By Waqas
Another day, another Bluetooth vulnerability impacting billions of devices worldwide!
This is a post from HackRead.com Read the original post: Bluetooth Vulnerability Enables Keystroke Injection on Android, Linux, macOS, iOS

Keystroke injection is a method wherein malicious commands or keystrokes are remotely injected into a system to compromise or manipulate its functionality, often exploited for unauthorized access or control.

A critical vulnerability in Bluetooth allows attackers to take control of Android, Linux, macOS, and iOS devices, including devices in Lockdown Mode. This vulnerability is tracked as **CVE-2023-45866** and disclosed by security researcher Marc Newlin. 

It enables attackers to connect to vulnerable devices without user confirmation and inject keystrokes, potentially allowing them to install malicious apps, run arbitrary commands, and perform other unauthorized actions (except those requiring password/biometric authentication). The software vendors were notified about the flaw in August 2023.

This vulnerability was first identified in 2016 in non-Bluetooth wireless mice and keyboards. Back then, it was assumed that Bluetooth was secure and promoted as a better alternative to vulnerable custom protocols.

In 2023, a challenge forced Newlin to focus on Apple’s Magic Keyboard due to its **reliance on Bluetooth** and Apple’s security reputation. Initial research revealed limited information about Bluetooth, macOS, and iOS, necessitating extensive learning. 

Later, unauthenticated Bluetooth keystroke injection vulnerabilities in macOS and iOS were discovered, which were exploitable even when **Lockdown Mode** was enabled. Similar flaws were identified in Linux and Android, suggesting a broader issue beyond individual implementations. The Bluetooth HID specification analysis revealed a combination of protocol design and implementation bugs.

Newlin explained in his **post on GitHub** that multiple Bluetooth stacks had authentication bypass vulnerabilities. The attack exploits an “unauthenticated pairing mechanism” defined within the Bluetooth specification, tricking the target device into accepting a fake keyboard.

This deception allows an attacker in close proximity to connect and inject keystrokes, potentially enabling them to install apps and execute arbitrary commands. It is worth noting that unpatched devices are vulnerable under specific conditions, such as:

*   Android: Bluetooth must be enabled.
*   Linux/BlueZ: Bluetooth must be discoverable/connectable.
*   iOS/macOS: Bluetooth must be enabled, and a Magic Keyboard must be paired with the device.

These vulnerabilities can be exploited with a standard Bluetooth adapter on a Linux computer. Notably, some vulnerabilities predate “**MouseJack**“, affecting Android devices as far back as version 4.2.2 (released in 2012). 

In a comment to Hackread.com, Ken Dunham, Director of Cyber Threat at Qualys said “The two new Bluetooth vulnerabilities that exist for Android, Linux, MacOS, and iOS enable unauthorized attackers to perform an “unauthenticated pairing”, then possibly enable execution of code and to run arbitrary commands.”

“Bluetooth attacks are limited to close physical proximity. As a workaround, users of vulnerable systems can limit their attack surface and risk until patched by disabling Bluetooth,” Dunham advised.

While a fix for the Linux vulnerability existed since 2020 (**CVE-2020-0556**), it was surprisingly left disabled by default. Despite announcements by major Linux distributions, only ChromeOS is known to have implemented the fix. The latest BlueZ patch for CVE-2023-45866 finally enables this crucial fix by default.

It is a serious vulnerability impacting a vast array of devices, exposing potential security risks inherent to Bluetooth technology. However, according to Google, “fixes for these issues that affect Android 11 through 14 are available to impacted OEMs. All currently-supported Pixel devices will receive this fix via December OTA updates.”

1.  **BlueRepli attack bypasses Bluetooth authentication on Android**
2.  **BleedingTooth Bluetooth vulnerability allows RCE in Linux devices**
3.  **Update your devices: New Bluetooth flaw lets attackers monitor traffic**
4.  **BlueBorne Bluetooth Flaw Affects Millions of Smartphones, IoT and PCs**
5.  **Hackers can crash Google’s Nest Dropcams by exploiting Bluetooth flaws**

Bluetooth Vulnerability Enables Keystroke Injection on Android, Linux, macOS, iOS

By Deeba Ahmed
Stop installing pirated and cracked software to ensure the protection of your devices against Proxy Trojan and other new malware threats.
This is a post from HackRead.com Read the original post: Cracked macOS Software Laced with New Trojan Proxy Malware

Kaspersky recently uncovered the most recent Trojan Proxy malware campaign, revealing that the earliest submission of the payload on VirusTotal can be traced back to April 28, 2023.

Cybercriminals have typically been keen on **exploiting macOS** applications to target Mac users, and this time, they might just have hit the jackpot. According to the latest research from cybersecurity researchers at Kaspersky, threat actors are deploying a novel Trojan Proxy malware in cracked applications, distributed via unauthorized websites. The plan behind this operation is to compromise Mac devices.

Researchers observed that the campaign’s earliest payload submission on **VirusTotal** was on April 28, 2023. Further probing revealed that the malware is disguised within popular copyrighted macOS software available on warez sites.

For your information, Warez sites are websites that offer copyrighted digital content, such as software, movies, music, ebooks, and games, for free or at a significantly lower price than the original product.

