■■■□□ #CyberAttack | Australia 🇦🇺

A cyber attack has hit the Australian Channel Nine’s live broadcasts causing the disruption of its operations. The broadcaster was unable to air its Sunday morning news program, which runs from 7:00 am to 1:00 pm from Sidney. 

https://hackademicus.nl/hackers-disrupted-live-broadcasts-at-channel-nine-is-it-a-russian-retaliation/

■■■■□ A critical flaw in the official Facebook for WordPress plugin could be abused exploited for remote code execution attacks.

https://securityaffairs.co/wordpress/116063/social-networks/facebook-wordpress-plugin-attacks.html

■■■■□ Intigriti — XSS Challenge 0321
XSS with CSRF Bypass

https://fh4ntke.medium.com/intigriti-xss-challenge-0321-472ae0a48254

■□□□□ ⚠️ Actor selling data allegedly of multiple organisations spread across Arabian peninsular / GCC incl. UAE 🇦🇪, KSA 🇸🇦, Qatar 🇶🇦, Kuwait 🇰🇼.

We requested for a sample and found the data to be inconsistent; in one instance the mail did not exist. Apparently another fraudster.

https://raidforums.com/Thread-SELLING-GCC-Countries-Big-Company-Base-UAE-Saudi-Arabia-Qatar-Kuveyt

■■■■■ php hacked viz. a supply chain attack.

On 28th March, 2021 two malicious commits were pushed to the php-src repo from the names of Rasmus Lerdorf and myself. We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account).

https://news-web.php.net/php.internals/113838

■■□□□ Solution for YesWeHack’s #8 DOJO Challenge.

https://holme-sec.medium.com/solution-for-yeswehacks-8-dojo-challenge-c1044d1ab586

■■□□□ Session monitoring scripts prompt dozens of privacy lawsuits against Big Biz, mainly in California and Florida.

https://go.theregister.com/feed/www.theregister.com/2021/03/30/intel_wiretapping_data/

● Even ckure.xyz has 1 page under video surveillance.

PortScan test video log.

If you are in someone else's property (domain), you abide by its rules of surveillance. As only public information about user is collected.

■■□□□ SolarWinds: SolarWinds Hackers Accessed DHS Chief's Email as several high-level government accounts were also breached in the attack.

Russia 🇷🇺 / United States 🇺🇸

■■□□□ CVE-2021-25160: A remote arbitrary file modification vulnerability exists in some Aruba Instant Access Point (IAP) products.

https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-25160

■■■■■ 8.2 TB #DataLeak from India 🇮🇳.

Popular Mobile payments service MobiKwik on Monday came under fire after 8.2 terabytes (TB) of data belonging to millions of its users began circulating on the dark web in the aftermath of a major data breach that came to light earlier this month.

https://thehackernews.com/2021/03/mobikwik-suffers-major-breach-kyc-data.html

Statement by Mobikwik:
https://mobile.twitter.com/MobiKwik/status/1367489330902675463

Comment by Troy Hunt:
https://mobile.twitter.com/troyhunt/status/1376656147218800641

● cKure has acquired the alleged data of MobiKwik leak. However, verification has not been made.

■■■■■ ⚠️ Following is the list of C2 servers of MetaSploit or CobaltStrike likely used by hackers to attack.

The list was provided via security researcher Michael.

https://gist.github.com/MichaelKoczwara/3a0037ad46c373bc71a6e22daf69d70e

■■■□□ CobaltStrike hunting list.

https://docs.google.com/spreadsheets/d/1bYvBh6NkNYGstfQWnT5n7cSxdhjSn1mduX8cziWSGrw/edit#gid=766378683

■■□□□ Proper compilation of defences against Cobalt Strike.

》Hunting & detection tools
》Yara & Sigma rules
》Indicators
》Research articles
https://mobile.twitter.com/certbund/status/1376556022131658767

https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence

■■■■■ Spectre bypass in Linux.

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/spectre-bypass-linux-vulnerabilities

■■■■□ 📢 Ubiquiti had disclosed earlier this year that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a “catastrophic” incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication.

https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/