31Wedge

Source: Cyber Security News

Author: Guru Baran

URL: https://cybersecuritynews.com/windows-user-account-control-bypassed/

ONE SENTENCE SUMMARY:

A new technique using Windows Private Character Editor exploits UAC, enabling privilege escalation without user intervention, alarming administrators.

MAIN POINTS:

1. Matan Bahar discovered the technique exploiting Windows Private Character Editor to bypass UAC.
2. The utility, eudcedit.exe, is used to create and edit End-User Defined Characters.
3. Vulnerability leverages critical configurations in eudcedit.exe’s application manifest.
4. Key metadata tags enable automatic elevation to administrative privileges.
5. UAC can be bypassed with permissive settings like “Elevate without prompting.”
6. Attackers use font linking in the editor to manipulate file handling for command execution.
7. The process allows execution of arbitrary commands via high-privilege PowerShell sessions.
8. Microsoft typically doesn’t patch UAC bypasses as UAC isn’t considered a security boundary.
9. The simplicity of this method raises security concerns for enterprise teams.
10. ANY.RUN offers a trial for threat data to enhance incident response.

TAKEAWAYS:

1. Legitimate system utilities can be weaponized effectively for attacks.
2. Microsoft’s stance on UAC has remained unchanged; security boundary not considered.
3. Administrators should review UAC configuration settings for enhanced security.
4. Awareness and monitoring of potential exploitation paths are crucial.
5. Enterprises must stay informed on emerging threats and vulnerabilities.

Source: Stories by Nasreddine Bencherchali on Medium

Author: Nasreddine Bencherchali

URL: https://nasbench.medium.com/the-ghost-in-the-logs-dfir-through-a-palimpsest-lens-b592ef733f4f

ONE SENTENCE SUMMARY:

Palimpsests in history and DFIR reveal how overwritten traces can be uncovered, aiding digital forensic investigations despite attack obfuscation.

MAIN POINTS:

1. A palimpsest is a manuscript with overwritten traces beneath new text.
2. The Archimedes Palimpsest was uncovered using advanced imaging techniques.
3. Attackers hide traces by deleting logs and overwriting files in DFIR.
4. Deleted or cleared logs and files still leave artifacts in systems.
5. Tampering with tools and services can still be detected by anomalies.
6. Absence of evidence often indicates a disruption or manipulation.
7. Sophisticated attackers avoid common telemetry triggers.
8. Investigators often face challenges due to lack of traditional logs.
9. A “palimpsestic” mindset helps reveal hidden forensic evidence.
10. Registry, $MFT, and other system artifacts hold valuable investigative data.

TAKEAWAYS:

1. Palimpsests illustrate how overwritten information can be revealed.
2. Forensic echoes linger despite attackers’ deletion efforts.
3. A “palimpsestic” perspective aids detection of subtle traces.
4. Advanced imaging uncovers hidden historical texts.
5. Investigative success often depends on understanding system artifact persistence.

Source: Help Net Security

Author: Zeljka Zorz

URL: https://www.helpnetsecurity.com/2025/08/07/exchange-hybrid-deployment-vulnerability-cve-2025-53786/

ONE SENTENCE SUMMARY:

Microsoft highlights a privilege escalation vulnerability in Exchange hybrid deployments, urging transition to dedicated apps for enhanced security.

MAIN POINTS:

1. Attackers can exploit CVE-2025-53786 in Exchange hybrid setups to escalate privileges.
2. Vulnerability arises from shared service principal in Exchange Server and Exchange Online.
3. Microsoft plans to block Exchange Web Services to promote dedicated hybrid app adoption.
4. Dedicated app and Graph API transition planned for greater security.
5. Hotfix updates are available for Exchange Server versions to support dedicated hybrid apps.
6. By October 2025, shared service principals in Exchange hybrids will be permanently blocked.
7. CISA advises following guidelines and using Health Checker for additional security.
8. Public-facing, outdated Exchange servers should be disconnected from the internet.
9. End of extended support for Exchange 2016 and 2019 is October 14, 2025.
10. Microsoft encourages patching and upgrading for better security against Exchange server attacks.

TAKEAWAYS:

1. Transition to dedicated Exchange hybrid apps is crucial for security.
2. October 2025 marks the end for shared service principal usage.
3. Organizations should run Microsoft’s Health Checker for configuration checks.
4. Discontinue outdated, unsupported Exchange and SharePoint servers.
5. Regular patching and upgrading bolster defenses against attacks.

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2025/08/6500-axis-servers-expose-remoting.html

ONE SENTENCE SUMMARY:

Security researchers identified multiple vulnerabilities in Axis Communications’ video surveillance products, enabling potential remote code execution and unauthorized access.

