Sys-Admin InfoSec

19 Feb 2024 09:38

/ Serious Vulnerability in the Internet Infrastructure Fundamental design flaw in DNSSEC discovered

https://www.athene-center.de/en/news/press/key-trap

Sys-Admin InfoSec

15 Feb 2024 11:45

📢 Открытый практикум DevOps by Rebrain: Работаем с бэклогом команды DevOps
⁠
Время:

• 20 Февраля (Вторник) 19:00 МСК

Программа:

• Построение процесса бэклога команды
• Подход к сквозному приоритету задач
• Контроль сроков

↘ Детали

Ведёт:

• Александр Крылов – Опыт работы в DevOps более 7 лет. Спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.

Sys-Admin InfoSec

14 Feb 2024 13:37

/ Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day

https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html

Internet Shortcut Files Security Feature Bypass Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412

Sys-Admin InfoSec

09 Feb 2024 11:06

/ Fake LastPass in AppStore

Official warning:

https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating-lastpass-currently-available-in-apple-app-store/

Sys-Admin InfoSec

08 Feb 2024 11:45

📢 Открытый практикум Linux by Rebrain: RAID массивы 2
⁠
• 12 Февраля (Понедельник) 20:00 МСК

Программа:

• Для чего нужна очистка метаданных mdadm?
• Как перенести данные с обычного диска на RAID1?
• Как понять был ли диск в RAID массиве mdadm?
• Как получить данные с диска из RAID1?
• Увеличение размера RAID массива

↘ Детали

Ведёт:

Андрей Буранов – Системный администратор VK Play. 10+ лет опыта работы с ОС Linux. 8+ лет опыта преподавания.
⁠

Sys-Admin InfoSec

08 Feb 2024 02:08

/ ResumeLooters gang infects websites with XSS scripts and SQL injections to vacuum up job seekers' personal data and CVs

https://www.group-ib.com/blog/resumelooters/

Sys-Admin InfoSec

05 Feb 2024 15:56

/ QNAP OS command injection vulnerability

Vulnerability in QTS, QuTS hero and QuTScloud (high):

https://www.qnap.com/en/security-advisory/qsa-23-47

Sys-Admin InfoSec

05 Feb 2024 09:25

/ AnyDesk - compromised production systems

AnyDesk - compromised any keys:

https://anydesk.com/en/public-statement

Sys-Admin InfoSec

02 Feb 2024 09:13

/ VajraSpy: A Patchwork of espionage apps

These apps share the same malicious functionality, being capable of exfiltrating the following:
- contacts,
- SMS messages,
- call logs,
- device location,
- a list of installed apps, and
files with specific extensions (.pdf, .doc, .docx, .txt, .ppt, .pptx, .xls, .xlsx, .jpg, .jpeg, .png, .mp3, .Om4a, .aac, and .opus).

Technical review:

https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/

Sys-Admin InfoSec

31 Jan 2024 14:57

/ GitHub Hardening Guide 🛡

Preambula:
Mercedes-Benz Source Code at Risk: GitHub Token Mishap Sparks Major Security Concerns

The story:
It all started during one of our internet scans where we identified a GitHub Token leaked by a Full Time Employee at Mercedez, in his GitHub Repository. The GitHub Token gave ‘unrestricted’ and ‘unmonitored’ access to the entire source code hosted at the Internal GitHub Enterprise Server. Redhunt Says.

Conclusion:
The essence of the story is this: even in large companies, failures happen, always be careful, scan tokens in workflow actions...

Next steps:
GitHub Hardening Guide: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

Sys-Admin InfoSec

31 Jan 2024 10:33

📢 Конкурс от Core 24/7 на 10 ваучеров на бесплатное обучение

Ваучеры дают 100% скидку на курс или экзамен из списка ниже до 17.01.2025:

— Каталог на Linux Foundation
— Сертификационному экзамену (каталог)
— или пакету (курс + сертификация)

Подвод итогов 9 февраля, детали здесь - https://core247.io/cncf

Sys-Admin InfoSec

30 Jan 2024 08:42

/ Prevent credential exposure with OIDC for GitHub Actions

Many different CI/CD patterns that cause us to raise our eyebrows. One situation in particular that we encounter relatively often is the unsafe use of AWS credentials.

OpenID Connect is an authentication standard, which when coupled with GitHub Actions, offers a more secure alternative for authentication when compared to utilizing traditional access keys..:

https://blog.cloudsecuritypartners.com/oidc-for-github-actions/

Sys-Admin InfoSec

29 Jan 2024 07:27

/ Info Stealing Packages Hidden in PyPI

The identified packages—nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111—exhibit attack methodologies similar to those outlined in a Checkmarx blog post published four months ago...

