Sys-Admin InfoSec

04 Oct 2023 10:16

kolesa conf'23 в эту субботу в Алматы
⁠
В этом году с Open SysConf.io нам помогли друзья из Kolesa Group, прошло пару недель и вот 7 числа наступает время kolesa conf.

4 направления, 35+ экспертов.. Кто намеревается быть онлайн, рега завтра после 18:00 будет закрыта, осталось чуть больше суток до закрытия.

Детали: kolesa-conf.kz

Sys-Admin InfoSec

02 Oct 2023 16:12

/ Using Cloudflare To Bypass Cloudflare

Cloudflare customer-configured protection mechanisms (e.g., Firewall, DDoS prevention) for websites can be bypassed due to gaps in cross-tenant security controls, potentially exposing customers to attacks Cloudflare is supposed to prevent. Attackers can utilize their own Cloudflare accounts to abuse the per-design trust-relationship between Cloudflare and the customers websites, rendering the protection mechanism ineffective..:

-- https://certitude.consulting/blog/en/using-cloudflare-to-bypass-cloudflare/

Sys-Admin InfoSec

02 Oct 2023 10:28

Canonical Temporary Suspends Snap Store after found potentially malicious snaps

-- https://forum.snapcraft.io/t/temporary-suspension-of-automatic-snap-registration-following-security-incident/37077

Sys-Admin InfoSec

29 Sep 2023 14:07

NIST Final Release 2023

Sys-Admin InfoSec

29 Sep 2023 04:03

/ The Marvin RSA Attack

..is a return of a 25 year old vulnerability that allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed with the private key..:

https://people.redhat.com/~hkario/marvin/

Sys-Admin InfoSec

28 Sep 2023 10:45

Открытый практикум DevOps by Rebrain: DevOps maturity matrix in product
⁠
• 3 Октября (Вторник) 19:00 МСК. Детали

Программа:
• Концепт DevOps maturity matrix
• Этапы внедрения maturity matrix

Ведёт:
• Александр Крылов - Опыт работы в DevOps более 7 лет. Постоянный спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор практикума по Haproxy на Rebrain.

Sys-Admin InfoSec

27 Sep 2023 16:12

/ Surprise: When Dependabot Contributes Malicious Code

https://checkmarx.com/blog/surprise-when-dependabot-contributes-malicious-code/

Sys-Admin InfoSec

27 Sep 2023 11:16

📢🚀 Exciting 2023 Q3 News and Improvements in OpenBLD.net DNS

In first - Big Thanks to the DNS Blocklists project for their significant contribution to "Keep the internet clean" ideology

In this quarter of 2023, I've introduced various enhancements to the OpenBLD.net ecosystem.

🔻 Here's the scoop:

1️⃣ OpenBLD.net now incorporates the DNS Blocklists project into its own DNS filtering mechanisms, ensuring a cleaner internet experience.

2️⃣ Successfully resolved major Apple content delivery issues for Eastern Europe, enhancing DNS delivery experience.

3️⃣ Experience a boost in DNS response speed by approximately 5%. The General pool is now around ~111ms, while Local pools are at ~70ms.

4️⃣ According to Alternativeto, OpenBLD.net stands out as an alternative to Quad9, NextDNS, AdGuard DNS, AhaDNS, and BlahDNS.

✨ And most importantly, OpenBLD.net is your go-to solution for a clean Internet – free from Ads, Tracking, Metrics, Telemetry, Phishing, Malware and all that other "Crap.” without agent installations and add-ins in your browsers.

