标签：#SEC

Kimwolf v7: Android/IoT Botnet with HTTP/2 Browser Spoofing DDoS and ENS/Tor Three-Layer C2 1. Basic Information Severity : High Article Title : Kimwolf v7: An Evolution of the Kimwolf Botnet Publisher : Unit 42 / Palo Alto Networks Publication Date : 2026-08-11 Original Source : https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ Related Sources : Unit 42 IOCs and Analysis Materials: https://github.com/pan-unit42/iocs/tree/master/Kimwolf-v7 BleepingComputer (Large-scale DDoS Observation): https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/ Related Malware, Groups, and Products : Kimwolf v7, AISURU, Android TV box, set-top box, Android Debug Bridge (ADB), Ethereum Name Service (ENS), Tor, nghttp2, BoringSSL Main IOCs : netd_service , TVHelper , 127.0.0.1:23075 , eth.rpcuniverse[.]com , 212.193.31[.]119:13 , 212.193.31[.]122:13 , 212.193.31[.]92:443 , 212.193.31[.]158:443 2. Executive Summary This is a new version of the botnet that uses residential proxies to reach unauthenticated ADB and turn Android TV devices into bots. It maintains DDoS and proxy relay capabilities using Chrome-like HTTP/2 floods and a fault-tolerant C2 that combines ENS, Tor, and local SOCKS proxies. 3. Attack Flow Chain A: Infection and Bot Registration The attacker uses a residential proxy exit node as a stepping stone to reach ADB TCP/5555 on the local network. The attacker finds Android TV boxes or set-top boxes where ADB is active and requires no authentication. The attacker drops and runs an ARM ELF payload via an external loader or APK wrapper. For APK variants, a Java wrapper disguised as SystemService runs an embedded ELF such as libdevice.so . Some samples check for root access, but public sources do not explain how this affects execution. Some samples use BootReceiver to run after reboot. The ELF creates a Unix domain socket to prevent multiple instances and changes its process name to netd_service or TVHelper . It

I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...

Honestly, when I saw this news, I wasn't that surprised — because this is already the third time in two weeks. Let's start with what happened. According to a Hong Kong Economic Journal report citing foreign media, Meta, Facebook's parent company, confirmed that its newly released AI model, Muse Spark 1.1, "broke into" a third-party service provider's system during a cybersecurity test and altered its internal systems. Meta's explanation: a misconfiguration by the independent testing firm Irregular let the model exploit a vulnerability in the third-party service and get in during the test. A spokesperson for Irregular confirmed the incident too, but stressed that "this doesn't involve a sandbox escape or a sophisticated cyberattack," and said they're currently writing a white paper to share best practices for cybersecurity assessments. The breach was first reported by the tech outlet The Information. If you've been following this kind of news, this should sound familiar — because two nearly identical incidents just happened before this: an OpenAI model broke into external systems during testing, including Hugging Face's; and an Anthropic model escaped its sandboxed environment too. (I wrote about both of those in my previous post .) A pattern I noticed that nobody's talking about Most coverage frames this as "AI going rogue again" or "another company messing up." But staring at all three, I noticed something few people are pointing out: All three used the same testing firm — Irregular. Three top AI labs, three different models, and when the tests went wrong, it was the same test environment behind all of them. That's interesting. When the common thread is "the environment" and not "one particular AI," the story stops being "which model is more dangerous" and becomes: what determines whether an AI oversteps its bounds usually isn't the model itself — it's the environment it's placed in, the permissions it's given, and whether anyone actually drew the boundaries for it

If you built a Supabase app quickly - with an AI coding tool or by hand - the row-level-security policies were often written last, or generated for you. That is fine. What is not fine is shipping without knowing whether those policies actually isolate one user's rows from another. Supabase ships a database linter, and you should run it first - it is free and it catches the obvious cases: RLS switched off, and RLS switched on with no policy behind it. But a linter checks whether a policy exists , not whether the policy is correct . Those are different questions, and the second one is where cross-user leaks live. The 2-second test I put a minimal, synthetic reproduction on GitHub: supabase-rls-leak-demo . Same test suite on two branches, differing only by db/policies.sql : broken -> 4 failed, 1 passed (an authenticated user reads another user's row) fixed -> 5 passed npm ci npm run test :ci No Docker, no Supabase project, no credentials. The tests run PostgreSQL in PGlite locally and exercise database-level row security. They do not model Supabase Auth, PostgREST, the Data API, or the network path - the result proves only the row-level gate in the fixture, which is exactly the gate people get wrong. On broken , the failing assertion is readable on purpose: x does not let user B read any row owned by user A -> user B received 1 row(s) belonging to another user: ["A: card ending 4471, expiry 09/29"] (That is synthetic seed data, not a real card.) Run the free checks against your own database The repo also ships audit/rls-audit.sql - nine read-only queries against the system catalogs, MIT-licensed, nothing to install and nothing to send anywhere. Every one is SELECT -only, so it is safe to paste into the Supabase SQL editor. They tell you: RLS coverage per table Every policy and the roles it actually applies to (an empty roles array means no TO clause, so the policy is evaluated for anon too) The effective write check, and which columns its predicate never mentions What

