Some pretty interesting stuff this week, hope you enjoy reading !
- It wouldn’t be news without Yahoo. News has surfaced that the “forged cookie” attack disclosed by Yahoo recently was used to access about 32M accounts. Yahoo claims it’s the same actor that was responsible for the prior breach that resulted in 500 million accounts being breached.
- Read More @ https://www.cnet.com/news/yahoo-says-forged-cookie-attack-accessed-about-32m-accounts/
- I am sure you all have heard about the Amazon Web Services outage, as it took down some quite big services for about 3 hours. Now the company has revealed that this was a result of an engineer mistyping a command and not due to an attack of any sort. Just good ol’ human error.
- Read More @ https://www.engadget.com/2017/03/02/amazon-admits-that-a-typo-took-the-internet-down-this-week/
- Next, an interesting new attack was discovered by Cisco Talos research team that was using the DNS Txt records to carry out PowerShell commands. This is a very interesting use of DNS as a way to ensure the attack is as stealthy as possible. Good read.
- Read More @ https://threatpost.com/new-fileless-attack-using-dns-queries-to-carry-out-powershell-commands/124078/
- The company behind the connected toy line “CloudPets” was breached as an exposed DB exposed something like 800, 000 user accounts and as many as 2.2M voice messages.
- Read More @ https://www.infosecurity-magazine.com/news/cloudpets-breached-kids-voice-2/?utm_source=dlvr.it&utm_medium=twitter
- The webcast for this week is on one of my favorite topics, which is of course “Exploit Kits”. The folks at Palo Alto Networks give a good introduction to EKs, and how they work. For those not familiar with the topic, it’s a good watch. Enjoy !
- Watch @ https://www.brighttalk.com/webcast/10903/240613?utm_campaign=viewing-history