LATEST

Ransomware Canaries: A 2022 Update | Huntress

Read about the exciting new updates to our Ransomware Canaries service.

BreakingFormation

Read access of host of AWS internal Cloudformation service via XXE SSRF. The level of access with the compromised IAM role from there is unclear.

SuperGlue

Compromise of internal AWS Glue service to assume the glue role in any AWS account that used glue.

Huntress Donates $100,000 to DIVD Bug Bounty Program | Huntress

We believe it’s time for MSP vendors to level up cybersecurity community efforts, so we’re taking the first step with a $100,000 contribution to DIVD.

AWS AI services ToS allow sharing of customer data

Use of the AI services on AWS allows customer data to be moved outside of the regions it is used in and potentially shared with third-parties. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.

2021 in Review (And Other Horror Stories) | Huntress

We recap some of the cybersecurity trends and events in 2021 to prepare for the new year.

Bypassing Identity-Aware Proxy in Google Cloud

A vulnerability in Google Cloud Platform's Identity-Aware Proxy (IAP) allowed attackers to bypass authentication and access IAP-secured web applications. The exploit involved creating a malicious IAP-secured app using the target's OAuth client ID, configuring query parameter-based routing to capture redirect tokens, and using these tokens to hijack authorized sessions.

Dataflow RCE via unauthenticated JMX service

Dataflow worker nodes ran an unauthenticated Java Management Extensions (JMX) service that under certain circumstances would be exposed to the Internet, thus allowing unauthenticated remote code execution (RCE) as root in an unprivileged container. The impact of the vulnerability depended on which service account qA assigned to Dataflow worker nodes (by default, that would be the Google Compute Engine default service account, which has the project-wide Editor role assigned).

Google Cloud Shell command injection

A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. The "Open in Cloud Shell" functionality allowed a user to provide values for both the "git_repo" and "go_get_repo" parameters, which would clone the target repo in the user's environment. While "git_repo" was validated against a list of trusted repos, "go_get_repo" was not. Therefore, an attacker could have supplied a trusted repository as "git_repo" and an arbitrary command in the "go_get_repo…

Mitigating Log4Shell in Log4j with Group-IB

Group-IB's recommendations to mitigate this vulnerability and protect your organization.

How MITRE ATT&CK® helps users of Threat Intelligence

Overprivileged AWS support IAM role policy

AWS added an excessive s3:getObject permission to AWSSupportServiceRolePolicy IAM policy used by AWS Support teams, and removed it a day later.

Ready-made fraud

Behind the scenes of targeted scams

Making the Switch to Huntress Managed Microsoft Defender| Huntress

Our partners at United Systems and F1 Solutions talk about their respective journeys with our Managed Microsoft Defender solution.

Texas HB 3834 Cyber Security Awareness Training Requirements | Huntress

Here's how to meet the Texas HB 3834 compliance requirement for a cybersecurity awareness training program for all contractors and employees.

Log4Shell: A Tradecraft Tuesday Recap | Huntress

We recap our December 2021 episode of Tradecraft Tuesday where we dive into the Log4Shell vulnerability.

Ditching FUD for FUN in Security Awareness Training | Huntress

Learn how to make security awareness training enjoyable and effective by ditching fear, uncertainty, and doubt (FUD) in the Huntress Blog.

Critical RCE Vulnerability: log4j - CVE-2021-44228 | Huntress

Our team is currently investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package.

Critical RCE Vulnerability Updates (log4j - CVE-2021-44228) | Huntress

Read about how our team investigated CVE-2021-44228, a critical vulnerability that was affecting a Java logging package.

Inside the Hive

Deep dive into Hive RaaS, analysis of latest samples

LPE vulnerability in Eltima (3rd-party cloud desktop driver)

Several cloud desktop solutions rely on a 3rd-party library called Eltima SDK to provide USB over Ethernet capabilities, to allow users to connect and share local devices such as webcams. SentinelLabs discovered vulnerabilities in Eltima drivers, including proprietary versions used by several cloud services (among them AWS Workspaces), that would allow unprivileged users to escalate privileges to kernel mode.

The True Value of the Huntress SOC Team | Huntress

Automation is great—but when it comes to threat detection and analysis, it doesn’t replace the need for human expertise.

AWS SageMaker Jupyter Notebook instance CSRF

AWS SageMaker Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments. The exact same issue existed in GCP previously.

Is There a Right Way to Set Up Two-Factor Authentication? | Huntress

In this blog, we aim to answer the question: how easy is it for hackers to circumvent two-factor authentication? We look at their tricks to learn the best way to set up 2FA.

Decrypting diversity: Diversity and inclusion in cyber security report 2021

The 2nd joint report between the NCSC and KPMG UK benchmarks against the 2020 findings to gauge what progress has been made.

CredManifest (Azure AD keyCredential property information disclosure)

Automation Account 'Run as' credentials (PFX certificates) were being stored in cleartext, in Azure Active Directory (AAD). These credentials were available to anyone with the ability to read information about App Registrations (typically most AAD users).

Investigating Unauthorized Access | Huntress

Learn about our investigation regarding unauthorized access to our QA and product testing environment.

AWS SOC 2 type 2 failure (Fall 2021)

Information about this issue is under NDA, but AWS customers can read about it on page 98 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.

AWS API Gateway HTTP header smuggling

A flaw in AWS API Gateway enabled hiding HTTP request headers. Tampering with HTTP requests visibility enabled bypassing IP restrictions, cache poisoning and request smuggling.

How Ransomware Works and Why It's a Hacker Favorite | Huntress

Ransomware marks a lucrative business in today’s cyber-driven world. Learn more about ransomware and why it’s a favorite among hackers.