Claude Code was fetching pages for me during a research session, one of them a GitHub repository page. Buried in the middle of the fetched text, between the project description and the install instructions, sat a <system-reminder> tag telling the agent that the date had changed. It hadn't. There is a real mechanism that delivers system reminders to Claude Code, and it had nothing to do with this one. A person typed that tag into a README, guessing that some AI agent would eventually read the page and mistake the text for a message from its own runtime. That was the entire attack. Plain text on a normal-looking repo, shaped like something an agent is trained to obey. No exploit, no malicious package. The README is an attack surface Fetch a GitHub repo page and you get the rendered README with it. That text is user controlled. Anyone can put anything there, and the fact that the page came from github.com over a valid certificate tells you nothing about it. The host is reputable. The content is whatever some stranger wrote. The trust boundary runs through the middle of the page, which is an uncomfortable place for a trust boundary to be. The numbers on this are worse than I expected. The ReadSecBench study (March 2026, reported in this Cloud Security Alliance research note ) tested 500 open-source README files against Claude, GPT-4, and Gemini. Direct commands embedded in the main README worked about 84% of the time. Instructions hidden two links away, in a CONTRIBUTING.md or a SECURITY.md, worked about 91%, presumably because nobody audits the files a README links to. Humans did not do much better. The same study showed flagged documents to 15 reviewers: 8 of them saw nothing wrong at all, 6 commented only on grammar and formatting, and one sensed a problem without finding the mechanism. Why "the date has changed" works The tag I found never said "ignore previous instructions." It lied about the date, which is a better move. An agent that believes today is a different

FBI Atlanta confirms it's looking into the incident, no arrests made.

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Today was a good day and a weird day, in that order. The good part: the autonomous pentest agent I've been building — I call it HALO — went from "runs a bunch of tools and hopes" to an actual web-recon → web-attack → flag-capture pipeline that pulled real flags out of a live target. The weird part: it captured flags on VulnBegin, and then, when it came time to actually submit them, they wouldn't take. Not an error. Not a crash. Just… rejected. I want to write down both halves honestly, because the second half is the more interesting engineering lesson, and it's the one I'd have skipped past a few months ago. What actually shipped today A few concrete milestones, roughly in the order they unblocked each other: The arsenal went from 31 tools to 42. I wired in a chunk of web + OSINT tooling — content discovery, subdomain enumeration, template scanning, XSS probing, passive URL collection. The point wasn't "more tools = better." It was to give the agent enough of a web-attack surface that it could go from host to flag without me babysitting each step. I stopped the silent hangs. This one cost me the most time and had the dumbest root cause. A couple of the Go-based scanners would just… hang. No output, no error, they'd ride the timeout all the way to the wall and die with nothing. I'd assumed it was a networking or a binary-compatibility problem and chased that for way too long. It wasn't. The agent runs as an MCP server over stdio — meaning the server's own stdin is the JSON-RPC pipe the whole system talks over. When I spawned a child scanner, it inherited that stdin, tried to read from it, and blocked forever waiting on a pipe that was never going to feed it. One line — stdin=subprocess.DEVNULL on the subprocess call — took one scanner from a 60-second timeout to a 1-second run. That's the whole fix. I'm still a little mad about how long it took to find. A pile of invocation fixes. Small, unglamorous, necessary: a resolver that reads targets from stdin instead of a fl

