Critical Windows network vulnerability with exploits in the wild. Another Bluetooth issue. Cool new iOS security features.

Granted, an attacker needs to have some kind of small foothold in the network first. But once they do, this is the one latteral move to rule them all. It doesn't happen often that a second-stage exploit gets a 10/10 CVSS score. There is exploit code in the wild, so patching is a must, and the US gov has even made that an order.

Another week, another Bluetooth vulnerability. This one has to do with the reconnection process between two devices. If I understand correctly, the Bluetooth spec doesn't describe clearly enough how reconnection authentication needs to be handled. As a result some implementations are vulnerable to authentication bypasses.

There's some good stuff there. Clear indication of microphone and camera being used, a notification when something accesses the clipboard, share general location instead of precise location, see when an app requests local network access and randomised MAC addresses to stop Wifi tracking.

Not the first time this technique is used, but very interesting to highlight. To try and bypass security measures the ransomware runs inside a virtual machine that mounts the hosts's disks as shares.

This is pretty cool. MITRE, known from the ATT&CK framework that maps out common steps that attackers take, are starting a library where they'll document how certain hacker groups run their attacks. This way you can put your defenses to the test and see if you'd be able to detect them. The linked article is their announcement, but if you just want to skip to what such a plan looks like, I got ya: link.

Related, although from a higher level, here's a fascinating write-up of how the FIN7 cybercrime group operates: link.

Quite an unorthodox approach for an IRS. They really must have a lot of trouble with people hiding and transfering assets through Monero currency.

I hadn't heard of this one yet, and it's a good "con" to be aware off. Potential investors approach your company with a lot of interest and goodwill, but expect you to bear the cost of the due dilligence. Once those have been paid to the legal firm they "prefer to work with", they bail out.

It's really just a document, but a good one at that. It describes how one could tackle vulnerability disclosure. It even provides a response plan for XSS and subdomain takeovers, because those were the most reported issues for them. You can go to the document directly here.

This is hands down the greatest write-up I have ever read, I was in tears from laughing halfway through. It's a very long read though, so make sure to set some time aside.