Top News

• Apple Loses Copyright Suit Against Security Startup

"A federal judge Tuesday dismissed Apple's copyright infringement lawsuit against cybersecurity startup Corellium in a case which could have implications for researchers who find software bugs and vulnerabilities."

Link

TLP¹ : Green

• CISA releases a PowerShell-based tool to detect malicious activity in Azure, Microsoft 365

"Cybersecurity and Infrastructure Security Agency (CISA) released a tool for detecting potentially malicious activities in Azure/Microsoft 365 environments."

Link

TLP¹ : Green

• Wasabi cloud storage service knocked offline for hosting malware

"Cloud storage provider Wasabi suffered an outage after a domain used for storage endpoints was suspended for hosting malware."

Link

TLP¹ : Green

Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism

• 21 arrested after allegedly using stolen logins to commit fraud

"UK police also give some food for thought to those on the verge of breaking the law"

Link

TLP¹ : Green

• US Treasury warns of ransomware attacks on COVID-19 vaccine research

"The US Treasury Department’s Financial Crimes Enforcement Network (FinCEN) warns of ransomware attacks on COVID-19 vaccine research organizations."

Link

TLP¹ : Green

• FBI: Pranksters are hijacking smart devices to live-stream swatting incidents

"The FBI said it's working with smart device makers to address the issue."

Link

TLP¹ : Green

• Russia’s SolarWinds Attack

"Recent news articles have all been talking about the massive Russian cyberattack against the United States, but that’s wrong on two accounts. It wasn’t a cyberattack in international relations terms, it was espionage. And the victim wasn’t just the US, it was the entire world. But it was massive, and it is dangerous.."

Link

TLP¹ : Green

Breaches: Data Breaches and Hacks

• Japanese Kawasaki Heavy Industries discloses security breach

"Japanese giant Kawasaki Heavy Industries discovered unauthorized access to a Japanese company server from multiple overseas offices."

Link

TLP¹ : Green

Vulnerabilities: Vulnerability Advisories, Zero-Days,Patches and Exploits

• Microsoft Issued a Fix for Zero-Day Six Months Ago but It Didn’t Work

"Microsoft fixed a zero-day vulnerability in June 2020, but the company did a poor job. Security researchers from Google’s Project Zero showed that attackers could still use the zero-day, despite the patch."

Link

TLP¹ : Green

Incident Response: Infrastructure, Training, SIEM and Incident Handling

• Responder e Prevenir – Ferramentas de Resposta a Incidentes de Segurança

"Quando o tema é Resposta a Incidentes de Segurança, devemos manter um olhar atento sobre as ferramentas necessárias para deteção, triagem, contenção e respostas eficazes. Neste artigo, iremos falar sobre algumas ferramentas e boas práticas para auxiliar a sua organização a tomar a decisão mais adequada em cada fase de investigação."

Link

TLP¹ : Green

• Zero-Day Spear Phishing Attack Targeting Covid-19 Pharmaceuticals—Likely Nation-State Threat Actors

"Today, SlashNext Threat Labs observed a flurry of spear-phishing attacks targeting companies at the forefront of Covid-19 vaccines and therapeutics development. These attacks are active, and as of this writing, there are more than 800 spear phishing domains over 60 days that belong to the same threat actors. There is nothing more critical in the age of Covid-19 than finding a cure, and hostile nation-states who cannot develop their own cure would rather steal it."

Link

TLP¹ : Green

• Homomorphic Encryption: The 'Golden Age' of Cryptography

"The ability to perform complex calculations on encrypted data promises a new level of privacy and data security for companies in the public and private sectors. So when can they get started? "

Link

TLP¹ : Green

Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography

• SEO Spam Links in Nulled Plugins

"It’s not unusual to see website owners running things on a budget. Choosing a safe and reliable hosting company, buying a nice domain name, boosting posts on social media, and ranking on search engines — all this costs a lot of money. At the end of the day, some site owners may even choose to cut expenses by installing pirated (or nulled) software on their websites."

Link

TLP¹ : Green

• Vulmap : Web Vulnerability Scanning & Verification Tools

"Vulmap is a vulnerability scanning tool that can scan for vulnerabilities in Web containers, Web servers, Web middleware, and CMS and other Web programs, and has vulnerability exploitation functions."

Link

TLP¹ : Green

• Burp Suite for Pentester: Burp Sequencer

"Today, in this article we’ll try to overtake the application’s algorithm that helps them to generate a randomized session ID for a specific user and will try to log in inside the application impersonating that user with our predicted session ID."

Link

TLP¹ : Green

¹Traffic Light Protocol (TLP) [1] for information sharing:

• Red:Not for disclosure, restricted to participants only.
• Amber: Limited disclosure, restricted to participants organizations.
• Green: Limited disclosure, restricted to the community.

[1]https://www.first.org/tlp