Embrace yourself and stay focused with the power of clean Internet with https://openbld.net DNS 😎

#OpenBLD #DNS #InternetCleanse #Innovation

Sys-Admin InfoSec

26 Sep 2023 05:59

They will take fingerprints when creating a passport in Kazakhstan

https://www.inform.kz/ru/kak-obyazatelnoe-snyatie-otpechatkov-paltsev-uprostit-zhizn-kazahstantsev-ee12c5

Sys-Admin InfoSec

25 Sep 2023 14:45

/ Inside Microsoft's plan to kill PPLFault

In this research publication, authors will learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other important security features:

-- https://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault

Sys-Admin InfoSec

22 Sep 2023 11:29

/ Urgent Apple Updates for iOS, macOS and etc

— iOS: https://support.apple.com/en-us/HT213927 (elevate privileges)
— iPad: https://support.apple.com/en-us/HT213926 (elevate privileges)
— Monterey: https://support.apple.com/en-us/HT213932 (elevate privileges)
— Ventura: https://support.apple.com/en-us/HT213931 (elevate privileges)
— Safari: https://support.apple.com/en-us/HT213930 (arbitrary code execution)

Sys-Admin InfoSec

21 Sep 2023 11:45

Открытый практикум Networks by Rebrain: Архитектура сети в реальности. Часть 1.
⁠
• 28 Сентября (Четверг) 19:00 МСК. Детали

Программа:
• Рассмотрим реальный кейс переезда сети на 10к+ серверов и сотни удаленных офисов на новое ядро
• Поменяем протокол маршрутизации, выплатим технический долг досрочно

Ведёт:
• Дмитрий Радчук – Team Lead Вконтакте. CCIE x4. Опыт работы с сетями больше 12 лет.

Sys-Admin InfoSec

21 Sep 2023 07:54

/ CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones

https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/

Malicious domain from this research sended to OpenBLD.net 😡 ecosystem. Take care of yourself 🙌🏻

Sys-Admin InfoSec

20 Sep 2023 09:42

/ GitLab Critical Security Release: 16.3.4 and 16.2.7

These versions contain important security fixes, and GitLab strongly recommend that all GitLab installations be upgraded to one of these versions immediately.

In short: A stored XSS vulnerability was discovered in GitLab.com that allowed an attacker to inject HTML in any note, issue description, or wiki page by abusing syntax_highlight_filter.rb. The vulnerability was caused by the lack of proper input sanitization. The attacker could inject a script tag by using the base tag and loading the script from their own domain, bypassing the CSP. This could lead to the creation of tokens and take over of SSO accounts.

— https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/

Sys-Admin InfoSec

19 Sep 2023 14:53

/ Fileless Remote Code Execution on Juniper Firewalls

In this blog, was demonstrated how CVE-2023-36845, a vulnerability flagged as “Medium” severity by Juniper, can be used to remotely execute arbitrary code without authentication. Authors turned a multi-step (but very good) exploit into an exploit that can be written using a single curl command and appears to affect more (older) systems..:

— https://vulncheck.com/blog/juniper-cve-2023-36845

Sys-Admin InfoSec

03 Oct 2023 10:14

🚀 Как достигать своих целей с Live Driving (c)

Например: "Выспаться", "Выучить английский", "Запустить свой проект", "Быть счастливым" - все эти цели вполне осуществимы, я бы сказал, что они жизненно важны.

Тем не менее, руки не доходят до собственных проектов, а счастье кажется где-то в далеком "светлом" будущем, которое может и не наступить.

Оглядись вокруг - мы уже в нужном месте, в нужное время, прямо здесь и сейчас. Все уже случилось!

😎 Некоторое время назад я создал свою точку опоры для достижения целей, которую назвал Live Driving - посредник между человеком и окружающим миром на пути к достижению целей.

Мы встречались 29 октября в Алматы - было здорово, как и всегда на наших встречах. Также есть мысль о встрече в Астане.

🔻 Кто хочет получить позитив, добро пожаловать - заполните форму участия в Live Driving.