The malware allows attackers to build a proxy server network to commit crimes or make profits. When installed, this malware converts computers into anonymous traffic-forwarding terminals, allowing malware operators to perform malicious activities, such as phishing, hacking, or conducting illegal transactions. 

“Attackers can use this type of malware to gain money by building a proxy server network or to perform criminal acts on behalf of the victim: to launch attacks on websites, companies and individuals, buy guns, drugs, and other illicit goods” researchers explained in a **blog post**.

Infected applications appear as **legitimate cracked software**, distributed as .PKG installers rather than the usual disk images. A post-installation script replaces two system files with malicious versions from the app resources and grants them administration permissions. A fake Google configuration file (p.plist) automatically starts the WindowServer malware file as a system process. 

This binary file was uploaded on VirusTotal on April 28 but wasn’t recognized as malware then. The malware utilizes DNS-over-HTTPS (DoH) to get the C2 server IP address and connects via WebSockets, receiving commands for the various malicious activities the Trojan can perform and sending information. 

However, during their research, investigators didn’t receive a server response beyond the 0x38 command and noted that the client supported TCP and UDP connections. Earlier versions relied on traditional DNS requests instead of DoH for C&C server acquisition.

It is worth noting that selling access to these proxies is a highly profitable business, encompassing massive botnets. Kaspersky researchers noted that Mac devices aren’t immune to this deep-rooted threat, which is why this campaign works. 

Attackers are exploiting the popularity of cracked versions of copyrighted software, specifically commercial software/programs, as users prefer to avoid paying for premium software.

Around 35 instances of popular image editing, data recovery, video compression and editing, and network scanning tools-related apps laced with Trojan Proxy were identified by Kaspersky.

Beyond **macOS**, researchers have identified Android and Windows versions connecting to the same C&C server. This means a larger distribution network for cracked software laced with Trojan Proxy malware could be at work.

Menlo Security’s chief security architect, **Lionel Litty**, shared with Hackread.com that using DoH and WebSocket indicates that threat actors are focusing more on evading network-based detection mechanisms.

“The use of DoH and WebSocket shows that more sophisticated bad actors are focused on evading network-based detection mechanisms an enterprise may have deployed,” Litty explained.

“DoH will often mean the malware can evade detection from products that look at DNS traffic for IOCs since DNS traffic is now wrapped within HTTPS connections that may not be inspected or that are inspected by solutions that do not understand DoH semantics,” Little added.

“Likewise, network devices that inspect HTTPS traffic may not understand WebSocket semantics and may fail to run signature-based detections that target the payloads of C&C traffic used by the malware” Litty warned.

****_RELATED ARTICLES_****

1.  **macOS Ventura Background Task Flaws Exploited for Malware**
2.  **LockBit Ransomware Expands Attack Spectrum to Mac Devices**
3.  **MacStealer: A New Malware Targeting macOS Catalina Devices**
4.  **Windows, Linux, macOS Users Targeted by Chinese Iron Tiger APT**
5.  **New Malware Turns Windows and macOS Devices into Proxy Nodes**

Cracked macOS Software Laced with New Trojan Proxy Malware

By Waqas
The documents were leaked on December 6th, 2023, on Breach Forums.
This is a post from HackRead.com Read the original post: Hacker IntelBroker Leaks Alleged Sensitive US DoD Documents

IntelBroker claims that the documents include information about communications between the Pentagon and the US Army’s CIO/G-6.

The infamous hacker, known by the online handle of ‘IntelBroker,’ alleges having acquired sensitive internal documents from the United States Department of Defense (US DoD). According to IntelBroker, the leaked data includes PDFs and XLSX files, potentially containing communications between the Pentagon and the Army’s CIO/G-6.

For readers’ information, the Chief Information Officer (CIO) is responsible for addressing IT and cybersecurity-related issues. On the other hand, G-6 refers to the Deputy Chief of Staff (DCS), who reports to the Chief of Staff of the Army. The G-6 is primarily involved in planning, strategy, network architecture, and related matters.

Some of the leaked documents are labeled FOUO (PDF) meaning ”For Official Use Only.” It is a security designation used by some governments, including the United States, to identify unclassified information that is sensitive and should be protected from unauthorized disclosure.

As seen by Hackread.com, the leaked documents are accessible for download on the Breach Forums. The same forum where, last month, another threat actor leaked a scraped LinkedIn database with 35 million user data. A couple of weeks ago, the Breach Forums witnessed the leak of a database containing the personal data of thousands of employees of the Idaho National Lab.

Regarding the current breach, screenshots provided by the hacker as samples reveal dates ranging from 2017 to 2021. Among the samples is a document titled “Task 10 – EIEMA (Enterprise Information Environment Mission Area) Process Improvement Projects and Tasks, dated 25th March 2021.”

Another document, labeled “Enterprise Service Division SAIS-NSE,” includes a presentation containing personal and contact details of several civilian government officials and contractors. The information disclosed comprises their full names along with contact numbers for office, cellular, and home.

Another FOUO document, titled “MDEP MXCL RVT Brief to the TT PEG – Pentagon,” provides a summary discussing requirements for Long Haul Communication within the US Army.

Hackread.com did not conduct the usual in-depth analysis; therefore, the authenticity of the data remains uncertain. However, considering the hacker’s track record with previous leaks, it is reasonable to presume that the documents could be legitimate.

