Multiple Agencies Warn of Web Application Access Control Attacks via IDOR Vulnerabilities

Context On July 27, 2023, The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) released an advisory “to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities.” The advisory primarily consists…

Read More

Account Takeover Proof of Concept for 0Auth Security Flaw in Microsoft Azure Active Directory

Before publishing, Descope informed Microsoft, several “large vulnerable applications,” and two authentication platform providers of the issue and Microsoft has reportedly taken mitigating steps. Context On June 20, 2023, researchers at Descope reported the technical details of a security flaw in the Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process they dubbed “n0Auth.” According…

Read More

New “Skuld” Infostealer Malware Written in Golang Leveraged in North America, Europe, and Southeast Asia

On June 13, 2023, security researchers at Trellix reported the details of a new information stealing malware written in Golang that they dubbed “Skuld.” Context Since April 2023, Trellix researchers observed the malware active against unspecified targets in North America, Europe, and Southeast Asia. Technical Details According to the report, Skuld attempts to steal sensitive…

Read More

Small and Medium-Sized Businesses Increasingly Targeted by APTs

On March 24, 2023, Proofpoint released their report, “Account Compromise, Financial Theft, and Supply Chain Attacks: Analyzing the Small and Medium Business APT Phishing Landscape in 2023.” Context The report provides insight into key trends in the increasing prevalence of sophisticated advanced persistent threats (APTs) targeting small and medium-sized businesses (SMBs). Key Takeaways Key points…

Read More

Resurgence of Vacation Request-Themed Phishing

On May 23, 2023, Cofense researchers reported a phishing campaign with threat actors leveraging paid time off (PTO) and vacation requests as a lure theme. Context The report is based on a Phishing Defence Center (PDC)-reported a phishing campaign where threat actors sent emails to users claiming to be from ‘HR Departments’ and providing the users with links…

Read More