MAIN POINTS:

1. Security flaws disclosed in Axis Communications’ video surveillance products.
2. Vulnerabilities could lead to takeover attacks when exploited.
3. Remote code execution possible on Axis Device Manager and Camera Station.
4. Internet scans reveal 6,500 servers using vulnerable Axis.Remoting services.
5. Four main CVEs identified with varying severity (CVSS scores 9.0 to 4.8).
6. Exploits allow adversary-in-the-middle and authentication bypass attacks.
7. Over 4,000 vulnerable servers are located in the U.S.
8. Attackers can hijack and control camera feeds.
9. Successful exploitation grants system-level access to internal networks.
10. Currently, no wild exploitation of these vulnerabilities has been reported.

TAKEAWAYS:

1. CVE-2025-30023 is critically severe with a score of 9.0.
2. Authentication bypass vulnerability poses significant security risk.
3. Patching systems with updated software versions is crucial.
4. Awareness of server exposure to Axis.Remoting services is important.
5. Vigilance needed as no current evidence of exploitation exists.

Source: Cisco Talos Blog

Author: Philippe Laulheret

URL: https://blog.talosintelligence.com/revault-when-your-soc-turns-against-you/

ONE SENTENCE SUMMARY:

Talos revealed multiple vulnerabilities in Dell’s ControlVault3 firmware, posing significant security risks across over 100 laptop models.

MAIN POINTS:

1. Reported vulnerabilities in ControlVault3 firmware and Windows APIs termed “ReVault.”
2. Vulnerabilities affect over 100 Dell laptop models, primarily in Latitude and Precision series.
3. ReVault attack enables persistence even after Windows reinstalls.
4. Physical compromise grants attackers admin privileges without login credentials.
5. Vulnerabilities include out-of-bounds, arbitrary free, stack-overflow, and unsafe deserialization issues.
6. Attack scenarios include post-compromise pivot and physical tampering.
7. Significant risk of leaking key security material and unnoticed firmware implants.
8. Attackers can exploit vulnerabilities by accessing the USH board.
9. Recommended mitigation involves keeping systems updated and disabling unused security peripherals.
10. Detection includes enabling chassis intrusion via BIOS and monitoring Windows logs for anomalies.

TAKEAWAYS:

1. Regularly update firmware and software to mitigate vulnerabilities.
2. Disable unused security features like fingerprint login to reduce risk.
3. Enabling chassis intrusion detection can help identify physical tampering.
4. Monitoring Windows logs can detect signs of potential compromise.
5. Proactive risk assessments are vital for maintaining secure hardware and software environments.

Source: Microsoft Security Response Center

Author: unknown

URL: https://msrc.microsoft.com/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks/

ONE SENTENCE SUMMARY:

Microsoft employs a defense-in-depth strategy against indirect prompt injection in LLMs, focusing on prevention, detection, and impact mitigation.

MAIN POINTS:

1. Indirect prompt injection targets LLMs by manipulating input data to misinterpret instructions.
2. Potential impacts include data exfiltration and unintended user actions.
3. Microsoft’s defense-in-depth approach includes probabilistic and deterministic measures.
4. Prevention strategies involve system prompts and Spotlighting to differentiate trusted/untrusted input.
5. Detection employs Microsoft Prompt Shields, integrated with Defender for Cloud.
6. Impact mitigation includes data governance and user consent workflows.
7. Advanced research contributes new mitigation techniques, like TaskTracker and FIDES.
8. Recent efforts involve open-sourcing datasets and running public challenges.
9. System design aims to limit security impacts even if prompt injections succeed.
10. Defense strategies are continually evolving with architectural changes and research initiatives.

TAKEAWAYS:

1. Defense-in-depth combines multiple strategies to combat prompt injection.
2. Prevention hinges on clear distinction between trusted and untrusted inputs.
3. Detection relies on continuous update and integration of safety tools.
4. Mitigation strategies ensure minimal impact even if injections occur.
5. Ongoing research and public challenges advance understanding and defenses.

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/security/cisa-flags-papercut-rce-bug-as-exploited-in-attacks-patch-now/

ONE SENTENCE SUMMARY:

CISA warns of active exploits targeting PaperCut software, urging immediate patching against vulnerabilities used by ransomware groups.

MAIN POINTS:

1. CISA reports exploitation of a high-severity PaperCut NG/MF vulnerability allowing remote code execution.
2. The software is used by over 100 million users in 70,000+ organizations worldwide.
3. Vulnerability CVE-2023-2533 was patched in June 2023; exploitation requires a logged-in admin and a malicious link.
4. CISA added this flaw to the Known Exploited Vulnerabilities Catalog, with a patch deadline of August 18 for U.S. agencies.
5. All organizations, including private, are advised to prioritize patching this bug due to significant risks.
6. Shadowserver tracks over 1,100 potentially exposed PaperCut servers, though not all are vulnerable.
7. No evidence links CVE-2023-2533 to ransomware; similar exploits used in past breaches by ransomware gangs.
8. Microsoft linked previous PaperCut attacks to LockBit, Clop ransomware, and Iranian state-backed groups.
9. Previous breaches targeted the ‘Print Archiving’ feature to steal corporate data from compromised systems.
10. Joint advisory from CISA and FBI warned educational organizations of potential exploitation by ransomware groups.