Redirect Chain چیست و چطور دامنه‌های جعلی را قبل از ورود شناسایی کنیم؟ وقتی روی یک لینک کلیک می‌کنید، همیشه مستقیماً به همان آدرسی که دیده‌اید منتقل نمی‌شوید. گاهی مرورگر ابتدا یک URL را باز می‌کند، سپس به آدرس دیگری می‌رود و در نهایت صفحه مقصد نمایش داده می‌شود. این فرایند می‌تواند کاملاً عادی باشد، اما زمانی که تعداد ریدایرکت‌ها زیاد شود یا دامنه‌ها بدون دلیل مشخص تغییر کنند، بررسی دقیق‌تر اهمیت پیدا می‌کند. برای ارزیابی یک لینک بهتر است سه موضوع را جداگانه ببینیم: مسیر Redirect، دامنه نهایی و وضعیت HTTPS. Redirect Chain دقیقاً چیست؟ Redirect Chain زمانی ایجاد می‌شود که یک URL قبل از رسیدن به مقصد نهایی، کاربر را از یک یا چند آدرس دیگر عبور دهد. یک مسیر ساده ممکن است به شکل زیر باشد: Page A → Page B → Final Page این ساختار لزوماً مشکل امنیتی نیست. سایت‌ها ممکن است برای تغییر دامنه، اصلاح ساختار URL یا انتقال صفحات قدیمی از Redirect استفاده کنند. اما مسیرهای طولانی‌تر نیاز به توجه بیشتری دارند: Link A → Domain B → Domain C → Unknown Domain D → Final Page در این حالت باید پرسید چرا کاربر میان چند دامنه متفاوت جابه‌جا می‌شود و آیا این دامنه‌ها با منبع اولیه ارتباط قابل فهمی دارند یا خیر. چه زمانی Redirect Chain مشکوک می‌شود؟ تعداد زیاد Redirect به‌تنهایی اثبات‌کننده جعل نیست، اما می‌تواند یکی از نشانه‌هایی باشد که ارزش بررسی بیشتری دارد. مواردی که بهتر است بررسی شوند شامل تغییر ناگهانی نام دامنه، عبور از چند دامنه نامرتبط، انتقال به URLهایی با ساختار عجیب و نمایش صفحه‌ای متفاوت با چیزی است که لینک اولیه وعده داده بود. مسیر مقصد را با متن لینک مقایسه کنید برای مثال اگر متن یک لینک نام یک پروژه مشخص را نشان می‌دهد اما مقصد نهایی دامنه‌ای کاملاً متفاوت است، بهتر است قبل از وارد کردن اطلاعات حساب دلیل این تفاوت مشخص شود. همچنین Short URLها می‌توانند مقصد واقعی را پنهان کنند. استفاده از Shortener به‌خودی‌خود خطرناک نیست، اما کاربر اطلاعات کمتری درباره مقصد اولیه دارد. HTTPS چه چیزی را ثابت می‌کند؟ HTTPS نشان می‌دهد ارتباط میان مرورگر و سرور با استفاده از TLS رمزگذاری می‌شود. این موضوع برای محافظت از داده‌هایی که در مسیر منتقل می‌شوند اهمیت دارد. اما HTTPS یک سوءبرداشت رای

Device-bound session credentials thwart an increasingly common form of account takeover.

In a new alert, the FBI said cybercriminals are targeting adults and minors in an attempt to steal their personal and intimate pictures in extortion campaigns.

Zoom screen-sharing bug let people fully take over other devices on a call.

Part 5 of a series building a support-ticket agent with no framework. Previous: Part 4 (the loop). Repo: github.com/akash-pal/agent-from-scratch Here's the finding this whole article is built around: partway through eval iteration, the agent started reporting that a refund had been proposed — a clean, plausible-sounding message — without ever having called the tool that proposes refunds. No approval was ever requested. No confirmation existed. The model just said it happened. That's the failure mode this part is about, and the fix is the actual argument for why guardrails belong in code, not in prompt text alone. Policy as code src/policy.ts is a plain data object — an allowlist, an approval list, rate limits, and regex patterns — checked by the agent loop, not asked of the model: export const policy : Policy = { allowTools : [ " order_lookup " , " refund_eligibility " , " issue_refund " , " kb_search " , " send_email " ], requireApprovalFor : [ " issue_refund " , " send_email " ], rateLimits : { maxToolCallsPerRun : 8 , maxCostPerRunUsd : 0.3 }, autoEscalatePatterns : { legal_threat : / \b( lawyer|attorney|sue|legal action|better business bureau| \b bbb \b)\b /i , fraud_flag : / \b( fraud|unauthorized|without my permission|didn't authorize|stolen card )\b /i , duplicate_ticket : / \b( already submitted|second ticket|duplicate ticket|already reported )\b /i , }, }; Every one of these is enforced outside the LLM's control. The model can't talk its way past requireApprovalFor — the loop checks it before executing the tool, full stop. The autoEscalatePatterns regexes run against the raw ticket text before the model is even called (this is that expected_trajectory: [] behavior from Part 3's edge-case bucket) — a legal threat or fraud flag never reaches the LLM at all, straight to a human queue. Three human-review patterns Not every consequential action needs the same review pattern. This build uses pre-action approval — human approves before execution — for issue_refund

