VayFul Security - July 09 2024

Hi all!

Welcome back, here is your dose of VayFul Security, a list of what we are enjoying…

📰 SECURITY BYTES

A Hacker Stole OpenAI Secrets, Raising Fears That China Could, Too - Hackers gained access to internal messaging systems, potentially stealing details about OpenAI's developmental processes and product designs. While the source code itself remains secure, the stolen information could provide a roadmap for competitors or malicious actors. #openAI #creds #stolen

New Variation of WordFence Evasion Malware - A new variation of malware has been discovered that specifically targets WordPress websites and attempts to evade detection by Wordfence, a popular security plugin. #wordpress #malware

Kimsuky hackers Targeting Japanese Organizations with Malware Using Weaponized EXE & DOCX Files - Japan's cybersecurity authority, confirms renewed attacks by the notorious North Korean threat actor group Kimsuky. The report details the use of CHM (compiled help) format malware to target Japanese organizations.  Kimsuky is known for its sophisticated spear-phishing tactics and focus on espionage. #malware #spear-phishing

A BGP Hijacking: Cloudflare's 1.1.1.1 Resolver Briefly Goes Down - A recent incident caused Cloudflare's popular 1.1.1.1 DNS resolver to experience temporary outages and degradation for some users globally on June 27th, 2024. The issue stemmed from a combination of Border Gateway Protocol (BGP) hijacking and route leaks. #cloudflare #bgp #hijack

CVE-2024-6376: Code Injection Vulnerability Patched in MongoDB Compass - CVE-2024-6376 identified in MongoDB Compass, a popular database management tool, has been addressed. This vulnerability involved potential code injection through the ejson shell parser within Compass' connection handling. #mongoDB #injection

🔥 INTERESTING WRITEUPS

CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector -  [4920$ Bounty] 

HTTPOnly session cookie exposure on the /csstest endpoint - [1500$ Bounty]

📝 BLOGS & ARTICLES

Securing Your Self-Hosted Open-Source AI Project - Securing your self-hosted, open-source AI application. While open-source AI offers exciting possibilities, security considerations are paramount. The article explores key strategies to fortify your application. #Appsec #AI

GHSL-2024-089: Path traversal in youtube-dl leading to RCE - CVE-2024-38519 - A recently discovered vulnerability in the popular video downloader "youtube-dl" (versions prior to 2024.07.14) could allow attackers to potentially gain remote code execution (RCE) on your computer. #path-traversal #youtube-dl

How Google handles security vulnerabilities - Google adheres to a 90-day disclosure deadline and notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after 90 days, or sooner if the vendor releases a fix. #google #vdp

Bittensor Security Incident - An Independent Analysis - An independent analysis delves deeper into the recent Bittensor security incident, where the platform suffered an $8 million loss. The report sheds light on the root cause of the breach, identifying a malicious package uploaded to the PyPi Package Manager. #security #incident #analysis

🛠️TOOLS

QuickJS - Execute JavaScript in a WebAssembly QuickJS Sandbox. #JS #WebAssembly #sandbox

Sharedrop- Easy P2P file transfer powered by WebRTC - inspired by Apple AirDrop. #WebRTC #file #transfer

Polyfil-glibc - Patch Linux executables for compatibility with older glibc. #polyfill #JS #glibc

Way-shell - A Gnome-like shell for wayland compositors. #gnome #shell

🧠 TUTORIALS & SKILL-BUILDING

A RedMonk Conversation: Useable Security is the Best Security - RedMonk conversation with security consultant and OWASP board member Avi Douglen. The interview focuses on the concept of "usable security" - security practices that are practical, user-friendly, and effective. Douglen argues that overly complex security measures often backfire, leading to user workarounds and ultimately, reduced security. #usable #security

AI is ruining the internet - Drew Gooden talks about how AI is ruining facebook, instagram, twitter/X, netflix, spotify, AI as a side hustle and terrifying AI video. He says AI stops human creativity by overly relying on AI tools. #AI #chatGPT

Use your source code to document your application - Michaël Hompus - In this session, we will explore how to leverage Roslyn to generate documentation directly from your .NET source code. We'll delve into creating diagrams that depict the structure and relationships within an aggregate and sequence diagrams that illustrate the flow throughout the application. #diagram #documents #from #sourcecode

So Long Secure Coding - Practical Steps for Securing the entire SDLC - If you haven't started to shift left yet, you're late. I mean, the whole world has been shifting application security left for about five years... especially in the wake of DevSecOps. Why we focus on secure code and how we can move towards secure development. #shift-left #devsecops

🎁 MISCELLANEOUS

Fabric - It is an open-source framework for augmenting humans using AI. #AI #open-source #framework

scrollHub - Host unlimited websites. Scroll is a language and static site generator for scientists of all ages. #static #website #hosting

PraisonAI - It is an application that combines AutoGen and CrewAI or similar frameworks into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent collaboration. #LLM #framework

Wild new Wi-Fi routers turn your home network into a security radar - Say goodbye to traditional security cameras and hello to the future! A new project on Indiegogo, the Gamgee Next-Gen Home Alarm, takes a unique approach to home security. #wifi #router

🎯 QUOTE OF THE DAY

⭐ HOW DID WE DO?

Enjoyed this newsletter? Friends don’t keep good things to themselves - forward this to your friends and have them sign up here.

That’s a wrap!

Thank you for reading,
VayFul Team