The packages released before December 2023 are very similar to those discussed in earlier blog posts. Specifically, they deploy Whitesnake PE malware if the victim’s device runs on Windows, or they can deliver a Python script designed to steal information from Linux devices..:

https://www.fortinet.com/blog/threat-research/info-stealing-packages-hidden-in-pypi

Sys-Admin InfoSec

26 Jan 2024 12:02

/ Phishing Microsoft Teams for initial access

https://pushsecurity.com/blog/phishing-microsoft-teams-for-initial-access/

Sys-Admin InfoSec

24 Jan 2024 11:11

🚀 zDNS Released with Big Updates and Features

Few month ago I stared develop from scratch zDNS service, now it's can:

- Restrict DNS queries by type like as A, AAAA, HTTPS, CNAME, MX, PTR..
- Balancing DNS traffic between upstream servers
- Providing Prometheus metrics
- DNS responses caching by custom TTL
- Has few working modes - Zero Trust, Allow/Blocking
- Has separated "Permanent" mode with additional custom upstream DNS servers
- Can load allow/block lists from local and remote through HTTP(S)
- Create/Delete custom users with different configs and hosts files
- and more...

New opportunities, features, looking forward, and info about of new OpenBLD.net Personal Usage Testing pre-relase see here:

https://openbld.net/blog/zdns-big-updates-and-features/

Sys-Admin InfoSec

15 Feb 2024 16:38

/ New WiFi Authentication Vulnerabilities Discovered

One vulnerability affects Android, ChromeOS and Linux devices connecting to enterprise WiFi networks, another affects home WiFi using a Linux device as a wireless access point:

https://www.top10vpn.com/research/wifi-vulnerabilities/

Sys-Admin InfoSec

15 Feb 2024 08:15

/ Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System

https://www.aquasec.com/blog/snap-trap-the-hidden-dangers-within-ubuntus-package-suggestion-system/

Sys-Admin InfoSec

12 Feb 2024 07:56

/ After a tip, ExpressVPN acts swiftly to protect customers

Express disclosure VPN users browsing data..

https://www.expressvpn.com/blog/windows-app-dns-requests/

Sys-Admin InfoSec

08 Feb 2024 15:47

/ VirtualBox KVM public release

https://cyberus-technology.de/articles/vbox-kvm-public-release

Sys-Admin InfoSec

08 Feb 2024 02:17

/ Critical Security Issue Affecting TeamCity On-Premises (CVE-2024-23917)

https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/

Sys-Admin InfoSec

06 Feb 2024 09:52

/ SmartScreen Vulnerability CVE-2023-36025 - Exploring the Latest Mispadu Stealer Variant

https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/

Sys-Admin InfoSec

05 Feb 2024 11:52

/ runc: CVE-2024-21626: high severity container breakout attack

https://www.openwall.com/lists/oss-security/2024/01/31/6

Sys-Admin InfoSec

05 Feb 2024 07:59

/ HeadCrab 2.0: Evolving Threat in Redis Malware Landscape

Technical analysis of HeadCrab 2.0 advanced malware:

https://www.aquasec.com/blog/headcrab-2-0-evolving-threat-in-redis-malware-landscape/

Sys-Admin InfoSec

01 Feb 2024 11:45

📢 Практикумы DevOps, Linux, Networks, Golang: расписание на Февраль 2024
⁠
• 6 февраля DevOps: Проксирование в Nginx и Angie
• 7 февраля Linux: RAID массивы
• 8 февраля Linux: Погружение в VoIP3: Dialplan в Asterisk
• 12 февраля Linux: RAID массивы 2
• 13 февраля DevOps: Балансировка нагрузки в Nginx и Angie
• 14 февраля Linux: DWARF, ELF, ptrace или как работает ваш дебагер. Часть 2
• 15 февраля DevOps: Ментальная модель Kafka

Открытые Февральские практикумы - Все детали
⁠

Sys-Admin InfoSec

31 Jan 2024 14:46

/ Discovers Important Vulnerabilities in GNU C Library’s syslog()

https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog

Sys-Admin InfoSec

31 Jan 2024 08:49

/ DarkGate malware delivered via Microsoft Teams - detection and response

https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response

Sys-Admin InfoSec

29 Jan 2024 19:41

/ A false-alarm incident involving Panda Security software leads to three very real CVEs

..an attacker might be able to achieve RCE by chaining CVE-2023-6330 with other vulnerabilities..:

https://news.sophos.com/en-us/2024/01/25/multiple-vulnerabilities-discovered-in-widely-used-security-driver/

Sys-Admin InfoSec

27 Jan 2024 06:28

/ GitLab - upgraded to the latest version as soon as possible

Crirtucal security release:

https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Sys-Admin InfoSec

25 Jan 2024 11:45

📢 Открытый практикум DevOps by Rebrain: Практика управления ошибками спринта в DevOps
⁠
• 30 Января (Вторник) 19:00 МСК.

↘ Детали

Программа:

• Что такое RCA
• Спринтовое планирование
• Проводим RCA и соотносим со сквозным бэклогом

Ведёт:

Александр Крылов – Team Lead DevOps. Опыт работы в DevOps более 7 лет. Спикер конференций: DevOps conf, TeamLead conf, Highload conf. Автор курса по Haproxy на Rebrain.

Sys-Admin InfoSec

24 Jan 2024 10:03

/ Malicious npm packages target developer SSH keys

warbeast2000, kodiak2k... Malicious actors looking to obtain SSH keys from developers is an alarming development. Detailed research:

https://www.reversinglabs.com/blog/gitgot-cybercriminals-using-github-to-store-stolen-data