Bypassing Biometrics, Hiding in Plain Sight, Hacker Cinema, & High Aspirations – PSW #720

Paul Asadoorian

1. Don’t Hide Your Secrets in Plain Sight
   Pretty good write-up of some of the ways in which to store and access secrets in AWS.
2. VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing
   Pretty neat addition to the platform: "Collections...are live reports that contain, alongside a title and an optional description, a group of IoCs such as domain addresses, file hashes, IPs, and URLs, which can be enhanced with VirusTotal analysis metadata."
3. How Decryption of Network Traffic Can Improve Security
   Agree or Disagree? - "Today, it’s nearly impossible to tell the good from the bad without the ability to decrypt traffic securely."
4. Play Your Cards Right: Detecting Wildcard DNS Abuse
5. Printing Shellz: Critical bugs impacting 150 HP printer models patched
   This is so interesting: "while the scanner board communicates with the communication board using normal network, the printer board seems to use CAN bus to interact with the formatter, making the architecture of this MFP somewhat similar to vehicles" Shodan is proof some people don't do this: "Secondly, since an attacker in the same network segment can exploit the vulnerability by communicating directly to JetDirect TCP/IP port 9100, it is recommended to place the printers into a separate, firewalled VLAN" Full research (A GREAT read): https://labs.f-secure.com/assets/BlogFiles/Printing-Shellz.pdf
6. SmartNICs set to infiltrate enterprise networks
7. How Red Canary and Microsoft can help reduce your alert fatigue – Microsoft Security Blog
8. Zoom Launches Auto-Update Feature For Windows And Mac Clients
   Have to give Zoom some credit here: "Their most recent step in this regard has been the launch of end-to-end encryption followed by two-factor authentication." and now they have automatic updates. Though does not appear to support Linux clients for me and the other person using the Linux client.
9. Multiple Vulnerabilities Spotted In Zoom Video Conferencing App
   Oh and they fixed a couple of vulnerabilities: "Following the report from the researcher, Zoom patched both the vulnerabilities with the latest releases. Users can take a look at the list of affected products shared in Zoom’s advisory to know about the security status of their apps. Whereas it’s ideal to ensure still updating the respective Zoom apps to the latest releases to receive any patches anyway."
10. Hacking Fingerprints With a $5 Setup To Bypass Biometric Authentication
    Awesome: "For our final step, we add some wood glue on top of the print to bring to life a fake fingerprint that we can use on a scanner."
11. Organizations Now Have an Average 76 Security Tools to Manage
12. Attackers exploiting Windows Installer vulnerability despite patching
13. Thousands of AT&T customers in the US infected by new data-stealing malware
14. Despite the popularity of password managers, many still use pen and paper – Help Net Security
15. Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
16. Insulet OmniPod Insulin Management System vulnerability
17. New Windows 10 zero-day gives admin rights, gets unofficial patch
18. This stealthy malware hides behind an impossible date
19. ‘The Matrix’ Is the Best Hacker Movie
20. “High” aspirations: 5 cannabis jobs you never knew existed
21. Perv dubbed ‘Dr Magic Flute’ claimed he could cure women’s cancer by having sex