text:
WhatsApp vulnerability enabling remote attackers to exploit Integer Overflow, especially in older versions, has been addressed with a security patch in newer v...
Cloudflare, a prominent cybersecurity vendor renowned for its website protection services, has recently been scrutinized due to a vulnerability that threatens the security of customer websites. This [Threatfeed](https://www.secureblink.com) delves into the technical intricacies of the vulnerability, its potential impact, and recommendations for mitigation. ## Understanding Cloudflare's Protection Mechanisms Cloudflare offers a range of security services like Web Application Firewall (WAF), DDoS protection, and Bot management. These defenses operate via reverse-proxy servers placed between a customer's web server (the "origin server") and its users, allowing Cloudflare to inspect incoming traffic for threats. The vulnerability arises when attackers manipulate the trust between Cloudflare and its customers by bypassing the protection mechanisms. ## Vulnerability Overview Cloudflare's documentation outlines various mechanisms to prevent attackers from overloading the origin server with malicious requests, encompassing layers of the OSI Model, including the Application Layer, Transport Layer, and Network Layer. Two of these mechanisms, "Authenticated Origin Pulls" and "Allowlist Cloudflare IP addresses," rely on the assumption that all traffic originating from Cloudflare can be trusted, while traffic from other sources should be rejected. However, this assumption opens the door to exploitation. ### Authenticated Origin Pulls "Authenticated Origin Pulls" is deemed "very secure" by Cloudflare. It involves using client SSL certificates to authenticate connections from Cloudflare's reverse proxy servers to the origin server. Customers are presented with two authentication options: a "Cloudflare certificate" or a custom certificate. The issue arises when customers opt for the convenient Cloudflare certificate. This shared certificate permits all connections originating from Cloudflare, regardless of the specific Cloudflare tenant initiating the connection. An attacker can set up a custom domain with Cloudflare, point it to the victim's IP address, and turn off protection features, thereby circumventing security measures. ### Allowlist Cloudflare IP Addresses The "Allowlist Cloudflare IP addresses" mechanism, categorized as "moderately secure," instructs the origin server to reject any connection not originating from within Cloudflare's IP address ranges. Similar to Authenticated Origin Pulls, this mechanism fails to account for tenant-specific distinctions. Attackers can exploit this by establishing a custom domain with Cloudflare, directing the DNS A record to the victim's IP address, and disabling protection features. Consequently, they can bypass the victim's configured security measures. ## Proof of Concept To illustrate the vulnerability, consider a scenario where a victim uses both "Authenticated Origin Pulls" with a Cloudflare Origin Certificate and "Allowlist Cloudflare IP addresses," as recommended by Cloudflare's official documentation. In contrast, the attacker sets up a domain without WAF protection, sharing the same origin IP address as the victim. - **Victim Configuration:** - Domain: victim.test - DNS A record points to: 203.0.113.42 - Authenticated Origin Pulls and Cloudflare Origin Certificate enabled - WAF Cloudflare Managed Ruleset and OWASP Core Ruleset enabled - Security Level: "I'm under attack" - **Attacker Configuration:** - Domain: attacker.test - DNS A record points to: 203.0.113.42 - Authenticated Origin Pulls and WAF disabled - Security Level: "Essentially off" In this setup, an attacker can successfully send malicious requests to 203.0.113.42 via attacker.test, bypassing the victim's WAF configuration, while the same requests would be blocked when sent via victim.test. ## Recommendations for Cloudflare Customers This vulnerability underscores the importance of not relying solely on the "Allowlist Cloudflare IP addresses" mechanism for protecting origin servers. Instead, consider it as a defense-in-depth measure. When implementing "Authenticated Origin Pulls," opt for custom certificates over the shared Cloudflare certificate. Additionally, explore alternative mechanisms for authenticating the Cloudflare tenant, as outlined in Cloudflare's documentation. These alternatives may involve trade-offs, such as running third-party code on sensitive webservers, but they provide a more robust defense against attacks.