Additionally, according to the online malware samples repository vx-underground, “The Five Eyes (FVEY) are actively hunting him down,” signaling the severity and gravity of the situation and suggesting potential damage caused by IntelBroker to the targeted organizations.

**Who is IntelBroker Exactly?**

IntelBroker is an infamous threat actor/hacker known for high-profile hacks against the US government, businesses, and delivery and logistics firms worldwide. Their previous cyber attacks include breaching the US-based online grocery delivery platform Weee! and leaking the personal details of over 1.1 million customers online.

In the past month, IntelBroker claimed to have breached the US-based multinational corporation General Electric (GE) and offered data, including access related to the US government’s defense R&D agency DARPA, for sale at just $500.

****Impact of Such FOUO Leaks****

The severity of the impact of a FOUO leak will depend on several factors, including the nature of the information that was leaked, the extent to which it was disseminated, and the response of the government and military. However, it is clear that the potential consequences of such leaks are significant and should not be taken lightly. Here are some potential consequences:

**1\. Damage to national security:**

*   Leaked FOUO documents could contain sensitive information about military strategies, troop deployments, weapons systems, or intelligence operations. This information could be used by adversaries to gain an advantage in a conflict or to plan attacks against the United States or its allies.

**2\. Embarrassment and political fallout:**

*   Leaked FOUO documents could reveal embarrassing or damaging information about the government or military. This could lead to public outrage, a loss of confidence in the government, and political pressure to change policies.

**3\. Harm to individuals:**

*   Leaked FOUO documents could contain personal information about military personnel or their families. This information could be used to target individuals for harassment, threats, or even violence.

**4\. Financial loss:**

*   Leaked FOUO documents could reveal information about sensitive government contracts or trade secrets. This could lead to financial losses for the government or private companies.

**5\. Loss of trust in the military:**

*   Repeated leaks of FOUO documents could erode public trust in the military and make it more difficult for the government to recruit and retain personnel.

****_RELATED ARTICLES_****

1.  **Military Satellite Access Sold on Russian Hacker Forum**
2.  **Quest Diagnostics data breach affects 12 million customers**
3.  **Top 10 vulnerable airports where your device can be hacked**
4.  **Top US aerospace services provider breach, loses 1.5 TB of data**
5.  **America’s largest diagnostics service LabCorp suffers data breach**

Hacker IntelBroker Leaks Alleged Sensitive US DoD Documents

By Deeba Ahmed
Discovered by the cybersecurity researchers at Group-IB; the new Linux RAT, dubbed Krasue, is targeting telecom firms in Thailand.
This is a post from HackRead.com Read the original post: New XorDdos-Linked Linux RAT Krasue Targeting Telecom Firms

The Krasue Linux RAT is quite sophisticated, and equipped with the capability to evade detection through Rootkit and RTSP communication.

Group-IB, a leading cybersecurity company, has uncovered a sophisticated new Linux RAT (Remote Access Trojan) they have dubbed “Krasue.” The malware is actively targeting organizations, mainly telecommunication firms, in Thailand and has been active since 2021.

GroupIB’s Threat Intelligence unit researchers found that Krause operates by gaining access to the targeted network and uses its rootkit capabilities to maintain persistence and ensure stealthy access.

The researchers are still investigating the initial infection vector and the full scale of the RAT’s usage. However, they believe that potential methods include vulnerability exploitation, deceptive downloads, and credential brute force attacks.

A notable feature of Krause is that it uses the Real Time Streaming Protocol (RTSP) for communication with its C2 server. This is an unusual tactic and is most likely used to evade detection by security software.

Profile of Krasue RAT (Credit: Group-IB)

Report author Sharmine Low, Group-IB’s Malware Analyst, wrote that Krause is named after a nocturnal spirit mentioned in Southeast Asian folklore. It lets cybercriminals remotely access and control compromised systems and remain undetected for a significant period.

Krasue uses multiple embedded rootkits to ensure compatibility with different Linux kernel versions. Interestingly, as with several other Linux rootkits, Krasue’s rootkit draws its functionalities from publicly available sources, specifically incorporating code from three open-source Linux Kernel Module rootkits.

This embedded rootkit can hook key system calls like kill(), network-related functions, and file listing operations to effectively mask its presence and evade detection. Researchers believe that this RAT was created by the same person who developed the XorDdos Linux Trojan or someone who has access to its source code.

Benyatip Hongto, Group-IB’s Business Development Manager in Thailand, highlighted the company’s commitment and proactive efforts to fighting cybercrime, including the planned opening of a Digital Crime Resistance Center in Thailand and their partnership with leading cybersecurity distributor nForce.

Upon discovering Krause, Group-IB researchers promptly notified their Threat Intelligence customers and published a report with YARA rules, which was shared with Thai authorities including ThaiCERT and TTC-CERT.

This revelation underscores the ever-looming threat of cyber risks and the need for strong cybersecurity measures. Organizations must be aware of threats like Krause and implement suitable security measures like strict access control, regular patching, and advanced threat detection solutions.

