Mark Foster

Polyfill[.]io Attack Impacts Over 380,000 Hosts, Including Major Companies ~~~~~~~~~~~ The supply chain attack targeting widely-used Polyfill[.]io JavaScript library is wider in scope than previously thought, with new findings from Censys showing that over 380,000 hosts are embedding a polyfill script linking to the malicious domain as of July 2, 2024. This includes references to "https://cdn.polyfill[.]io" or "https://cdn.polyfill[.]com" in their HTTP responses, the attack surface management firm said. "Approximately 237,700, are located within the Hetzner network (AS24940), primarily in Germany," it noted. "This is not surprising – Hetzner is a popular web hosting service, and many website developers leverage it." Source: https://lnkd.in/gA4Hp_y3 Join Us: ~~~~~~~~ LinkedIn Community: https://lnkd.in/dU8hyiWG LinkedIn Page: https://lnkd.in/dp-6ivtp Whatsapp Community: https://lnkd.in/dYtzvt92 Facebook: https://lnkd.in/d6nGUG_j #Cybersecurity #InfoSec #EthicalHacking #PenTesting #CyberSecurityAwareness #CyberSecurityJobs #CyberDefense #Hacking #EthicalHacker #SecurityAnalyst #VulnerabilityAssessment #CyberSecurityTraining #CyberSecurityTips #CyberSecuritySolutions #CyberSecurityExpert #OffensiveSecurity #SecureCoding #Phishing #RedTeaming #Purpleteam #InfoSecNews #BugBounty #WebApplicationSecurity #AttackSurfaceManagement #FirewallSecurity #CyberSecurityThreats #SecureYourData #VulnerabilityManagement #PenetrationTesting #CyberSecurityCommunity #Exploit #Expertz #ExploitXpErtz #XpErtz #ExploitXpErts #XpErts

5

The current state of CVEs and vendor vuln reporting is often piss poor. Latest case in point, the latest Android 0-day (CVE-2024-32896) being used in the wild. Almost 0 details. The official bulletin says the subcomponent involved is "firmwire"...they can't even get that detail right. We are told to follow vendor recommended mitigations...and there aren't any that I can find. So, "Hey, there's a new 0-day you need to be worried about being exploited in the wild. But here's no details. Here's no suggested mitigations. Just good luck. Glad we told you!" https://lnkd.in/ennKNMrq

20

3 Comments

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

[2-min Tech Talk] Secure Agentless BYOD Access via #CloudBrowser ➡ Providing VDI-like view (SaaS & Pvt Web apps w/ protected storage)  💪 with VDI++ controls (clipboard, watermarking etc. + DLP engine) 👉 but without requiring any addl agent   💲 and at a fraction of the cost of VDI ✨ while enabling Day-1 Access

81

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

Exciting news for PlexTrac Priorities users! 🎉 We've enhanced our context-based scoring engine with a powerful metrics feature, making managing and prioritizing offensive security assessments easier. As an early adopter, Charles Snyder of CAI explains, "PlexTrac Priorities allows us to assess security findings within client-specific risk frameworks and measure risk mitigation progress aligned with business impact." See what the newly update PlexTrac Priorities can do for YOU. https://hubs.li/Q02FRd4N0

19

Imperva protects customers from CVE-2024-4577, a critical vulnerability in PHP. See this blog from Imperva Threat Research for details and an analysis of attack activity. #CyberSecurity

7

🚨 PSA – BEC Tradecraft We have seen an uptick in adversaries using “,” or “.” as malicious inbox rule name then forwarding to the RSS Feeds folder. I’m not 100% sure why, but it may be a way to interfere with SIEM queries or manual data queries. It could also be some new script everyone is pulling from GitHub. Another tactic is the use of IPv6 addresses, likely to bypass IPv4 lookups. If anyone suspects they might have a BEC compromise, I highly recommend this excellent tool to dump forensic CSVs. Focus on the inbox rules output CSV: https://lnkd.in/ehha5hBP #cybersecurity #cloudsecurity #m365 #compromise #security #infosec #riskmanagement #incidentresponse

30

4 Comments

OWASP AppSec Days Pacific Northwest Conference is coming to an end, but not before Brandon Wu's workshop on Finding Bugs and Scaling Your Security Program with Semgrep! 💪

15

With vulnerabilities being exploited faster than ever, staying ahead of threats has become crucial. That’s where Horizon3.ai's Rapid Response service steps in! It's designed to alert you when your organization is at risk, allowing you to swiftly tackle N-day and zero-day vulnerabilities. Want to see how it works? Visit our site to learn how we can help you find, fix, and verify vulnerabilities before they're exploited — or come see the team at #RSAC2024 booth 4505 N!

1

Curious about your Active Directory hygiene? Today's #BloodHoundBasics tip details our latest AD Hygiene cypher queries, specifically "Computers with unsupported operating systems." With a few mods, you can contextualize cypher queries for max visibility of your environment. s/o Nathan Davis

10

Today Counterveil Ltd. CEO met with John Althouse CTO FoxIO. We discussed the evolution of JA to JA4 an actual SILVER BULLET for mapping and fingerprinting. We talked about enabling JA in your Corelight, Fortinet, Google Chronicle and Splunk stacks. John was kind enough to take some time today and provide the ultimate info dump. https://lnkd.in/gdgp4FQh #Cybersecurity #securityoperations #cyberthreatintelligence #hashing #ndr #networkoperations

5

Huntress adds Active Remediation and macOS coverage to its EDR solution: Huntress announced that its Managed Endpoint Detection and Response (EDR) product now includes Active Remediation and macOS coverage. Huntress EDR previously included proactive isolation to stop the spread of threats immediately, click-to-approve remediation, and guided recovery and cleanup. With the addition of Active Remediation, security administrators can pre-authorize Huntress to take action on their behalf with zero manual review and approval. This added convenience promises to speed up the remediation process and lighten the workloads … More → The post Huntress adds Active Remediation and macOS coverage to its EDR solution appeared first on Help Net Security.

1

Often, we get asked about when MFA Auth Methods are changed and where that is logged and what is updated. Great detailed article. https://lnkd.in/g_hP_GTA

10

It is easy to protect PL/SQL from security vulnerabilities. - https://lnkd.in/eqdFZB9n #plsql #protect #databreach

2

Trying to understand how AI and Analytics can help your Agency? Check this out!

2

Looking to ensure you've got a full asset and identify network inventory? This Splunk Lantern article will show you how to identify who's supposed to be on your network and how to find rogue machines. 👀

34

Vulnerability detection software tends to either hurt application performance or fall short in accuracy. With Datadog Code Security, you get a production-ready, IAST-based solution that has earned a 100% score in the OWASP Benchmark test. Read more: https://lnkd.in/g9Cphz9N

99

1 Comment

CISA published an alert on a supply-chain compromise of the XZ Utils package. Are you vulnerable? Check out this Sumo Logic blog to learn what to do including identifying vulnerable versions of this package in your environment and upgrading as soon as possible. https://lnkd.in/d9AJN7fb #XZUtils #cybersecurity

7