Khaled Farah

🚀 LATEST FUNDING/M&A IN CYBERSECURITY 🚀   Zafran Security: An Israeli Cybersecurity startup which has developed a risk and mitigation platform to pinpoint the ‘exploitable’ threats in the organization and to mitigate their risk by mobilizing existing security controls, has raised $40 million in their latest funding round. The funding round was led by Sequoia Capital's growth fund, with participation from all existing investors. This is Zafran Security's second fundraising round in six months. Prior to this round, Zafran had raised $30.5 million in Seed funding in March from leading investors Sequoia Capital and Cyberstarts.   P0 Security: A cybersecurity provider of the first unified IGA and PAM platform for the cloud designed to secure all enterprise cloud identities, today announced the closing of its $15 million Series A round, bringing its total raised since inception to $20 million. The investment was led by SYN Ventures with participation from Zscaler, the leader in cloud security, and existing investor Lightspeed Venture Partners.   Illuma Labs: a leader in voice authentication technology for banking contact centers, has secured $9 million in Series A funding led by LiveOak Ventures, with participation from Forefront Venture Partners Curql Fund, USNet, Capital Factory, Connexus, and TDECU. This investment will accelerate the development of Illuma’s voice verification solutions, addressing threats like fraud, voice cloning, and deep fakes and expanding its reach to more credit unions and banks nationwide.   ColorTokens Inc.: A leading global enterprise micro segmentation company, announced that it has acquired PureID, an innovative startup providing secure identity and access management. This acquisition will significantly strengthen ColorTokens’ micro segmentation capabilities by integrating robust identity solutions. This news closely follows the announcement that ColorTokens was named a Leader in The Forrester Wave Micro segmentation, Q3 2024 evaluation.    Operant AI: A Runtime AI Application Protection Platform provider has raised $10 million in a Series A funding round co-led by SineWave Ventures and Felicis, with participation from Alumni Ventures, Massive, Calm Ventures, Gaingels, alongside industry-expert angels. This investment brings Operant AI’s total funding to $13.5 million, which they will use to accelerate team and product expansion.   Difenda: a privately held Sec-Ops-As-A-Service company will be acquired by Quorum Cyber, one of the fastest-growing cyber security companies in the UK and North America. The acquisition aligns with Quorum Cyber’s strategic objective to accelerate its global expansion and scale meaningfully into new regions.   Congrats to all involved! 👨‍🎤 👩‍🎤 #venturecapital #cybersecurityfunding #startups

20

SUMMARY: A new Golang-based botnet named Zergeca has been discovered, capable of bypassing security mechanisms and attacking various systems. MAIN POINTS: - Zergeca botnet uses Golang programming language for enhanced evasion capabilities. - It targets both Windows and Linux operating systems. - Security experts found it bypasses several advanced security mechanisms. TAKEAWAYS: - Organizations need to update their defenses to tackle evolving threats like Zergeca. - Cross-platform malware demands heightened attention on security practices. - Regular security audits and updates are crucial for threat mitigation. #Botnet #Golang #cybersecuritynews #MemorySafeLanguage #MSL

4

Searching for AWS Resources in the Console Search Bar ~~ Using /Resources to find all the things https://lnkd.in/eXc74V66

1

🚨 Top Android Apps Vulnerable to Frida 🚨 A significant security gap has been uncovered, revealing that 97% of the most popular Android apps are susceptible to the reverse engineering tool, Frida. This vulnerability, discovered by Norwegian cybersecurity firm Promon, could pave the way for malicious actors to manipulate app behaviour and harvest sensitive data. Promon's analysis of 150 top Android apps found that a staggering 144 could be configured to operate within Frida's testing environment. Shockingly, only three apps had measures in place to detect Frida and respond appropriately by shutting down or limiting functionality. This lack of detection is an open invitation for exploitation, according to security researcher Simon Lardinois. Frida is a dynamic instrumentation toolkit popular among security researchers for legitimate purposes, but also a favourite among attackers. The fact that nearly all apps lack Frida detection highlights a critical shortfall in app security. Lardinois underscores the urgency: "For apps handling sensitive data, this is a wake-up call to implement more stringent protections against Frida." Promon's report stresses the urgent need for increased awareness and the implementation of proactive security measures in the Android development community. Traditional detection techniques, like identifying unique library names or monitoring network resources, must evolve as attackers increasingly refine their evasion tactics. It's a poignant reminder for developers to fortify their apps against such vulnerabilities. Let's discuss in the comments: Are you concerned about the security of your favourite apps? 🚀🛡️📱 #CyberSecurity #AndroidApps #TechNews

4

1 Comment

certutil.exe is showing up in my investigations - what do I do next? Michael Wilkinson goes into the details in this blog https://lnkd.in/e2TPHivM

2

How to Figure Out What’s Running On a Specific Port on Linux ~~ Some strange process is running on a particular port — what is that? ~~ In this case looking at STUN/TURN/ICE traffic which is used for peer to peer connections to bypass NATs and Firewalls https://lnkd.in/e-BcKWq2

