■■□□□ Vulnerabilities in McAfee ePolicy Orchestrator.
https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
PT SWARM
Vulnerabilities in McAfee ePolicy Orchestrator
This August, I discovered three vulnerabilities in McAfee ePolicy Orchestrator (ePO) version 5.10.0. McAfee ePO is software that helps IT administrators unify security management across endpoints, networks, data, and compliance solutions from McAfee and…
cKure
6dd04fe2-7d10-4632-89f1-eb8f932f6e94.pdf
■■■□□ Detailed technical analysis of SolarWinds Hack / SunBurst.
https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
Google Cloud Blog
SUNBURST Additional Technical Details | Mandiant | Google Cloud Blog
■■□□□ #DataLeak: A misconfigured AWS ☁️ cloud storage bucket has exposed the personal details of hundreds of social media influencers, potentially putting them at risk of fraud and harassment, according to researchers.
A team at vpnMentor discovered the AWS S3 bucket wide open with no encryption or password protection, back in early November. Action has apparently yet to be taken by the company responsible, Barcelona-based “social commerce” company 21 Buttons.
https://www.infosecurity-magazine.com:443/news/misconfigured-bucket-exposes/
A team at vpnMentor discovered the AWS S3 bucket wide open with no encryption or password protection, back in early November. Action has apparently yet to be taken by the company responsible, Barcelona-based “social commerce” company 21 Buttons.
https://www.infosecurity-magazine.com:443/news/misconfigured-bucket-exposes/
Infosecurity Magazine
Misconfigured AWS Bucket Exposes Hundreds of Social Influencers
Victims could be targeted by stalkers and fraudsters
cKure
■■■□□ Microsoft Warns CrowdStrike of Hackers Targeting Azure Cloud Customers and alleged unsuccessful attempt to compromise CrowdStrike. https://thehackernews.com/2020/12/microsoft-warns-crowdstrike-of-hackers.html
■■■■□ SolarWinds / Solorigate: Suspected Russian hackers used Microsoft vendors to breach customers.
https://in.mobile.reuters.com/article/amp/idINKBN28Y1QF
https://in.mobile.reuters.com/article/amp/idINKBN28Y1QF
Reuters
Suspected Russian hackers used Microsoft vendors to breach customers
The suspected Russian hackers behind the worst U.S. cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp, investigators said.
■■□□□ Apple sends hacker-friendly iPhones to researchers, expects quick fix for vulnerabilities. The phones allow attackers to bypass code signing and similar features that prohibit offensive tactics.
■■■□□ Police Arrest 21 WeLeakInfo Customers Who Bought Breached Personal Data.
https://thehackernews.com/2020/12/police-arrest-21-weleakinfo-customers.html
https://thehackernews.com/2020/12/police-arrest-21-weleakinfo-customers.html
■■□□□ Another technical writeup.
SolarWinds' SunBurst: the next level of stealth.
https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth
SolarWinds' SunBurst: the next level of stealth.
https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth
ReversingLabs
The attack on SolarWinds: Next-level stealth was key
The SunBurst supply chain attack, which was behind the SolarWinds compromise, took sophistication and patience.
cKure
■■■□□ Microsoft Warns CrowdStrike of Hackers Targeting Azure Cloud Customers and alleged unsuccessful attempt to compromise CrowdStrike. https://thehackernews.com/2020/12/microsoft-warns-crowdstrike-of-hackers.html
■■□□□ 🇺🇸 | 🇷🇺 #CyberWar update: CrowdStrike releases free Azure tool to review assigned privileges.
https://hackademicus.nl/crowdstrike-releases-free-azure-tool-to-review-assigned-privileges/
https://hackademicus.nl/crowdstrike-releases-free-azure-tool-to-review-assigned-privileges/
hackademicus.nl
Hackademicus is under construction
it's all about security stupid!
■■□□□ ApkLeaks - Scanning APK File For URIs, Endpoints And Secrets.
https://github.com/dwisiswant0/apkleaks
https://github.com/dwisiswant0/apkleaks
GitHub
GitHub - dwisiswant0/apkleaks: Scanning APK file for URIs, endpoints & secrets.
Scanning APK file for URIs, endpoints & secrets. Contribute to dwisiswant0/apkleaks development by creating an account on GitHub.
■■□□□ CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze.
http://seclists.org/fulldisclosure/2020/Dec/55
http://seclists.org/fulldisclosure/2020/Dec/55
seclists.org
Full Disclosure: Re: [FD]
CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
■■■□□ #DataLeak: REvil ransomware group, aka Sodinokibi, hacked The Hospital Group and threatens to release before-and-after pictures of celebrity clients.
https://securityaffairs.co/wordpress/112637/cyber-crime/the-hospital-group-revil.html
https://securityaffairs.co/wordpress/112637/cyber-crime/the-hospital-group-revil.html
■■■□□ Analyzing APT19 malware (viz. DLL backdoor) using a step-by-step method.
https://cybergeeks.tech/analyzing-apt19-malware-using-a-step-by-step-method/
https://cybergeeks.tech/analyzing-apt19-malware-using-a-step-by-step-method/
■□□□□ #DataLeak: Japanese 🇯🇵 game developer Koei Tecmo discloses data breach after hacker leaks stolen data.
https://www.bleepingcomputer.com/news/security/koei-tecmo-discloses-data-breach-after-hacker-leaks-stolen-data/ #Japan
https://www.bleepingcomputer.com/news/security/koei-tecmo-discloses-data-breach-after-hacker-leaks-stolen-data/ #Japan
BleepingComputer
Koei Tecmo discloses data breach after hacker leaks stolen data
Japanese game developer Koei Tecmo has disclosed a data breach and taken their European and American websites offline after stolen data was posted to a hacker forum.
■■■□□ SolarWinds has released an updated advisory for the additional SuperNova malware discovered to have been distributed through the company's network management platform.
https://www.bleepingcomputer.com/news/security/solarwinds-releases-updated-advisory-for-new-supernova-malware/
https://www.bleepingcomputer.com/news/security/solarwinds-releases-updated-advisory-for-new-supernova-malware/
BleepingComputer
SolarWinds releases updated advisory for new SUPERNOVA malware
SolarWinds has released an updated advisory for the additional SuperNova malware discovered to have been distributed through the company's network management platform.
■□□□□ 😂 GoDaddy apologized for insensitive phishing email sent to its employees offering a fake bonus.