Linux: Определение нагрузки на сервер и поиск узких мест производительности
• 23 мая Networks: Фильтрация, блокировки и взаимодействие с провайдером
• 24 мая DevOps: Настройка firewall с помощью IPTables - 2

Детали: ↘ Здесь
⁠

Sys-Admin InfoSec

15 May 2024 04:13

/ Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2024-30051. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges..:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051

Sys-Admin InfoSec

14 May 2024 09:09

/ Apple Fixed Security Issues in iOS, iPadOS, macOS

- An app may be able to access user-sensitive data in iOS/iPadOS
- A malicious application may be able to access Find My data in macOS

Sys-Admin InfoSec

10 May 2024 10:21

Unmasking Tycoon 2FA: A Stealthy Phishing Kit Used to Bypass Microsoft 365 and Google MFA

Tycoon 2FA is a phishing-as-a-service (PhaaS) platform that was first seen in August 2023. Like many phish kits, it bypasses multifactor authentication (MFA) protections and poses a significant threat to users. Lately, Tycoon 2FA has been grabbing headlines because of its role in ongoing campaigns designed to target Microsoft 365 and Gmail accounts.

This blog post is a rundown of how these attacks work, how they’re evolving, what they look like in the real world..:

https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass

Sys-Admin InfoSec

08 May 2024 05:02

/ Graph: Growing number of threats leveraging Microsoft API

An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud.

BirdyClient or OneDriveBirdyClient malware revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats

Sys-Admin InfoSec

04 May 2024 12:04

/ Eight Arms To Hold You: The Cuttlefish Malware

https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/

Sys-Admin InfoSec

02 May 2024 16:26

/ Hackers breached its Sign production environment and accessed customer email addresses and hashed Dropbox passwords

The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:

https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

Sys-Admin InfoSec

02 May 2024 04:58

/ Detecting browser data theft using Windows Event Logs

This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:

https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html

Sys-Admin InfoSec

30 Apr 2024 21:31

/ Coordinated attacks on Docker Hub that planted millions of malicious repositories

https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/

Sys-Admin InfoSec

30 Apr 2024 11:06

😡 OpenBLD.net со своими стикерами и мерчем на AppSecFest.kz

Организаторы AppSecFest.kz, предоставили OpenBLD.net, как открытому проекту на безвозмездной основе стенд 🔥

3 Мая, в Алматы, на стенде, у нас будет монитор, команда из трех человек, и мы научим, расскажем, покажем, как:

🔹 Меньше потреблять трафика
🔹 Уменьшить использование ресурсов памяти и процессора
🔹 Уменьшить тепловыделение
🔹 Убрать рекламу в играх
🔹 Батарея живет дольше, телефон греется меньше
🔹 Снизить вероятность возникновения информационных рисков
🔹 Ускорить загрузку веб-страниц
🔹 Уменьшить интернет шум
🔹 Как можно помочь проекту жить и развиваться

И самое главное оставаться собой и быть в фокусе!

Приходите, подходите. Будут олдскул-стайл стикерпаки, пару футболок, пушечный заряд и тонна мотивации.

Информация о конференции доступна Здесь

Sys-Admin InfoSec

25 Apr 2024 17:05

/ Autodesk hosting PDF files used in Microsoft phishing attacks

Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...

https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/

Sys-Admin InfoSec

22 May 2024 10:12

Как чувство осознанности может повлиять на безопасность жизни?

Мое интервью на тему кибербезопасности, как можно обезопасить себя, свое окружение, следить за собой - быть осторожным.

Отдельное спасибо хочу выразить авторам проекта Commutator Казахстан - Узлу связи между государством, бизнесом, обществом и масс-медиа и в частности Татьяне Бендзь за интересно поднятую тему.

Как вести себя с умными колонками, что делать нашим бабушкам и дедушкам в эпоху цифровизации, что такое OpenBLD.net и зачем существует этот проект.

Приятного и полезного просмотра (титры на Казахском, Русском языках присутствуют):

- https://youtu.be/MxWD1N0Bmv8?si=nSmTxUH_AAzsng-5

Детали проекта Commutator о чем он, множество других интересных интервью можно посмотреть на официальном сайте проекта:

- https://commutator.tilda.ws/

Sys-Admin InfoSec

21 May 2024 10:05

Git CVE-2024-32002 - This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed

Got vesrsions: 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, 2.39.4

git config --global core.symlinks false can be disable this attack vector

https://nvd.nist.gov/vuln/detail/CVE-2024-32002

PoC: https://github.com/szybnev/git_rce/blob/main/create_poc.sh

P.S. Thx Tatyana for the reporting ✌️

Sys-Admin InfoSec

17 May 2024 11:35

/ Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/

Sys-Admin InfoSec

17 May 2024 04:55

/ New WiFi Vulnerability: The SSID Confusion Attack

This vulnerability exploits a design flaw in the WiFi standard, allowing attackers to trick WiFi clients on any operating system into connecting to a untrusted network:

https://www.top10vpn.com/research/wifi-vulnerability-ssid/

Sys-Admin InfoSec

16 May 2024 05:25

/ Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices

This blog post aims to provide details on methods for investigating potentially compromised Palo Alto Networks firewall devices and a general approach towards edge device threat detection.

- Detecting Compromise
- Memory Analysis

https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/

Sys-Admin InfoSec

14 May 2024 19:15

/ Trusted Brands and Sponsored Google Ads to Distribute MSIX Payloads

Researchers discovered some of the most dangerous threats – including the Kaseya MSP breach and the more_eggs malware...

https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads

Sys-Admin InfoSec

13 May 2024 05:54

/ CISA - StopRansomware: Black Basta

- technical details
- mitre tactics
- IoC
- mitigations

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

Sys-Admin InfoSec

09 May 2024 13:00

/ TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak

https://www.leviathansecurity.com/blog/tunnelvision

PoC: https://github.com/leviathansecurity/TunnelVision

Sys-Admin InfoSec

04 May 2024 12:32

/ GitLab Vulnerability Allows Intercept Accounts Management

https://nvd.nist.gov/vuln/detail/CVE-2023-7028y

Sys-Admin InfoSec

04 May 2024 11:43

/ Analysis of ArcaneDoor

The zero day vulnerabilities identified are tracked as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358 – of these, only CVE-2024-20353 and CVE-2024-20359 were exploited in the ArcaneDoor campaign.

The campaign, dubbed “ArcaneDoor,” targeted government-owned perimeter network devices from various vendors as part of a global effort..:

https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/

Sys-Admin InfoSec

02 May 2024 13:56

📢 Открытый практикум Linux by Rebrain: С Windows на Linux

Время:

• 8 Мая (Среда) 20:00 МСК

Программа:

• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux

Детали ↘ Здесь

Ведет:

Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.

Sys-Admin InfoSec

01 May 2024 14:46

System Hacking: Common Windows, Linux & Web Server Hacking Techniques

Sys-Admin InfoSec

30 Apr 2024 21:25

/ Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers

..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:

https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/

Sys-Admin InfoSec

26 Apr 2024 08:34

/ Brokewell: do not go broke from new banking malware

..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:

https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware

Sys-Admin InfoSec

25 Apr 2024 13:53

📢 Открытые практикумы by Rebrain: Расписание на неделю

🔹 2 мая Networks: Мастер-класс по собеседованиям для сетевых инженеров и не только
🔹 6 мая Golang: Prometheus метрики в Golang-приложении
🔹 7 мая DevOps: Повесть о том, как найм идёт в ИТ
🔹 8 мая Linux: С Windows на Linux

Детали: ↘ Здесь