****_RELATED ARTICLES_****

1.  **New Cylance Ransomware Targets Linux and Windows**
2.  **Patched OpenSSH Exploited for IoT, Linux Cryptomining**
3.  **Free Download Manager Site Pushed Linux Password Stealer**
4.  **Kinsing Crypto Malware Hits Linux Systems via Apache Flaw**
5.  **Hamas Targeting Israelis with New BiBi-Linux Wiper Malware**

New XorDdos-Linked Linux RAT Krasue Targeting Telecom Firms

By Waqas
Self-Hack: Strengthen Your Security Before External Threats Strike!
This is a post from HackRead.com Read the original post: Cybersecurity Firm Hacks Itself, Finds DNS Flaw Leak AWS Credentials

Intruder.io, a London, England-based cybersecurity firm, conducted a self-hack using a DNS rebinding attack, enabling them to extract low-privileged AWS credentials.

Cybersecurity firm Intruder has published blog posts explaining how they got hacked by successfully exploiting a DNS rebinding vulnerability that allowed them to extract low-privileged AWS (Amazon Web Services) credentials. They discovered a DNS rebinding vulnerability in their platform after hacking themselves.

Although rare, DNS rebinding exploitation is a persistent threat. In 2018, Hackread.com **reported** cybersecurity firm Armis’ research, which revealed that over half a billion (496 million) IoT devices were found vulnerable to DNS rebinding, most used by enterprises.

Intruder’s penetration tester Daniel Thatcher **noted** that while the vulnerability’s impact was limited due to the prevailing security measures, the exploit indicates the feasibility of DNS rebinding attacks in time-constrained scenarios like penetration testing.

Further probing helped him **achieve** reliable split-second DNS rebinding in Chrome, Edge, and Safari browsers, which was surprising, specifically when IPv6 was available.

The vulnerability was discovered in Intruder’s screenshot workers, which capture snapshots of customer websites. Since these follow HTTP redirects before taking screenshots and lack restrictions on accessing the internal EC2 metadata service, it became possible to expose AWS credentials for available roles.

Leveraging this vulnerability, a public web server was set up to redirect to the EC2 metadata service endpoint. When a worker took a screenshot of this server, it captured the list of available roles, revealing sensitive information. Through further modification, Thatcher obtained actual credentials for a specific role.

Thatcher notified the **DevOps team** and tried to fix the issue by implementing network-level restrictions to prevent the “screenshotting tool from accessing the metadata service”, the blog read.

Daniel also switched workers to using **IMDSv2**, thinking this would prevent the attack by making it compulsory to include a token in a header in all requests to the metadata service by making a PUT request to a specific endpoint on the metadata service.

With HTTP redirects, such as those Intruder’s screenshot workers were following, it isn’t possible to set headers, make PUT requests or view their responses. That’s when it occurred to him that DNS rebinding could potentially enable them to bypass restrictions on major browsers and private network requests.

In browsers, traditional DNS rebinding allows attackers to access internal network services by tricking victims into loading a malicious website. However, given that modern web applications are driving headless browsers for their functionality, it’s become a useful tool for attacking web apps by returning both public (attacker-controlled) and target server IP addresses.

The attack relies on the browser first communicating with the public server and loading the attacker’s page. The attacker’s server then blocks traffic, forcing the browser to fall back to the target server, allowing JavaScript on the attacker’s page to send requests to the target server with the same origin.

The extracted credentials had minimal permissions and limited potential damage, but service disruption was possible. They could prevent further digging into AWS and possible harm by limiting access to other HTTP services.

Thatcher concluded that multiple security layers could minimise the attack surface even if the vulnerability was exploited. The screenshot worker vulnerability was patched with IMDSv2 implementation.

**Strengthen Your Security Before External Threats Strike**

Conducting ethical hacking or penetration testing, wherein you intentionally hack into your own network to identify security vulnerabilities, is a proactive and strategic approach to bolstering cybersecurity defences.

By simulating real-world attack scenarios, organizations can gain valuable insights into potential weaknesses that could be exploited by malicious actors. This self-imposed testing allows for the discovery of vulnerabilities **before they can be maliciously leveraged** by external threats.

Understanding these weaknesses enables organizations to implement strong security measures, apply necessary patches, and strengthen their defences, ultimately reducing the risk of unauthorized access, data breaches, or other cyber threats.

Simply put, hacking oneself provides an opportunity to address vulnerabilities beforehand, ensuring a more secure network environment before adversaries have a chance to exploit identified vulnerabilities.

****_RELATED ARTICLES_****

1.  **Cybersecurity firm exposes 5 billion data breach records**
2.  **Chinese Hackers Keep Targeting Group-IB Cybersecurity Firm**
3.  **WH National Cybersecurity Strategy: Software Firms Liable for Breaches**
4.  **Cybersecurity firm Stormshield breach; customer data, source code stolen**
5.  **LockBit 3.0 Posts Dubious Claims of Breaching Darktrace Cybersecurity Firm**

Cybersecurity Firm Hacks Itself, Finds DNS Flaw Leak AWS Credentials

By Owais Sultan
Reflectiz, a cloud-based platform that helps organizations manage and mitigate web application security risks
This is a post from HackRead.com Read the original post: Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz Elevates Security with AI-Powered Smart Alerting: Enhanced Threat Detection with Cross-Validation.

Ramat Gan, Israel, December 7th, 2023, Cyberwire – Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new AI-powered capability enhancing its Smart Alerting system.