Sys-Admin InfoSec

02 Oct 2023 16:09

/ Six 0day exploits were filed against Exim

-- https://lists.exim.org/lurker/message/20231001.165119.aa8c29f9.en.html

Sys-Admin InfoSec

02 Oct 2023 10:23

Two or More Ransomware Variants Impacting the Same Victims and Data Destruction Trends

Report from FBI:
-- https://www.ic3.gov/Media/News/2023/230928.pdf

Sys-Admin InfoSec

29 Sep 2023 07:06

/ ZenRAT: Malware Brings More Chaos Than Calm

..a new malware called ZenRAT being distributed via fake installation packages of the password manager Bitwarden..:

https://www.proofpoint.com/us/blog/threat-insight/zenrat-malware-brings-more-chaos-calm

Sys-Admin InfoSec

28 Sep 2023 14:32

/ MS Teams external participant splash screen bypass

-- https://badoption.eu/blog/2023/09/27/teams4.html

Sys-Admin InfoSec

28 Sep 2023 08:08

/ (0Day) Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability

https://www.zerodayinitiative.com/advisories/ZDI-23-1469/

Sys-Admin InfoSec

27 Sep 2023 15:59

/ Your photos can hear you. AI and machine learning help researchers get audio from still images and silent videos

https://news.northeastern.edu/2023/09/25/audio-recovery-still-images-silent-videos/

Sys-Admin InfoSec

26 Sep 2023 08:45

/ Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted

https://www.threatfabric.com/blogs/xenomorph

Sys-Admin InfoSec

25 Sep 2023 14:51

/ Predator In The Wires

Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions

-- https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/

Sys-Admin InfoSec

22 Sep 2023 14:25

📢. What's the Difference Between Ada and Ric OpenBLD.net? 😡

🌟 Ada - Adaptive DNS: Harmoniously filters malicious content and ensures seamless internet connectivity whenever possible

🚫 Ric - Strict DNS: Blocks many marketing and tracking resources, which may affect access to certain internet content

Curious to learn more? Dive into the details here

I recommend Ada for most OpenBLD.net DNS users. Take care of yourself. Peace out! ✌️

Sys-Admin InfoSec

21 Sep 2023 14:25

/ StopRansomware: Snatch Ransomware

Report from CISA, FBI agency - about of how to mitigate/stop this ramsomware:

— https://www.cisa.gov/sites/default/files/2023-09/joint-cybersecurity-advisory-stopransomware-snatch-ransomware_0.pdf

IOCs:
xml - https://www.cisa.gov/sites/default/files/2023-09/AA23-263A.stix_.xml
json - https://www.cisa.gov/sites/default/files/2023-09/AA23-263A%20%23StopRansomware%20Snatch%20Ransomware.stix_.json

Full advisory:
— https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263av

Thread domains sended to OpenBLD.net DNS 😡

Sys-Admin InfoSec

21 Sep 2023 08:05

/ Malware Appears in Earnest Across Cybercrime Threat Landscape

https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape

Sys-Admin InfoSec

21 Sep 2023 03:13

/ Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT

PoC meant to exploit WinRAR vulnerability:

https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat/

Sys-Admin InfoSec

19 Sep 2023 19:49

/ New Linux Backdoor, Uses Cobalt Strike for Lateral Movement

https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html

Sys-Admin InfoSec

19 Sep 2023 08:41

😎 Live Driving - Собственная система знаний от @sysadminkz

Всем привет, меня зовут Евгений Гончаров, кто меня не знает, узнает позже, пост посвящается знающим меня людям.

За последние дни кибер-конференций меня спрашивали "как ты это делаешь, откуда энергия", вопросов было много, на которые я отвечал "у меня есть своя система знаний”.

Система видения мира созданная собственным сознанием, системно организованная, где все практики, результаты, теория - взяты из сугубо личного опыта подтвержденного годами жизни.

Некоторым я рассказываю "как и что", некоторым говорю основы или указываю на ошибки, но действительно - мне хочется отрефлексировать этот опыт в слух, без телефонов, гаджетов.

Мы можем настроиться. Дайте мне знать через форму о своей готовности к участию.

Кто готов. Давайте попробуем в какой-нибудь день вместе послушать о моем “точечном мире”.