TAKEAWAYS:

1. Immediate patching of PaperCut vulnerabilities is crucial to prevent potential exploitation.
2. Organizations should prioritize addressing known exploited vulnerabilities to enhance security.
3. Understanding the tactics used by ransomware gangs is essential for proactive defense.
4. Collaborations between agencies like CISA, FBI, and companies like Microsoft help in threat mitigation.
5. Continuous monitoring of exposed servers can prevent unauthorized access and data breaches.

Source: The Hacker News

Author: The Hacker News

URL: https://thehackernews.com/2025/07/fire-ant-exploits-vmware-flaw-to.html

ONE SENTENCE SUMMARY:

Fire Ant, linked to China’s UNC3886, targets virtualization and networking infrastructure using stealthy methods for cyber espionage.

MAIN POINTS:

1. Fire Ant targets VMware ESXi, vCenter, and network appliances in cyber espionage.
2. Uses sophisticated techniques for multilayered attack chains accessing segmented networks.
3. Shares attributes with UNC3886, a known China-nexus cyber espionage group.
4. Establishes control in VMware environments and bypasses network segmentation.
5. Exploits vulnerabilities, notably CVE-2023-34048 and CVE-2023-20867, for prolonged access.
6. Deploys persistent backdoors and Python-based implants for remote command execution.
7. Facilitates network tunneling and compromises F5 load balancers using CVE-2022-1388.
8. Maintains low intrusion footprint by tampering with logging and using stealth techniques.
9. Highlighted as a threat to national security by Singapore’s Minister for National Security.
10. Operates covertly, targeting under-secured infrastructure layers lacking detection solutions.

TAKEAWAYS:

1. The campaign shows advanced, stealthy intrusions targeting critical network infrastructure.
2. Fire Ant demonstrates persistent, sophisticated cyber espionage capabilities.
3. Traditional security tools struggle to detect hypervisor and network infrastructure attacks.
4. The threat extends risks to critical infrastructures beyond regional borders.
5. UNC3886’s activities raise significant national security concerns globally.

Source: Active Countermeasures

Author: Faan Rossouw

URL: https://www.activecountermeasures.com/dns-packet-inspection-for-network-threat-hunters/

ONE SENTENCE SUMMARY:

DNS packet inspection helps network threat hunters detect Command and Control (C2) communications by analyzing atypical DNS traffic patterns.

MAIN POINTS:

1. DNS is often used for Command and Control (C2) communications due to its commonality and stealth capabilities.
2. Analyzing DNS traffic can reveal hidden malicious activities within network communications.
3. DNS packet inspection involves scrutinizing packet data for unusual patterns or anomalies.
4. Long, garbled DNS queries are potential indicators of C2 communications.
5. Insight into DNS anomalies helps identify compromised systems in a network.
6. Effective DNS monitoring requires understanding typical traffic patterns and deviations.
7. Network threat hunters utilize DNS inspection to trace back malicious activities.
8. DNS logging and analysis tools facilitate the detection of C2 communications.
9. Real-time monitoring of DNS traffic enhances threat detection capabilities.
10. Proper DNS inspection can prevent data breaches by identifying early signs of threats.

TAKEAWAYS:

1. DNS traffic analysis is crucial in identifying covert C2 communications.
2. Understanding normal DNS patterns aids in detecting anomalies.
3. Real-time inspection can proactively mitigate network threats.
4. Long, suspicious queries are key indicators of malicious activities.
5. Effective DNS inspection prevents potential security breaches.

Source: The CISO code of conduct: Ditch the ego, lead for real | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4022903/the-ciso-code-of-conduct-ditch-the-ego-lead-for-real.html

ONE SENTENCE SUMMARY:

The article criticizes inflated egos among CISOs, advocating for humility, collaboration, and real leadership within the cybersecurity field.

MAIN POINTS:

1. CISOs’ egos can overshadow their intelligence, impacting collaboration and decency.
2. The industry glorifies the CISO role, rewarding poor behavior over genuine leadership.
3. CISOs often create echo chambers, avoiding challenges and hoarding influence.
4. Toxic behaviors extend to vendor interactions, negatively affecting collaboration.
5. There’s a call for CISOs to embrace humility and accountability for true leadership.
6. Security leadership involves aligning with business outcomes, not just technical functions.
7. Respect across domains like Legal and Finance is essential for trust and effectiveness.
8. Effective leadership involves building resilient teams and mentoring future leaders.
9. Real leaders make themselves replaceable, ensuring continuity and growth.
10. The CISO Code of Conduct emphasizes integrity, humility, and respect in leadership.