The new AI-powered insights enhance the Reflectiz Smart Alerting system by integrating AI LLM technology on top of its traditional alerting tool for cross-checking the validity of the alert with Reflectiz’s extensive databases.

It then recommends the next steps, indicating whether it’s safe to approve or requires further investigation while providing clear justification for that decision. The system immediately raises a flag if any component is identified as uncommon, malicious, or vulnerable. This empowers our customers to rapidly detect and respond to malicious activities, thwarting the latest advancements in cyberattacks.

Statistically, new applications and new domains are the most common alerts, and the AI engine recommendations can save 25%-30% of the time managing the new alerts. 

****Quick Justifications for PCI DSS Audits****

PCI DSS requires the detection, approval, and justification of each script loaded on the application page. If you choose to approve an application, the AI engine can automatically generate the justification for you. This rationale will then be included in the PCI report, as usual, leading to a reduction in the time spent on PCI.

Reflectiz now offers a free PCI Dashboard for 30 days, helping clients meet the new PCI DSS v4 requirements and bolster their web security.

Idan Cohen, Reflectiz co-founder and CEO, states, “Today, Reflectiz takes a significant step forward by integrating LLM into our alert system. This enhances our platform, enabling clear justifications within seconds and allowing security teams to respond swiftly to prevent security and privacy breaches.”

****About Reflectiz:****

Reflectiz is a leading cybersecurity company specializing in next-generation web threat management. Years of research by cybersecurity experts have led to the development of our cutting-edge platform, which is trusted by global companies to keep their websites secure.

Recognized by Gartner for innovation in website security, Reflectiz is dedicated to combating today’s web threats and making the Internet a safer place for businesses and customers alike. Book a personalized demo **he****r****e**.

****Contact****

*   **Reflectiz**
*   **Daniel Sharabi**
*   **Marketing Director**
*   **\[email protected\]**

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

By Deeba Ahmed
100,000+ Reasons to Rethink Vulnerability Management.
This is a post from HackRead.com Read the original post: Flashpoint Uncovers 100,000+ Hidden Vulnerabilities, Including Zero-Days

Flashpoint’s latest report redefines the Vulnerability Management system and challenges the current standards set by CVE.

Reaching a noteworthy milestone, the cybersecurity firm Flashpoint has announced that its VulnDB (Vulnerability Database) now documents over 100,000 vulnerabilities. Notably, these vulnerabilities were not covered by the Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD). This includes zero-day vulnerabilities, containing those that were previously unknown, unannounced, and undocumented.

Vulnerability management programs typically rely on CVE data. However, this approach leaves organizations vulnerable, overlooking 30% of known threats. Flashpoint’s VulnDB database addresses this gap by including over 100,000 non-CVE vulnerabilities and comprehensively analyzing the threat landscape.

Flashpoint’s Brian Martin confirmed in the company’s official announcement that 101,000 non-CVE or hidden vulnerabilities, including zero-days and recently exploited flaws, have become part of their database. These vulnerabilities affect major vendors and specialized industries, posing significant risks.

“Our team goes above and beyond to provide our customers with the most comprehensive, actionable, and timely source of vulnerability intelligence. This includes our team adding over 90 new vulnerabilities on average daily while also updating roughly many hundreds of existing records,” Flashpoint researchers noted.

There are several restrictions with CVE data. For instance, CVE misses at least 30% of known vulnerabilities, and assigning CVE IDs is a lengthy process that may take up to a month to complete, leaving users/businesses vulnerable to zero-day attacks. Most importantly, CVE prioritizes vulnerabilities that can impact major vendors and neglects niche industries with distinct needs.

VulnDB, on the other hand, offers standardized information on CVE and non-CVE vulnerabilities. So it becomes easier for organizations to address them. Flashpoint collects data from thousands of sources, making VulnDB the most useful vulnerability database.

Over half of the non-CVE vulnerabilities are rated high to critical severity using CVSS v3. VulnDB covers a broader range of vendors, including Microsoft, Google, and Apple. The company tracks zero days and issues exploited in the wild, which helps it offer critical threat intelligence.

“Organizations need to remember that vulnerabilities discovered in the wild are sometimes first disclosed without a CVE ID. Zero-day vulnerabilities and other high-profile issues, such as the MOVEit vulnerability, also tend to follow this trend,” the blog read.

The report noted that around 60.4% of non-CVE vulnerabilities are remotely exploitable, making them attractive targets for attackers. Flashpoint’s VulnDB can help security teams identify/prioritize more vulnerabilities and focus on easy wins. They can target vulnerabilities with readily available exploit information and remediation steps.

In addition, they can improve patch effectiveness by prioritizing vulnerabilities based on their actual impact and exploitability. Furthermore, VulnDB caters to the specific needs of industries such as manufacturing and medical devices, addressing issues often missed by CVE.

According to researchers, VulnDB provides quicker access to newly disclosed vulnerabilities, enabling proactive mitigation strategies and integrates well with existing GRC, ITIL, CMDB, and SIEM products, streamlining workflows.

