Introducing a new way of keeping up with the _secpro

Hello!

Welcome to another_secpro!

This time, we're changing up the newsletter a little...

We're splitting the _secpro in two - firstly, thefreenewsletter will stay freebutwe're expanding what is on offer for you all: you'll still getnews and tools, but you'll also get conference information,Packtnew title release information, and other little useful tidbits and trinkets; secondly, thepremiumnewsletter will become a monthly edition that is sent out to all paying subscribers, including: analytical and opinionpieces from the_secprostaff, podcast episodes, templates, expert access, industry-leading advice,offers for events, and any other premium features that we roll out in thenear future. If that appeals to you, click the link below!

Of course, if you only want the free edition, that's cool too. We're going to ensure that our content remains as interestinganduseful for all of you who are sticking with thenewsletter. We might even share some of our premium content here with you from time to time - just as a thank you for sticking with us.

Cheers!
Austin Miller
Editor-in-Chief

Soledad Antelada Toledano is the Security Technical Program Manager at Google. She has previously worked for Berkeley Labs.

Soledad was the first woman in the history of the Cybersecurity department at Berkeley Lab. After specializing in 'penetration testing' for several years, Soledad also develops research and advancement tasks for intrusion detection systems, monitoring of high capacity networks and vision and research exercises on how cybersecurity will evolve in the next 10 years adopting techniques of Artificial Intelligence for intrusion detection and handling of BigData generated by monitoring tools.

Soledad has combined her work at the Berkeley lab in recent years with the responsibility of being the head of security for the ACM / IEEE Supercomputing Conference, the annual supercomputing conference in the United States, protecting and building the network architecture of SCinet, the fastest network in the world.

AquaSec-Hadooken Malware Targets Weblogic Applications: "WebLogic Server is an enterprise-level Java EE application server developed by Oracle, used for building, deploying, and managing large-scale, distributed applications. It’s commonly used in banking, e-commerce, and business-critical systems due to its support for Java technologies, transaction management, and scalability. However, WebLogic is a frequent target for cyberattacks due to vulnerabilities such as deserialization flaws and improper access controls. Misconfigurations, like weak credentials or exposed admin consoles, can lead to remote code execution (RCE), privilege escalation, and data breaches if not properly patched or secured."

Bruce Schneier-Microsoft Is Adding New Cryptography Algorithms:Microsoft is updatingSymCrypt, its core cryptographic library, with new quantum-secure algorithms. Microsoft’s details arehere. From anews article.

Bruce Schneier-Evaluating the Effectiveness of Reward Modeling of Generative AI Systems:New research evaluating the effectiveness of reward modeling during Reinforcement Learning from Human Feedback (RLHF): “SEAL: Systematic Error Analysis for Value ALignment.” The paper introduces quantitative metrics for evaluating the effectiveness of modeling and aligning human values.

Bruce Schneier-New Chrome Zero-Day: "According to Microsoft researchers, North Korean hackers have beenusinga Chromezero-day exploitto steal cryptocurrency."

Bruce Schneier-Australia Threatens to Force Companies to Break Encryption:In 2018, Australia passed the Assistance and Access Act, which—among other things—gave the government the power to force companies to break their own encryption. "The Assistance and Access Act includes key components that outline investigatory powers between government and industry."

Bruce Schneier-YubiKey Side-Channel Attack:There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. It’s acomplicated attack, requiring the victim’s username and password, and physical access to their YubiKey—as well as some technical expertise and equipment.

Dr. Web-Void captures over a million Android TV boxes: "Doctor Web experts have uncovered yet another case of an Android-based TV box infection. The malware, dubbed Android.Vo1d, has infected nearly 1.3 million devices belonging to users in 197 countries. It is a backdoor that puts its components in the system storage area and, when commanded by attackers, is capable of secretly downloading and installing third-party software."

GitLab-Critical Patch Release:GitLab on Wednesday released security updates to address 17 security vulnerabilities, including a critical flaw that allows an attacker to run pipeline jobs as an arbitrary user.The issue, tracked as CVE-2024-6678, carries a CVSS score of 9.9 out of a maximum of 10.0.

Krebs on Security-Bug Left Some Windows PCs Dangerously Unpatched:Microsoft Corp.today released updates to fix at least 79 security vulnerabilities in itsWindowsoperating systems and related software, including multiple flaws that are already showing up in active attacks. Microsoft also corrected a critical bug that has caused someWindows 10PCs to remain dangerously unpatched against actively exploited vulnerabilities for several months this year.

