Mila G.

SANS NewsBites Vol. 26 Num. 63 : National Public Data Breach Affects 3 Billion; PII of 2.9 Billion Individuals Stolen from Background Check Company SANS NewsBites <[email protected]> If not already aware please read the following article including the associated reference links.   Top of the News PII of 2.9 Billion Individuals Stolen from Background Check Company (August 7, 8, & 12, 2024)   According to a class-action lawsuit against Jerico Pictures, Inc., doing business as National Public Data, personally identifiable information belonging to 2.9 billion people was stolen and offered for sale on the dark web. National Public data provides background check and fraud prevention services. Of particular concern is that most people are likely unaware that National Public Data collected their information, as the company regularly scraped PII from non-public sources without consent.   Read more in: - news.bloomberglaw.com: Personal Data of 3 Billion People Stolen in Hack, Suit Says (1) - www.techtimes.com: Almost 2.7 Billion Data Records From National Public Data Leaked in Hacking Forum - cybersecuritynews.com: National Public Data Hacked: 2.9 Billion Users Personal Data Stolen - mashable.com: Background check company breached, nearly 3 billion exposed in data theft

1

1 comentario

Threshold Ed25519 The Edwards-curve Digital Signature Algorithm (EdDSA) is used to create a digital signature using an enhancement of the Schnorr signature with Twisted Edwards curves. Overall it is faster that many other digital signature methods, and is strong for security. One example of EdDSA is Ed25519, and which is based on Curve 25519. It generates a 64-byte signature value of (R,s), and has 32-byte values for the public and the private keys. In this case, we will split a private key into a 2-from-3 secret share policy and allocate it to a number of parties. Next, each of the parties can generate a part of the signature, and then these are aggregated together to produce the overall signature. In this way, the private key never has to be rebuilt in order to create a signature for a data object. https://lnkd.in/eR-2NgYH

26

1 comentario

Automated Generation of Cyber Threat Intelligence, written by the following authors: KAKUMARU Takahiro, TAKAHASHI Wataru, KATSUSE Riku, SIRACUSANO Giuseppe, SANVITO Davide, BIFULCO Roberto. Share and follow Threat Intelligence Lab!

26

CVE-2017-7938 - CVSS 9.8 - EPSS 1,24% - Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files. Ref.: https://lnkd.in/ea26bBra

1

The campaign pushes the malware via phishing emails disguised as invitations to webinars or online courses. The emails redirect the targets to archives containing malicious payloads hosted on the Egnyte secure file-sharing platform. Some versions found in the wild also come with a custom malware loader designed to inject it into the active processes of a handful of apps, including Microsoft Edge, Google Chrome, AnyDesk, Microsoft OneDrive, PowerShell, and Opera. #Muddywater #Phishing #malware #BugSleep #malwarebackdoor #implantdelivery #ttp #MITRE https://lnkd.in/gnqZDe3t

6

Good Opportunity

14

https://lnkd.in/eyYqgNZT "In July 2024, Volexity identified exploitation of a zero-day credential disclosure vulnerability in Fortinet’s Windows VPN client that allowed credentials to be stolen from the memory of the client’s process. This vulnerability was discovered while analyzing a recent sample of the DEEPDATA malware family." #vpn #zeroday #cve #deepdata #maliciousactivity #malware

1

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 comentario

[cbr] Groq just released two new models that look very interesting, and you can already use them on the latest version of "The Cyber Boardroom - Community Edition" 😀. Just go to https://lnkd.in/ecGduU6b and choose the "4. Groq" provider from the "Groq (Free)" platform. The two models added are: LLaMA3 Groq 8b Tool and LLaMA3 Groq 70b Tool. I'm starting to add "function/tool based workflows" to a number of use cases, so this release is very timely :) You can try all Groq models in The Cyber Boardroom UI, which btw are still the fastest models in there (and the cheapest ones, since at the moment, Groq is free to use). Thanks Groq team for releasing this model, and for allowing free use for experiments and research: Sheryl Savage Shelby Hritz Charles Sullivan Sunny Madra Rick Lamers Ad Boon Paul Watson Jonathan Ross Paul Capano  You can read more about this release at: - Introducing Llama-3-Groq-Tool-Use Models: https://lnkd.in/eAbSdH2Y - Groq’s open-source Llama AI model tops leaderboard, outperforming GPT-4o and Claude in function calling: https://lnkd.in/eVvQ5awp - Groq Releases Open-Source AI Models That Outperform Tech Giants in Tool Use Capabilities: https://lnkd.in/efeg6XFn

13

The #CrowdStrike incident this summer reminded us all, once again, how critical resilience is, and that #CyberResilience is not only about being prepared for malicious attacks. As I wrote back then in the wake of the event, this is great opportunity for all organizations to revise and update their preparations. Ralf Weissbeck and his colleagues, driving from their #NotPetya breach experience at Maersk back in 2017, has prepared a super insightful assessment tool that measures your resilience level. There are some unexpected (in a good way!) questions in there that I am sure will make you think, hopefully in ways that you did not do before. I highly recommend that you take this assessment 👇   https://lnkd.in/dzEW23JH

50

2 comentarios

Cyber resilience beyond cybersecurity! 💪 This case illustrates the importance of focusing on cybersecurity with a 360-degree perspective as attackers exploit any vulnerability. Here it has been the outdated software. 💣 It also illustrates the importance of having a cyber resilience plan—a kind of "B" plan. If we are attacked, how can our operations and people continue working? ⚙️ 🏭 #cyberresilience #cybersecurity #informationsecurity #CISO #SecurityGovernance Arexdata Applivery Javier Conejo del Cerro ThousandGuards | Experts in Cybersecurity Startups Gabriella Di Domizio Daniel Martín Alberto Tejero

4

CVE-2023-49606 - CVSS 9.8 - EPSS 0.09% - A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. Ref.1: https://lnkd.in/e7G3a3RW Ref.2: https://lnkd.in/ejAm7ekx

3

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

I just completed the TryHackMe room on Phishing Prevention. This room focus specifically on Email Security, I learnt and used tools such as: - SPF (Sender Policy Framework) - DKIM (DomainKeys Identified Mail) - DMARC (Domain-Based Message Authentication, Reporting, and Conformance) - S/MIME (Secure/Multipurpose Internet Mail Extensions) Final part of the task involved using wireshark to investigate a PCAP file to identify SMTP packet information, and understand how these tools perform on the network.

5

CVE-2024-3661 - CVSS 8.8 - EPSS We don't have an EPSS score for this CVE yet - By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Ref.1: https://lnkd.in/eXEskBcn Ref.2: https://lnkd.in/e_KwDMtH

1

We’ve selected some interesting case studies presented by the course instructor - Filipi Pires - in previous editions of PenTest, Hakin9, and eForensics magazines. https://lnkd.in/deWESwNS #cybersecurity #pentesting #hacking #hackers #window

1