****_RELATED ARTICLES_****

1.  **The Most Common API Vulnerabilities**
2.  **Unveiling Vulnerabilities: Penetration Testing Services**
3.  **CVSS v4.0 Out with New Supplemental Metrics, OT/ICS/IoT Support**

Flashpoint Uncovers 100,000+ Hidden Vulnerabilities, Including Zero-Days

By Waqas
Kali Linux Unveils Feature Rich 2023.4 Release with Cloud ARM64, Vagrant Hyper-V, Raspberry Pi 5, and More!
This is a post from HackRead.com Read the original post: Kali Linux 2023.4 is Out: Cloud ARM64, Hyper-V, Pi 5, & More!

Attention Kali Linux enthusiasts! Your holiday treat has arrived with the release of Kali Linux 2023.4, packed with a plethora of new features. Download now and elevate your Kali experience!

As 2023 draws to a close, **Kali Linux** enthusiasts are in for a treat with the latest release, Kali Linux 2023.4. Packed with innovative features and improvements, this update focuses on expanding platform support and refining existing capabilities.

****Cloud ARM64 Marketplaces Integration****

One standout feature is the addition of ARM64 support on Amazon AWS and Microsoft Azure marketplaces. This enhancement not only provides users with more flexibility in instance options but also promises an improved price-to-performance ratio. While Kali Linux has consistently prioritized ARM architecture, the team acknowledges ongoing efforts to ensure broader compatibility.

****Vagrant Hyper-V Support for Seamless Virtualization****

Kali Linux’s Vagrant offering receives a significant upgrade with added support for Hyper-V environments. Targeted at users familiar with Vagrant’s command-line interface, this feature allows for seamless management of virtual machines.

Users can customize their Kali environments by defining various parameters such as operating system, CPU, RAM, storage, networking, and additional scripts or commands for installation and configuration.

****Raspberry Pi 5 Compatibility****

Exciting news for Raspberry Pi enthusiasts as Kali Linux introduces dedicated support for the latest Raspberry Pi 5. Users can either download the pre-built image directly or automate the process using Raspberry Pi Imager. While the image is currently in a BETA state and limited to ARM64 architecture, the Kali team expresses optimism about additional flavours in the future.

****Embracing GNOME 45 for Enhanced User Experience****

Kali Linux now integrates with the latest GNOME 45, bringing aesthetic improvements and functionality enhancements. Users opting for GNOME as their desktop environment can enjoy features like full-height sidebars, faster search in the Nautilus file manager, and updated themes for various components. Despite some pending updates for Nautilus, the overall user experience is expected to be more refined.

****Revamped Internal Infrastructure with Mirrorbits****

Undergoing significant infrastructure changes, Kali Linux bids farewell to MirrorBrain and welcomes Mirrorbits as the new “mirror redirector.” This essential service, responsible for directing requests to the nearest mirror, has undergone a successful migration.

Leveraging modern technologies like Go and Redis, Mirrorbits proves to be a robust solution, initially developed by Ludovic Fauvet for the VLC media player. The transition, though not without challenges, reflects Kali’s commitment to improving user-facing services.

****Introduction of New Tools and Packages****

True to Kali tradition, the 2023.4 release introduces a host of new tools and updates to existing ones. Notable additions include:

*   **cabby:** TAXII client implementation
*   **h8mail:** Email OSINT and Password breach hunting tool
*   **ReconSpider:** Most Advanced Open Source Intelligence (OSINT) Framework
*   **SPIRE:** SPIFFE Runtime Environment for establishing trust between software systems

Additionally, various packages have been updated, and the Kali kernel has been bumped to version 6.5.0.

****Continued Kali NetHunter and ARM Updates****

The Kali NetHunter community remains active, showcasing impressive feats such as Doom running on Kali NetHunter TicWatch Pro 3 and speedy installations on Android 14. While ARM updates are relatively minimal, the inclusion of Raspberry Pi 5 support stands out as a significant addition.

As Kali Linux enthusiasts eagerly await the new release, the team encourages users to explore fresh images or update existing installations using the provided instructions. The live voice chat session with the Kali team on Discord offers an opportunity for direct interaction and Q&A.

To update your existing Kali Linux to Kali Linux 2023.4, use the following commands:

    ┌──(kali㉿kali)-[~]
    └─$ echo "deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware" | sudo tee /etc/apt/sources.list
    [...]
    
    ┌──(kali㉿kali)-[~]
    └─$ sudo apt update && sudo apt -y full-upgrade
    [...]
    
    ┌──(kali㉿kali)-[~]
    └─$ cp -vrbi /etc/skel/. ~/
    [...]
    
    ┌──(kali㉿kali)-[~]
    └─$ [ -f /var/run/reboot-required ] && sudo reboot -f

Whether you’re a seasoned Kali user or exploring it for the first time, the 2023.4 release promises an enhanced experience with its diverse features and community-driven ethos.

To stay updated on the latest developments, bug fixes, and announcements, users are encouraged to engage with the Kali Linux community and actively contribute to its growth. For more information and to download Kali Linux 2023.4, visit the official **Kali Linux website**.

****_RELATED ARTICLES_****

1.  **What is an OSINT Tool – Best OSINT Tools 2023**
2.  **Download NSA’s reverse engineering tool GHIDRA**
3.  **Top 7 Most Popular and Best Cyber Forensics Tools**
4.  **AttackSurfaceMapper: New automated penetration testing tool**
5.  **Why Cybersecurity Business Needs a Real-Time Collaboration Tool**

Kali Linux 2023.4 is Out: Cloud ARM64, Hyper-V, Pi 5, & More!

