Deniz M.

Windows Zero-Day Exploited in the Wild: CVE-2024-38193 A critical use-after-free vulnerability in the afd.sys driver (CVSS 7.8) is being actively exploited by threat actors, including the Lazarus Group. This vulnerability allows privilege escalation, enabling attackers to execute arbitrary code and gain NT AUTHORITY\SYSTEM privileges. Key Details: Vulnerability: Race condition between AfdRioGetAndCacheBuffer() and AfdRioDereferenceBuffer() in Windows RIO. Exploit Process: 1. Heap Spraying: Preparing fake structures in memory. 2. Triggering the Vulnerability: Deregistering buffers mid-use to cause use-after-free. 3. Privilege Escalation: Gaining full system control by overwriting sensitive structures. Targeted Malware: Linked to FudModule, a sophisticated implant. Mitigation: Patch Now: The vulnerability was patched in August 2024 Patch Tuesday. Apply the update immediately to prevent exploitation. Monitor PoC Activity: A Proof-of-Concept (PoC) for CVE-2024-38193 is available on GitHub, increasing the threat level for unpatched systems. Zero-day vulnerabilities like this highlight the evolving sophistication of attackers. #CyberSecurity #WindowsZeroDay #CVE202438193 #VulnerabilityManagement #ThreatIntelligence https://lnkd.in/eXpHcJb7

1

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes. Made to accompany another project that's in the works. https://lnkd.in/dtMA-zfj #cybersecurity #pentesting #redteam

3

Top 10 Cybersecurity Breaches in Switzerland #1 Data of 800,000 Swisscom Customers Compromised As a Result of Breach #2 Swiss Drug and Technology Maker Roche Has Become a Victim of Targeted Cyberattacks #3 SITA, Global Air Transport Giant, Confirmed a Security Breach #4 Swiss Consumer Outlet Was Affected by a Massive Cyberattack #5 Personal Data & Documents of Swiss Town Residents Leaked to Darknet After a Data Breach #6 ProtonMail Service Amends Its Policy After Giving Up an Activist's Data #7 MCH Group, Swiss Events Organizer and Marketing Company, Was Hit by Cyberattack #8 Credit Suisse Leak Unmasks Criminals, Fraudsters & Corrupt Politicians #9 Novartis International AG Reported a Massive Cyberattack: No Data Were Compromised #10 Red Cross Cyberattack Compromised Data of Over 515,000 People Join us at our e-Crime & Cybersecurity Congress in Zurich on September 18, 2024. Secure your complimentary spot today and hear experts share best practices. Spaces are filling up quickly, so register now! Event : https://lnkd.in/e2KUCq9d 🔴 Registration : https://lnkd.in/e42pBe2h 🔴 #eCrime #Cybersecurity #Zurich2024 #CyberCongress #TechConference #CybersecurityExperts #ITSecurity #CyberAwareness #FreeEvent #RegisterNow https://lnkd.in/eu2v2B3j

2

🔐 Security Lessons: Malicious PyPI Package ‘Fabrice’ Steals AWS Keys 🔐 🔹 Summary: A malicious Python package, ‘fabrice,’ has been exploiting typosquatting on PyPI since 2021, targeting AWS credentials across platforms. With over 37,000 downloads, it leverages platform-specific scripts on Windows and Linux to exfiltrate credentials, demonstrating the need for vigilance in dependency management and AWS permissions controls. Key Insights & Recommendations: 🔹 Typosquatting Awareness: The ‘fabrice’ package mimics the popular ‘fabric’ package, catching users off guard with similar naming. 🛡️ Action: Always double-check package names and origins before installation, especially on PyPI. 🔹 OS-Specific Payloads for Persistence: The package adapts based on OS, storing hidden files and scripts for Linux and scheduling tasks for persistence on Windows. 🛡️ Action: Employ endpoint monitoring tools to detect unusual directories and scheduled tasks, which can flag hidden malicious scripts. 🔹 AWS Credentials Theft via Boto3 SDK: Fabrice uses the Boto3 SDK to pull and exfiltrate AWS credentials. 🛡️ Action: Implement AWS IAM policies with the principle of least privilege, regularly rotate keys, and monitor access to AWS credentials. 🔹 Threat Detection and Dependency Management: Retrospective scanning could have detected fabrice sooner. 🛡️ Action: Use dependency scanning tools to retroactively check installed packages for suspicious activity and potential typosquatting. Message for Security Professionals: Ensuring secure dependency management is essential to prevent typosquatting attacks like fabrice. Strengthen AWS credential management, validate dependencies, and actively monitor endpoints to protect against threats that target cross-platform environments. Hashtags: #PythonSecurity #AWS #Typosquatting #CloudSecurity #CredentialTheft #DependencyManagement #Cybersecurity https://lnkd.in/eD-zXwsg