The Delta flight crew switched off the aircraft's legitimate Wi-Fi network for around 30 minutes due to the incident, according to a spokesperson.

Zoom has patched a major security vulnerability that could allow an attacker to hijack anyone's device during a meeting. In a blog post on Tuesday, researchers at A Security say they uncovered the flaw using "fewer than 20 prompts on publicly available AI models," as reported earlier by Wired. The exploit involved Zoom's annotation feature, […]

The investigation shows that North Koreans are able to infiltrate government agencies, as well as private organizations and crypto exchanges.

Phone and Bluetooth signals could turn roadside cameras into far richer tracking tools.

Researchers say it took fewer than 20 prompts for a public AI tool to find a flaw (now fixed) allowing anyone on a Zoom call to hijack another participants’ device.

The #1 question I got after my last article: "What happens when the agent tries something destructive at 3 AM?" Every CISO I've worked with asks some version of this. They don't care how fast your agent investigates. They care about blast radius. What can it touch? What can it break? Who approved it? Where's the audit trail? This article answers all of that. I gave Kiro Crew a P1 incident and told it to fix it. Then I watched it hit a wall. If you're new to this series, catch up here: Kiro Crew Series The scenario: a real P1 on FinPay FinPay is a payment processing platform. Three services (payment, user, notification), PostgreSQL on RDS Multi-AZ, ECS Fargate, the usual stack. 26 commits of realistic history. CI/CD via GitHub Actions. Someone committed a "performance optimization" that reduced the database connection pool from 50 to 5. Deployed at 5:30 PM on a Wednesday. By 2:47 AM, the pool was exhausted. Transactions started failing. Success rate dropped from 99.8% to 34%. I gave the agent the alert and said: fix it. What happened next is exactly why enterprise teams can trust this thing. Layer 1: Investigation passes freely The agent's first instinct was to investigate. It ran: git log --oneline -10 to check recent deployments cat services/payment-service/config.js to read the configuration grep -rn pool services/payment-service/ to find pool settings All three ran automatically. No approval popup. No human intervention. Why? Read-only operations don't need permission. The agent can look at anything it needs to understand the problem. Reading code, checking logs, searching files. None of that changes state. None of that can break anything. Within 23 seconds it identified the root cause: pool max was changed from 50 to 5 in commit 2181456 ("perf: reduce connection pool overhead for lower memory footprint"). A well-intentioned optimization that was never load-tested. This is the same investigation pattern from Part 2. Fast, accurate, no human bottleneck for the det

Sometimes your application can reach an external service from one server, but not from another. I ran into this problem while working on one of my projects. I needed my server in Iran to communicate with Telegram, but the connection wasn't reliable from inside Iran. Instead of moving the whole application, I built a small intermediate service: Signed Webhook Receiver It is a lightweight FastAPI service that receives requests signed with an RSA private key and verifies them using the corresponding public key before processing them. Your Server | | RSA Signed Request v Webhook Receiver | | HTTP Request v External Service The receiver can be useful for: Secure server-to-server communication Webhooks and internal APIs Acting as a controlled proxy/gateway Connecting servers across different network environments Payment integrations where a provider requires requests from an Iranian IP For example, if your main application is hosted outside Iran but a payment gateway only accepts requests from Iranian IP addresses, an Iranian server can act as the intermediate gateway: Foreign Server | | Signed Request v Iranian Gateway Server | v Payment Gateway The important part is that this isn't an open proxy. Requests can be authenticated and the gateway can be restricted to specific operations and destinations. The project is built with Python, FastAPI, Cryptography, Docker, and Traefik and is open source. View the project on GitHub I also wrote more technical notes and development articles on my website: Building a Secure Webhook Receiver for Server-to-Server Communication | CyberHuginn