6

Saiu update do Prowler 4 com grandes updates. 💪🏼 55 New AWS checks Prowler is improving its AWS coverage by including 55 new checks for Kafka, Lightsail, Storage Gateway, DynamoDB, Cognito, EC2, EventBridge, SNS and RDS. 📝 HTML output is back! We have listened you and as our community is always first, we brought our HTML back 😄 Get it again with prowler <provider> -M/--output-formats html ✍️ Custom Checks Metadata Now you can override the all the metadata fields from a check using the --custom-checks-metadata-file custom_checks_metadata.yaml flag. Mais infos https://lnkd.in/d3ha4N-i Já tem o prowler 4.2.1 com bug fixes mas as infos updates estão link acima =) #cloud #cloudsecurity #cspm #blueteam #redteam #aws #awssecurity

83

2 Comments

I've seen a few accounts recently where scammers posing as recruiters sent software engineers fake coding tests that included malicious code. One case involved a Python coding challenge that, when executed, gave attackers access to the candidate’s system. While this type of scam is deeply malicious, there could also be less harmful but equally annoying attempts — such as wasting your time with fake tests that lead nowhere or using your work for unauthorised purposes. Even if you already run all untrusted code in isolated containers or routinely inspect for obfuscated scripts, it’s worth keeping these reminders in mind: ✅ Check the Recruiter: Always verify their identity through LinkedIn or the company’s website before engaging further. ✅ Use a Sandbox: Run all coding tests in a controlled environment to ensure they’re safe. ✅ Look for Red Flags: Suspicious file formats, unsolicited assignments, or pressure to complete a task quickly can all indicate something’s off. ✅ Guard Your Work: If the test seems unusually detailed or asks for deliverables resembling real-world production work, question the intent. These scams can range from frustrating to outright dangerous. Stay sharp and always take a moment to evaluate before diving into a test. https://lnkd.in/gWkFNcuu

3

These are some of the situations where you know "the limit of your language is your limit". I have really been stressed trying to get AWS Encryption SDK working in Golang. Lot's of experimentations in the last couple of hours. It's unfortunate that AWS doesn’t natively support Golang for the Encryption SDK yet. #cloudengineering #cloudcomputing #softwareengineering #coding #programming #golang #awscloud

7

### SUMMARY: Apache has issued warnings about critical security vulnerabilities affecting Mina, HugeGraph, and Traffic Control, urging immediate updates to secure systems. ### MAIN POINTS: - Apache Mina has been identified with severe security flaws posing significant risks to systems. - Vulnerabilities in HugeGraph and Traffic Control require prompt response to prevent potential exploitation. - Immediate updates are recommended to address these critical vulnerabilities and enhance security. ### TAKEAWAYS: - Users and administrators should prioritize applying security patches to affected Apache software. - Staying informed about security alerts can help mitigate risks from known vulnerabilities. - Regular updates are essential for maintaining system integrity and protecting against threats. #ApacheUpdates #VulnerabilityAlert #SecurityPatch #cybersecuritynews

2

Any people involved in risk assessments for organizations should take note of this blog post my comments on X and be asking AWS questions as the architecture seems to be changing. On the one hand it’s good! You want to see all resources in one place across all the regions in which you operate. On the other hand, there are regions where you never, ever want your packets to travel. Is that still the case without complicated configurations? The global views should be opt in where you select the regions you want to see, and where you can explicitly block ALL traffic to each region where you never operate when you set up that view. Something like that would solve security problems instead of creating them. Check out my blog post below for what to check.

5

Are you looking for an alternative to Docker Desktop, especially in environments where licensing restrictions apply? Let me introduce you to Finch (https://lnkd.in/eRAS4qpv) — a seamless and efficient container management solution! Finch offers a lightweight, Docker-compatible runtime. Here are a few reasons to consider Finch: 1. Docker-Compatible: Use your existing Docker files without changes. 2. Open Source: Free to use and community-driven. 3. Minimalist Design: Focus on simplicity and performance. #containers #opensource #finch

4

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization. The Apache Software Foundation (ASF) has released patches to address a maximum severity vulnerability in the MINA Java network application framework that could result in remote code execution under specific conditions. Tracked as CVE-2024-52046, the vulnerability carries a CVSS score of 10.0. It affects versions 2.0.X, 2.1.X, and 2.2.X. "The ObjectSerializationDecoder in Apache MINA uses Java's native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses," the project maintainers said in an advisory released on December 25, 2024. "This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks." However, it bears noting that the vulnerability is exploitable only if the "IoBuffer#getObject()" method is invoked in combination with certain classes such as ProtocolCodecFilter and ObjectSerializationCodecFactory.

1

1 Comment

Join us for an interactive Chalk Talk session on how to use AWS services to secure your software build pipelines. Also, there will be lots of dad jokes throughout courtesy of yours truly. 🤣 #aws #appsec #softwaresupplychain

24