4

CVE-2024-9191: #Sicherheitslücke bei #Okta #Gerätezugangssteuerungssoftware "Verify Agent for Windows" ermöglicht Abgriff von #Passwörtern - #Update verfügbar: "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing." https://lnkd.in/eAJwP3zk

4

🚨 Important news about the critical #CrushFTP security flaw... CVSS 9.8! The team at Airbus #CERT has published Python scripts on #GitHub that can be used to scan for the #CrushFTP file read vulnerability, as well as search for #IoCs in a CrushFTP server installation directory🔥 Thank you!!! Check this out: https://lnkd.in/e6sN7szg If you are still vulnerable (versions below 11.1), your top three priorities today should be: 1️⃣ Patch!! 2️⃣ Patch!! 3️⃣ Patch!! ;-) #SimpleActionPlan This flaw has been exploited as a zero-day to target multiple U.S. entities...

72

Recommended Mitigations 1) Boot Windows into Safe Mode 2) Navigate to the directory C:\Windows\System32\drivers\CrowdStrike 3) Locate the file matching C-00000291*.sys and delete it 4) Boot the host normally Note: You can also boot in Windows Recovery Environment (WinRE) #crowdstrikefriday

5

#Addressing the Growing Demand for Protection Against Large-Scale Cyber Attacks in Switzerland =============================================== Swiss companies are increasingly seeking robust cybersecurity solutions. According to recent insights, 73% of Swiss firms see urgent action required in this area. As cybercrime becomes a top risk, the insurance gap for large-scale cyber events is widening both nationally and internationally. At Helvetia's symposium on June 5, 2023, the critical issues were brought to the forefront. Martin Jara, CEO of Helvetia Switzerland, noted that while the insurance industry can cover individual risks with proper company investments in prevention and data security, there is insufficient protection for large-scale events. The key focus should be on enhancing the resilience of Swiss SMEs through industry-specific prevention, not mandatory measures. Alexandra Arni of Swiss Banking emphasized the "three pillars of resilience": prevention, crisis management, and damage recovery. Hans-Ulrich Bigler of the Swiss Trade Association highlighted the vulnerability of SMEs, stressing the importance of risk awareness and prevention. Patrick Reischuk of Zühlke Engineering underscored the necessity of insuring cyber risks for the benefit of society and the economy. He advocated for a data-driven system to assess cyber risks in real-time, offering incentives to reduce risks and rewarding policyholders with adaptive premiums. Florian Schütz from the National Cyber Security Centre (NCSC) and future Director of the new Federal Cyber Security Office, called for a national cyber strategy aligned with economic productivity goals. Academic contributions, such as those from ETH Zurich, are crucial for developing future-oriented models. Insurance industry leaders like Jean-Philippe Moser from the Swiss Insurance Association (SVV) and David Ribeaud from Helvetia stressed the importance of solid data and risk models to improve insurability of cyber attacks. Investments in cybersecurity will enhance the chances for insurance solutions. Politically, there is strong support for these initiatives. Werner Salzmann, President of the Security Policy Committee of the Council of States, indicated a favorable outlook for broad-based initiatives addressing cybercrime. Collaboratively, the SVV and insurance companies are developing essential foundations. Future symposiums will refine these insights, aiming for a collaborative effort between business, academia, and government to establish a leading model for cyber resilience in Switzerland. This integrated approach presents a significant opportunity for Switzerland to set a global standard in cybersecurity and fortify its economic position. Join the e-crime & Cybersecurity Congress 18. Sept Zurich 2024 https://lnkd.in/e42pBe2h 👈 #CyberSecurity #SwissBusiness #CyberRisk #Insurance #DataSecurity #CyberStrategy #SwissEconomy #CyberResilience #CyberProtection

3

I was selected to speak about vulnerability management at this year´s IT Security Summit in Munich, which will take place from December 2nd to 5th. [𝗦𝗲𝘀𝘀𝗶𝗼𝗻] 🔥 𝗛𝗮𝗰𝗸𝗶𝗻𝗴 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗙𝗮𝘁𝗶𝗴𝘂𝗲: 𝗔 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗚𝘂𝗶𝗱𝗲 𝘁𝗼 𝗣𝗿𝗶𝗼𝗿𝗶𝘁𝗶𝘇𝗶𝗻𝗴 𝗮𝗻𝗱 𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗥𝗶𝘀𝗸𝘀📣 𝗗𝗲𝘀𝗰𝗿𝗶𝗽𝘁𝗶𝗼𝗻: Vulnerability fatigue is a growing concern for security teams overwhelmed by the constant deluge of alerts. This session explores how a risk-based approach to vulnerability management can alleviate this fatigue while improving your organisation’s security posture. You will learn to: 🔹 Assess the true business impact of vulnerabilities. 🔹 Prioritise vulnerabilities based on risk, not just severity. 🔹 Develop a sustainable vulnerability management program. 🔹 Effectively communicate risk to stakeholders. Join us to overcome vulnerability fatigue and build a more resilient security strategy. https://buff.ly/3ZlK28B Organized by Entwickler.de Akademie and Software & Support Media #CyberSecurity #VulnerabilityManagement shiftavenue