By Deeba Ahmed
CISA Warns of Critical Adobe ColdFusion Vulnerability Actively Exploited by Threat Actors.
This is a post from HackRead.com Read the original post: Adobe ColdFusion Flaw Used by Hackers to Access US Govt Servers

Authorities urge Adobe ColdFusion customers to promptly install patches and update their systems.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a Cybersecurity Advisory (CSA) alerting organizations to the exploitation of a critical vulnerability in Adobe ColdFusion by unidentified threat actors.

The vulnerability, **CVE-2023-26360**, affects Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier), as well as older ColdFusion installations that Adobe no longer supports.

Exploitation of CVE-2023-26360 allows threat actors to execute arbitrary code on affected systems, posing a significant security risk. The vulnerability was added to CISA’s known exploited vulnerability (KEV) catalogue right after its discovery, and an April 5 deadline was given to agencies to fix the issue. 

Adobe ColdFusion is a widely used software suite for web application development. Hackread has been reporting this vulnerability ever since it was **discovered** in March. We reported in August 2023 that this critical remote code execution (RCE) flaw, which impacts both Windows and macOS platforms, allows attackers to seize control of affected systems, making it a high-severity cybersecurity risk. Adobe **released** security patches to address the following vulnerabilities:

*   APSB23-40
*   APSB23-41
*   APSB23-47

However, FortiGuard Labs observed continued exploitation attempts at that time, indicating that some users had not yet applied the patches.

Now, the same vulnerability has been exploited by unidentified hackers to gain access to two systems within a Federal Civilian Executive Branch (**FCEB**) agency. Reportedly, the FCEB was running outdated versions, including ColdFusion, which made it vulnerable to the exploit. The hackers were able to gain initial access to two public-facing web servers within the agency’s pre-production environment.

At least two public-facing servers within a Federal Civilian Executive Branch (FCEB) agency were **targeted** with this vulnerability between June and July 2023. Here are the details of the attacks:

**June 2:** Initial access, reconnaissance activities (local/domain admin information, network configurations, user details), and deployment of a remote access trojan (**RAT**). Attempts to exfiltrate data, obtain credentials, download data from C2 infrastructure, and change policies were unsuccessful.

**June 26:** Attackers connected through a malicious IP address, exploited the vulnerability, and analysed running processes. They navigated the filesystem, deleted logs, and executed malicious code designed for ColdFusion versions 9 and below (targeting usernames, passwords, and URLs).

The code could enable future attacks and upload additional files from an unknown source. Password decryption was not possible due to the agency’s newer ColdFusion version. Attempts to conceal the web shell also failed.

While the hackers could insert malware and launch a reconnaissance campaign, there is no evidence of data exfiltration or lateral movement. The agency removed the compromised servers from the network within 24 hours of receiving the alert. CISA is yet to clarify whether the two attacks originated from the same operators.

****_RELATED ARTICLES_****

1.  **68% of US Websites Exposed to Bot Attacks**
2.  **Fake Lockdown Mode Exposes iOS Users to Malware Attacks**
3.  **Cyberattack Defaces Israeli-Made Equipment at US Water Agency**
4.  **Hackers Leak Thousands of Idaho National Lab Employees’ PII Data**
5.  **USPS Delivery Phishing Scam Exploits SaaS Providers to Steal Data**

Adobe ColdFusion Flaw Used by Hackers to Access US Govt Servers

By Waqas
November 2023 has emerged as the most devastating year for crypto users and the most lucrative for cybercriminals and malicious hackers, as the majority of crypto hacks occurred during that month.
This is a post from HackRead.com Read the original post: Cryptocurrency losses reach $1.75 Billion in 2023; CeFi and Hacks Blamed

According to the crypto bug bounty and cybersecurity firm Immunefi, hackings accounted for $335,574,150 in losses in November 2023, involving 18 incidents.

The world’s leading blockchain cybersecurity platform, Immunefi, has published its Crypto Losses in November 2023 Report, according to which **cryptocurrency losses** have surpassed $1.75 billion due to hacks and rug pull attacks between January and November 2023. This includes 296 distinct incidents. The cryptocurrency ecosystem has witnessed $1,753,707,812 in losses year-to-date (YTD) across 296 specific incidents.

Graph credit: Immunefi

The report is quite concerning. It comes at the same time when the cybersecurity firm Unciphered discovered a critical vulnerability, dubbed ‘**Randstorm**,’ that has put billions of dollars in Bitcoin and crypto assets at risk due to outdated wallets.

In Immunefi’s October 2023 **report**, the Singapore-based Immunefi revealed that cryptocurrency attacks surged by 153% year-over-year in Q3 2023. The two largest exploits targeting Multichain and Mixin Network collectively accounted for 47.5% of all losses. The North Korean state-sponsored hacking group **Lazarus Group**’s cyberattack represented 30% of the total losses, with $208.6 million in stolen funds.

According to Immunefi’s latest **report** (PDF), a record-breaking $343 million was lost to fraud and hacks in November 2023 alone, making it the highest monthly loss this year, representing a significant 15.4x increase from October 2023’s losses that amounted to $22 million.