# Cybersecurity News Analysis: Lazarus Hacking Group Targets Spanish Aerospace Company In a recent cybersecurity incident, the notorious North Korean hacking group known as 'Lazarus' demonstrated their evolving tactics by targeting employees of a Spanish aerospace company. The attack involved a cunning blend of social engineering and the deployment of a previously undocumented backdoor named 'LightlessCan.' Let's dissect the technical details of this operation. ## Operation Dreamjob: A Deceptive Approach Lazarus initiated this attack with a deceptive LinkedIn message from a fake recruiter, masquerading as 'Steve Dawson' from Meta (Facebook). The target was lured into engaging with the attackers by feigning interest in a job opportunity. As the conversation progressed, the victim was asked to prove their proficiency in C++ programming, a clever ruse to introduce malicious payloads. ## Payload Delivery and Execution To deliver the malicious payloads, Lazarus employed ISO files containing executable quizzes. When executed, these files silently dropped an additional payload onto the victim's machine using DLL side-loading through 'mscoree.dll,' a legitimate program ('PresentationHost.exe'). This additional payload was the NickelLoader malware loader, responsible for deploying two backdoors, including 'LightlessCan.' ## miniBlindingCan: A Versatile Backdoor miniBlindingCan, a variant of BlindingCan with reduced functionality, was one of the backdoors deployed. This backdoor supports a range of commands, allowing the attacker to gather system information, update communication intervals with the command and control (C2) server, download and decrypt files, and execute shellcode. Its versatility makes it a potent tool for cyber espionage. ## LightlessCan: The Advanced Backdoor ESET's analysis revealed LightlessCan as the star of this attack. It's a successor to BlindingCan, boasting a more sophisticated code structure, different indexing, and enhanced functionality. In version 1.0, it supports a staggering 43 commands, with an additional 25 commands lurking in the code, yet to be implemented. What sets LightlessCan apart is its ability to mimic native Windows commands, such as 'ping' and 'ipconfig,' while remaining invisible to real-time monitoring tools. ## Evolving Defense Measures One intriguing defense measure implemented by Lazarus is the encryption of one LightlessCan payload with a key dependent on the target's environment. This tactic thwarts attempts by security researchers or analysts to access the victim's computer, emphasizing Lazarus' commitment to secrecy and espionage. ## Espionage Over Financial Gain This attack underscores that Lazarus' motives extend beyond mere financial gain, such as cryptocurrency theft. Their 'Operation Dreamjob' campaign reveals a strategic shift towards espionage, targeting sensitive information and intellectual property. ## Implications for Organizations For organizations in the crosshairs of threat groups like Lazarus, this development is concerning. The introduction of LightlessCan showcases the group's growing sophistication and adaptability. Enterprises must remain vigilant, continuously updating their cybersecurity defenses to counter evolving threats. ## Conclusion The Lazarus hacking group's recent attack on a Spanish aerospace company serves as a stark reminder of the ever-changing landscape of cybersecurity threats. Their blend of social engineering and the deployment of advanced backdoors like LightlessCan demonstrates the need for organizations to stay proactive and vigilant in defending against cyber adversaries. In this dynamic environment, understanding the nuances of such attacks is paramount to crafting effective defense strategies. As cybersecurity professionals, staying informed about the latest tactics and tools employed by threat actors is essential to safeguarding our digital assets and sensitive information. For the Spanish aerospace company, this incident serves as a wake-up call, highlighting the need for robust cybersecurity measures to protect against persistent and determined adversaries like Lazarus. The future of cybersecurity lies in continuous adaptation and proactive defense, and organizations must rise to the challenge to secure their digital infrastructure.
CVE-2023-42793, a critical vulnerability resulting in ripples, specifically targets TeamCity, JetBrains' popular CI/CD server. Its implications are significant, granting unauthenticated attackers the ability to execute arbitrary code on TeamCity servers, thereby facilitating remote code execution (RCE). Here, in this [Threatfeed](https://www.secureblink.com/cyber-security-news) we delve into the details of CVE-2023-42793, assess its consequences, and discuss the measures required to safeguard your systems. ## Key Information ### Sonar's Discovery The discovery of CVE-2023-42793 can be credited to Sonar's Vulnerability Research Team. They discovered a vulnerability that enables unauthenticated attackers to gain remote code execution privileges on TeamCity servers. This vulnerability poses an imminent threat, as it allows attackers to steal source code, access sensitive service secrets and private keys, manipulate the build process, and compromise the integrity of software releases. This vulnerability is not dependent on user interaction, making it an enticing target for malicious actors. Meanwhile, Greynoise is currently tracking many IP addresses from which CVE-2023-42793 exploit attempts are being made. ### Vulnerability Details The root cause of this vulnerability lies in an authentication bypass. Specifically, TeamCity versions 2023.05.3 and earlier of the on-premises variant are susceptible. Attackers can exploit this flaw without requiring a valid account on the target instance, rendering it easily exploitable. As a result, we are compelled to emphasize the urgency of prompt action to mitigate this risk. ## Impact ### The Gravity of RCE [CVE-2023-42793](https://nvd.nist.gov/vuln/detail/CVE-2023-42793) strikes