16

1 Kommentar

CVE-2023-49606 - CVSS 9.8 - EPSS 0.09% - A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. Ref.1: https://lnkd.in/e7G3a3RW Ref.2: https://lnkd.in/ejAm7ekx

3

CVE-2017-7938 - CVSS 9.8 - EPSS 1,24% - Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files. Ref.: https://lnkd.in/ea26bBra

1

🚨 Unveiling the Invisible Leak: Securing Apache Kafka Against Emerging Threats 🚨 Imagine a bustling city where millions of messages are exchanged every second—that's Apache Kafka in our digital world. It's the heartbeat of countless organizations, streaming data seamlessly across systems. But what happens when an unseen vulnerability turns this lifeline into a potential leak? 🏙️💔 A newly discovered vulnerability, CVE-2024-31141, has emerged, exposing Apache Kafka Clients to potential unauthorized data access. This isn't just a technical hiccup—it's a wake-up call for all of us relying on Kafka for critical data operations. 📢 What's at stake? Unauthorized Access: Attackers could exploit this flaw to read sensitive files and environment variables. 🔓 Data Integrity: The very data streams we trust could be compromised, affecting decision-making and operations. 📉 Escalated Threats: In environments like SaaS platforms, this vulnerability could escalate from mere access to full-fledged system breaches. 🚨 Action Points: 🔧 Upgrade Immediately: If you're using Apache Kafka Clients, update to version 3.8.0 or higher. 🔒 Set Protective Properties: Configure the JVM system property org.apache.kafka.automatic.config.providers=none to prevent unauthorized access. 🛡️ Review Configurations: For Kafka Connect users, implement allowlist.pattern and allowed.paths to restrict access appropriately. 🤝 Collaborate and Share: Inform your teams and networks about this vulnerability to ensure collective security. In the fast-paced world of data streaming, staying ahead means not just moving fast but moving securely. Let's turn this challenge into an opportunity to strengthen our defenses and ensure the integrity of our digital ecosystems. 🌐💪 Stay vigilant, stay informed, and let's keep our data highways secure! #Cybersecurity #ApacheKafka #DataSecurity #Infosec #StaySecure" https://lnkd.in/ezzyw2Bq

2

Exciting webinar with KuppingerCole Analysts AG on June 13, 2024, 4:00 pm CEST: Unveiling 2024's Identity Landscape: Real-World Tactics, Top Risks, and Cybersecurity Best Practices Revealed! As cyberattacks increase in volume and sophistication, it is not a matter of if but when your organization will have an incident. Join Martin Kuppinger and Morey Haber to learn about the risks of poor identity security, techniques used by threat actors, and best practices for protecting against identity theft. Your Key Takeaways: 🔸Hear examples of tactics used in real-world identity attacks 🔸Discover The Top Five Identity Risks in 2024 🔸Learn about Operational best practices to protect Identities & Access Register: https://lnkd.in/e8jc4k6Q #webinar #identityandaccessmanagement #IdentitySecurity

4

Exciting webinar with KuppingerCole Analysts AG on June 13, 2024, 4:00 pm CEST: Unveiling 2024's Identity Landscape: Real-World Tactics, Top Risks, and Cybersecurity Best Practices Revealed! As cyberattacks increase in volume and sophistication, it is not a matter of if but when your organization will have an incident. Join Martin Kuppinger and Morey Haber to learn about the risks of poor identity security, techniques used by threat actors, and best practices for protecting against identity theft. Your Key Takeaways: 🔸Hear examples of tactics used in real-world identity attacks 🔸Discover The Top Five Identity Risks in 2024 🔸Learn about Operational best practices to protect Identities & Access Register: https://lnkd.in/e8jc4k6Q #webinar #identityandaccessmanagement #IdentitySecurity

5

#Blue_Team_Techniques "MITRE Attacks Detection Rules: The MITRE ATT&CK Alerts For log point", Part 2, 2023. Part 1 https://lnkd.in/d2KJ3u-X

2