Hackings accounted for $335,574,150 in losses in November 2023, involving 18 incidents. This highlights that hacking poses a persistent threat in the cryptocurrency space.

On the other hand, fraudulent activities resulted in losses of $7,464,660 in 23 separate incidents, which is comparatively lower than hacking but remains a concerning issue in the industry.

In a notable shift, Centralized Finance (**CeFi**) emerged as the primary target for exploits in November 2023, surpassing Decentralized Finance (**DeFi**) in lost funds. Immunefi found that CeFi accounted for 53.8% of overall losses, whereas DeFi accounted for 46.2%. These spikes are primarily attributed to high-profile attacks on platforms like HTX Exchange, Poloniex, and Kronos Research.

DeFi platforms recorded $158,638,810 in losses in November 2023 in 37 distinct incidents, making DeFi a vulnerable sector. CeFi platforms suffered $184,400,000 in losses in November 2023 in four incidents.

The BNB Chain and **Ethereum blockchains** remained the most targeted platforms in November 2023, accounting for more than half (83%) of the total losses in all targeted chains.

BNB Chain became a target of 22 incidents, leading to losses of 53.7% of the total losses, whereas Ethereum accounted for 29.3% of the total losses with 12 incidents. Arbitrum, Optimism, Avalanche, Fantom, and Heco Chain each suffered one attack in November 2023, contributing the remaining 2.4% of the total losses.

Immunefi is the premier **bug bounty** and security services provider, safeguarding Web3 ecosystems and protecting a staggering $50 billion in user funds with its vast network of white hackers.

Graph credit: Immunefi

**Immunefi** empowers cybersecurity experts to scrutinize project code, detect and responsibly disclose vulnerabilities, and offer rewards for their contributions. This collaborative approach, according to the company, has resulted in the disbursement of over $85 million in total bounties, averting potential losses of over $25 billion in user funds. Since its inception, Immunefi has saved over $25 billion from being stolen.

As an investor in the ever-evolving world of cryptocurrency, DeFi, blockchain, and Web3, it’s crucial to prioritize the security of your digital assets. Here are 5 essential tips to protect your funds from hackers and cyber attacks:

****Secure Your Wallets****

*   **Use Cold Wallets:** These hardware devices store your private keys offline, making them significantly less susceptible to cyberattacks compared to hot wallets (software wallets connected to the internet). Popular cold wallets include Ledger, Trezor, and KeepKey.
*   **Diversify Your Wallets:** Don’t store all your funds in one wallet. Distribute them across multiple wallets for better risk management.
*   **Implement Strong Passwords:** Use unique and complex passwords for all your wallets and exchanges. Consider password managers for efficient management.
*   **Enable 2-Factor Authentication (2FA):** 2FA adds an extra layer of security by requiring a second verification factor, like a code sent to your phone, when logging in or making transactions.

****Practice Cybersecurity Hygiene****

*   **Stay Vigilant:** Be wary of phishing scams, unsolicited emails, and suspicious links. Never share your private keys or seed phrases with anyone, even those claiming to be support personnel.
*   **Keep Software Updated:** Ensure your operating systems, wallets, and other relevant software are updated with the latest security patches.
*   **Use Secure Networks:** Avoid using public Wi-Fi for accessing your crypto accounts. Opt for secure, private networks whenever possible.
*   **Be Cautious of dApps**: Before interacting with any dApp (decentralized application), research its reputation and security practices.

****Choose Reputable Platforms:****

*   **Research Exchanges:** Before investing in an exchange, thoroughly research its security features, reputation, and regulatory compliance.
*   **Prioritize Transparency:** Choose platforms that prioritize transparency in their operations and code.
*   **Beware of Unknown Projects:** Exercise caution when investing in unfamiliar projects or dApps. Conduct thorough research and due diligence before committing any funds.

****Stay Informed and Educate Yourself:****

*   **Continuously learn:** The crypto landscape is constantly evolving, so stay updated on the latest security threats and best practices. Follow reliable sources and participate in educational communities.
*   **Be aware of common scams:** Learn about common phishing tactics, exit scams, and other fraudulent activities targeting crypto investors.
*   **Seek expert advice:** If you’re unsure about any aspect of crypto security, don’t hesitate to consult with a trusted security expert or financial advisor.

****Backup Your Keys:****

*   **Always have a backup plan:** Create backups of your private keys and seed phrases and store them securely offline, preferably in multiple locations.
*   **Consider multi-signature wallets:** These wallets require multiple keys to authorize transactions, offering an additional layer of protection.

Lastly, but most importantly, visit Hackread.com regularly. Follow us on **X (formerly Twitter)**, **Facebook**, or **LinkedIn** to stay updated on daily cybersecurity news and threats.

****_RELATED ARTICLES_****

1.  **6 of the Best Crypto Bug Bounty Programs**
2.  **Crypto Scammers Exploit Gaza Crisis in Donation Scam**
3.  **We Need Smarter Smart Contracts To Prevent DeFi Hacks**
4.  **New MortalKombat Ransomware Attack Aiming for Crypto Wallets**
5.  **Scammers Use Fake Ledger App on Microsoft Store to Steal $800K**
6.  **8,000 Solana Wallets Drained Millions Worth of Crypto in Cyberattack**