Critical Windows network vulnerability with exploits in the wild. Another Bluetooth issue. Cool new iOS security features.  21st September 2020

Zerologon: trivial exploit to get full control of a Windows Domain Controller

Granted, an attacker needs to have some kind of small foothold in the network first. But once they do, this is the one latteral move to rule them all. It doesn't happen often that a second-stage exploit gets a 10/10 CVSS score. There is exploit code in the wild, so patching is a must, and the US gov has even made that an order.

BLESA: Bluetooth security flaw

Another week, another Bluetooth vulnerability. This one has to do with the reconnection process between two devices. If I understand correctly, the Bluetooth spec doesn't describe clearly enough how reconnection authentication needs to be handled. As a result some implementations are vulnerable to authentication bypasses.

New iOS 14 and iPadOS 14 security and privacy features

There's some good stuff there. Clear indication of microphone and camera being used, a notification when something accesses the clipboard, share general location instead of precise location, see when an app requests local network access and randomised MAC addresses to stop Wifi tracking.

Maze ransomware now encrypts via virtual machines to evade detection

Not the first time this technique is used, but very interesting to highlight. To try and bypass security measures the ransomware runs inside a virtual machine that mounts the hosts's disks as shares.

MITRE introduces library for adversary emulation plans

This is pretty cool. MITRE, known from the ATT&CK framework that maps out common steps that attackers take, are starting a library where they'll document how certain hacker groups run their attacks. This way you can put your defenses to the test and see if you'd be able to detect them. The linked article is their announcement, but if you just want to skip to what such a plan looks like, I got ya: link.

Related, although from a higher level, here's a fascinating write-up of how the FIN7 cybercrime group operates: link.

IRS offers $625,000 bounty if you can break Monero privacy

Quite an unorthodox approach for an IRS. They really must have a lot of trouble with people hiding and transfering assets through Monero currency.

Krebs article on investment scams

I hadn't heard of this one yet, and it's a good "con" to be aware off. Potential investors approach your company with a lot of interest and goodwill, but expect you to bear the cost of the due dilligence. Once those have been paid to the legal firm they "prefer to work with", they bail out.

UK government releases toolkit to easily disclose vulnerabilities

It's really just a document, but a good one at that. It describes how one could tackle vulnerability disclosure. It even provides a response plan for XSS and subdomain takeovers, because those were the most reported issues for them. You can go to the document directly here.

When you browse Instagram and find former Australian Prime Minister Tony Abbott's passport number

This is hands down the greatest write-up I have ever read, I was in tears from laughing halfway through. It's a very long read though, so make sure to set some time aside.