Microsoft’s post-mortem into how China-linked attackers accessed cloud email accounts for US gov’t organisations is an incredible read, and it shows how a chain of mistakes and vulnerabilities in the cloud can lead to a real mess. The attackers probably couldn’t believe their luck. In cloud email security poker, it's a royal flush.

A Microsoft engineer account gets hacked. Engineer has access to a sensitive crash dump, which due to a race condition vulnerability still contained a consumer signing key. That expired consumer signing key works for – boom! – enterprise email due to some validation errors. After forging some Azure Active Directory (AD) access tokens, the attackers crack open the email accounts of the State and Commerce departments. #infosec

Story by @dangoodin https://arstechnica.com/security/2023/09/hack-of-a-microsoft-corporate-account-led-to-azure-breach-by-chinese-hackers/

NEW: Using a Flipper Zero, a security researcher has demonstrated that anyone can flood nearby iPhones with annoying and persistent pop-ups.

Researchers says this can be used as a "prank," but also effectively as a denial of service.

“It’s not just a minor inconvenience; it can disrupt the seamless experience that Apple users are accustomed to,” he said.

https://techcrunch.com/2023/09/05/flipper-zero-hacking-iphone-flood-popups/

Find of the day - someone dropped an AtlasVPN #0day on Reddit. The AtlasVPN daemon on Linux runs an HTTP server to accept CLI commands, it binds to 127.0.0.1:8076 by default.

What's hilarious is that it accepts commands without ANY authentication - so if you open a malicious webpage, that webpage can fire a POST to 127.0.0.1:8076/connection/stop and instantly disconnect your VPN.

Utter garbage.

Source: https://www.reddit.com/r/cybersecurity/comments/167f16e/atlasvpn_linux_client_103_remote_disconnect/

Proof below - used AtlasVPN's latest Linux client, version 1.0.3.

Just published a blog post about the crates.io malware typosquatting incident a couple of weeks ago — basically, what happened, and what we did in response on the crates.io team: https://blog.rust-lang.org/inside-rust/2023/09/01/crates-io-malware-postmortem.html

You can also read this in conjunction with this blog post from Phylum, who reported this incident: https://blog.phylum.io/rust-malware-staged-on-crates-io/ — our thanks again to @louislang!

#rust

Never in my life would I expected a cybersecurity issue (at least not a non-food safety issue) to result in a food recall

Add this to your risk assessments

FYI, when a website erases your text that you just spent an hour writing, you can use this little trick to recover it 99% of the time:

1. find the firefox pid

$ pgrep -l firefox

2. attach gdb to firefox and dump its core

$ sudo gdb <pid>
gcore firefox.dump
<this takes awhile>
quit
<firefox dies>

3. find your lost text in the coredump

$ strings firefox.dump | grep "a unique word/sentence from ur text"

i just did this today to recover a long post i wrote, and figured i'd show others!!