TAKEAWAYS:

1. Recognize and address inflated egos to foster a healthier leadership environment.
2. Shift focus from influence to integrity in the CISO role.
3. Encourage collaboration, mentorship, and team-building over control and ego.
4. Align security initiatives with the business for meaningful impact.
5. Uphold a shared standard of conduct to elevate the role’s credibility.

Source: AWS Security Blog

Author: Mitch Beaumont

URL: https://aws.amazon.com/blogs/security/beyond-iam-access-keys-modern-authentication-approaches-for-aws/

ONE SENTENCE SUMMARY:

Enhance AWS authentication security by replacing long-term IAM access keys with secure alternatives, such as CloudShell, IAM Identity Center, and IAM roles.

MAIN POINTS:

1. Long-term IAM access keys pose security risks like credential exposure and unauthorized access.
2. Use AWS CloudShell for AWS CLI to avoid local credential management.
3. Combine AWS CLI v2 with IAM Identity Center for centralized user management and MFA.
4. Integrated development environments like Visual Studio Code support secure IAM Identity Center authentication.
5. Use IAM roles for AWS compute services and CI/CD pipelines to automate credential rotation.
6. For third-party applications, use temporary credentials through IAM roles and avoid root account keys.
7. Implement IAM Roles Anywhere for non-AWS workloads to generate temporary credentials.
8. Use OpenID Connect with IAM roles for SaaS CI/CD services to reduce long-term credential usage.
9. Apply the principle of least privilege to ensure minimal necessary permissions.
10. Utilize AWS tools for policy generation based on CloudTrail logs to optimize security strategies.

TAKEAWAYS:

1. Prefer temporary credentials to enhance security over long-term access keys.
2. Choose authentication methods suited to specific use cases.
3. Implement the principle of least privilege on all access pathways.
4. Leverage AWS tools for efficient policy generation and management.
5. Regularly assess and update authentication methods as new solutions appear.

Source: Dark Reading

Author: Ariadne Conill

URL: https://www.darkreading.com/vulnerabilities-threats/containment-core-security-strategy

ONE SENTENCE SUMMARY:

The website’s security system blocked access due to suspicious activity, and resolution involves contacting the site owner with details.

MAIN POINTS:

1. The website uses a security service against online attacks.
2. Blocking can result from triggering security measures.
3. Specific actions like submitting certain data can cause blocks.
4. A SQL command or malformed data might trigger a block.
5. Users should contact the site owner to resolve issues.
6. Provide details of the action when the block occurred.
7. Include the Cloudflare Ray ID in communication.
8. Emailing the site owner is recommended for assistance.
9. Determining specific triggering action may help prevent future blocks.
10. Website protection prioritizes security and user safety.

TAKEAWAYS:

1. Website employs robust security systems to prevent attacks.
2. Understand which actions might trigger security blocks.
3. Direct contact with site owner is essential for resolution.
4. Sharing detailed incident information aids troubleshooting.
5. Automation in security may occasionally cause user inconvenience.

Source: BleepingComputer

Author: Lawrence Abrams

URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/

ONE SENTENCE SUMMARY:

A zero-day vulnerability in Microsoft SharePoint, CVE-2025-53770, has led to widespread exploitation, with ongoing efforts to mitigate and patch the issue.

MAIN POINTS:

1. Updated article reveals 54 organizations affected by SharePoint vulnerability.
2. CVE-2025-53770 has been exploited since July 18, affecting 85 servers.
3. Viettel’s “ToolShell” attack used chained SharePoint flaws CVE-2025-49706/49704.
4. Microsoft has not yet patched CVE-2025-53770; AMSI integration is recommended.
5. Enabling AMSI and Defender AV as mitigations prevent unauthenticated attacks.
6. SharePoint 2016/2019 updates include AMSI by default since September 2023.
7. Disconnect unprotected SharePoint servers to prevent exploitation.
8. CISA added CVE-2025-53770 to its Known Exploited Vulnerability catalog.
9. Over 29 organizations initially compromised, detected by Eye Security.
10. Attackers use “spinstall0.aspx” for MachineKey theft and RCE.

TAKEAWAYS:

1. Prompt application of upcoming SharePoint security patches is crucial.
2. Enabling AMSI and deploying Defender AV mitigates vulnerability risks.
3. Detecting specific IOCs can indicate compromised SharePoint servers.
4. Disconnect from the internet if unable to apply mitigations swiftly.
5. Monitoring for IP addresses associated with exploitation is essential.