Krebs on Security-Sextortion Scams Now Include Photos of Your Home:An old but persistent email scam known as “sextortion” has a new personalized touch: The missives, which claim that malware has captured webcam footage of recipients pleasuring themselves, now include a photo of the target’s home in a bid to make threats about publishing the videos more frightening and convincing.

Sekoia-A glimpse into the Quad7 operators’ next moves and associated botnets: "The Sekoia TDR team has recently identified new staging servers, leading to the discovery of additional targets, implants, and botnet clusters tied to the Quad7 operators."

No theme this week. Just some things that we've been playing with. Check them out!

ncorbuk/Python-Ransomware- A tutorial kit for making ransomware with Python.

captainGeech42/ransomwatch- A tool for monitoring global malware occurences.

ForbiddenProgrammer/conti-pentester-guide-leak- Leaked pentesting guides for the Conti team - get into the minds of the threat actor!

YJesus/AntiRansom- A toolkit for running anti-ransomware honeypots

BSides Charlotte(14th September): "BSides Charlotte 2024 will be held on September 14th and 15th in Charlotte, NC. Join us for talks, competitions, villages, training, capture the flag, and more! A call for papers, volunteers, and sponsorship opportunities will be posted on our website as preparations for the conference are made. Be sure to join us on Discord or follow on X/Mastodon as well for the most up to date information. Our mission is to serve the information security community in and around Charlotte, NC by primarily holding an annual BSides Charlotte Security Conference which offers learning opportunities through talks, activity villages, and capture-the-flag competitions. From time-to-time BSides Charlotte may put on training opportunities and partner with other organizations to bring value added content to the community."

The Annual Cyber Security in Financial Services Summit 2024(16th September): "City & Financial Global is pleased to announce the 10th edition of its annual Cyber Security in Financial Services Summit event on 16th September 2024. The purpose of the Summit is to look at the cyber risks, wherever they originate, which pose a threat to London and the financial services community and will provide a forum for Government bodies, regulators, law enforcers, and financial institutions to examine the latest threats and how to combat them. It will also look at the Government’s cyber strategy, the current and future priorities of the National Cyber Security Centre, the NCA’s response to the evolving nature of the cyber threat, and the Bank of England’s stance on cyber resilience in the financial sector."

Supply Chain Insight Summit 2024(16th September): "By bringing together industry leaders and innovators, the GDS Supply Chain Summit will explore the latest trends, technologies, and strategies shaping global supply chains. During this period of continuous change where resilience, efficiency, and sustainability are paramount, this summit will highlight key challenges and opportunities spanning the entire supply chain spectrum. From procurement and manufacturing to logistics, distribution, and customer engagement, we will discuss the importance of building strong supply chains for future success. Why attend? Connect with like-minded senior leaders for a curated agenda, focused on tackling your current business critical challenges and driving the industry forward."

Mandiant Worldwide Information Security Exchange (mWISE) 2024(18th September): "mWISE 2024 (Mandiant Worldwide Information Security Exchange) is heading to Denver, Colorado from September 18–19. A new, more central location but our goal is the same: gather leading security experts to share knowledge and intel, and to address the greatest cyber threats and challenges our industry faces. mWISE is open to the security community at large — bringing industry, government, and academia together to discuss and understand today’s landscape and identify the threats on the horizon."

The AI Tsunami: Is Your API Security Ready for the Perfect Storm?(19th September): "Is Your API Security Ready for the Perfect Storm? provided a comprehensive overview of the emerging threats in API security driven by AI advancements. Experts discussed proactive measures and best practices to safeguard APIs against sophisticated attacks. The event was well-organized, featuring insightful presentations and interactive Q&A sessions. Attendees gained valuable knowledge on fortifying their API security strategies in the face of evolving AI-driven threats."

AI in Cybersecurity: A Double-Edged Sword(20th September):"AI in Cybersecurity: A Double-Edged Sword" explores the dual nature of artificial intelligence in the realm of cybersecurity. The event highlights how AI can enhance security measures through advanced threat detection and automated responses, while also acknowledging the risks of AI being exploited by cybercriminals. Featuring expert panels and discussions, the event aims to provide a comprehensive understanding of AI's impact on modern cybersecurity practices.