at the heart of cybersecurity concerns. With RCE capabilities, attackers can not only pilfer source code but also gain access to highly confidential service secrets and private keys. Moreover, the ability to interfere with the build process by injecting malicious code jeopardizes the integrity of software releases. The most concerning aspect is that this vulnerability requires no user interaction, making it an attractive option for cybercriminals. ### Urgency of Action To underscore the urgency of the situation, it's crucial to note that this vulnerability does not necessitate a valid account on the targeted instance. Its trivial exploitability raises concerns about its potential exploitation in the wild. Shodan currently identifies over 3,000 on-premises TeamCity servers accessible from the Internet. ## Indicators of Compromise ### Unveiling Malicious Activity One crucial indicator of compromise is the existence of an authentication token named RPC2. This token's presence strongly suggests unauthorized and potentially malicious user activity on the server. It's essential to recognize that an attacker may attempt to cover their tracks by deleting or renaming this token post-exploitation. ## Technical Details ### Request Interceptors TeamCity employs request interceptors to execute specific actions for every HTTP request. A critical role of these interceptors is the authorization mechanism. These interceptors are part of the global request handling process and are often overlooked during security assessments. In the context of this vulnerability, a wildcard expression, "**/RPC2," was unintentionally included, disabling the authorization check for requests ending with "/RPC2." ### Request Path Parameters TeamCity offers a REST API for external application integration. While the documentation outlines endpoints, some hidden endpoints, like "/app/rest/users/<userLocator>/tokens/{name}," can be exploited. This specific endpoint allows an unauthenticated attacker to create a new authentication token with an arbitrary name, including "RPC2." ## Patch ### The Path to Security JetBrains swiftly addressed this vulnerability with the release of TeamCity version 2023.05.4. The patch removes the wildcard expression for the "/RPC2" pre-handling exception, ensuring that pre-handling is only disabled when "/RPC2" is accessed directly without additional prefixes in the requested path. This measure effectively prevents authentication bypass for other endpoints. ## Timeline ### Collaborative Efforts JetBrains and the Sonar Vulnerability Research Team maintained open communication throughout the discovery and remediation process. JetBrains' rapid response and efficient collaboration ensured a swift resolution to this critical security issue. - **September 6, 2023**: The vulnerability is reported to JetBrains. - **September 6, 2023**: JetBrains acknowledges receipt of the report. - **September 7, 2023**: JetBrains fixes the issue in the 2023.05 branch. - **September 12, 2023**: JetBrains prepares a plugin as a workaround. - **September 14, 2023**: JetBrains confirms the issue as a major security concern. - **September 18, 2023**: TeamCity version 2023.05.4 is released, addressing the vulnerability. - **September 18, 2023**: JetBrains notifies customers to update promptly. - **September 19, 2023**: CVE-2023-42793 is published. - **September 21, 2023**: Coordinated release of blog posts from JetBrains and Sonar. - **September 27, 2023**: Full disclosure follows the public release of an exploit. ## Learnings ### The Importance of Authorization This incident underscores the significance of authorization checks. While endpoints often receive individual checks, global request interceptors are frequently overlooked. These interceptors, part of the global attack surface, must not be neglected in security assessments. ### Taming Wildcards Wildcard expressions, while versatile, can inadvertently expose vulnerabilities. A more restrictive approach is advisable to prevent unintended vulnerabilities like the inclusion of "/**/RPC2."


text:
We have created these Free Calendar Save the Dates for every month of 2010, 2011, and 2012! We had a lot of fun making them and we hope you love them. The download also includes a fancy little envelope to make your Save the Dates super special. Download them. {They will take a bit to download because they are 300 dpi files}
Download 2010 and 2011 HERE Download 2012 HERE Supplies Needed:
Printer, we love the Epson Stylus Photo 1400 #10 Luxe Fino Cream Flat Cards 25 for $6.25 #10 Open End Luxe Fino Cream Envelopes 10 for $5.50
Stamp and Ink, or Brads and a 1/8 inch hole punch.
4x3 Photos (if you would like to attach an actual photo to the card)
Choose your favorite photo and print or trim to 4 inches by 3 inches and attach it to your Save the Date. You can go to your local photo lab or print them yourself on photo paper. (We have printed the image directly on the card.)
Top image by Hugh Forte Middle Image by Lane Dittoe Bottom image by Mathieu Photography Print out your cards. We used the Epson Stylus Photo 1400 and it's amazing! Perfect for all of your wedding DIY projects.
We got our card stock and envelopes at Paper Source. #10 Luxe Fino Cream Flat Cards 25 for $6.25 #10 Open End Luxe Fino Cream Envelopes 10 for $5.50
If you have access to any photo editing program, you can simply create a circle graphic to mark your date.
Another cute way to mark your date is with a stamp, we chose a heart. Stamp and ink from Michael's. This is my personal favorite. Super sweet and adds a pop of color.
Although, the brads are super cute too. We found these little gems at Michael's and used a 1/8 hole punch.
We hope you have fun with our Calendar Save the Dates. Please let us know what you think and let us know what you want to see next! Download 2010 and 2011 HERE Download 2012 HERE

subset: commoncrawl


text:
No products
Prices are VAT excluded
24 Morning Mist 111224
New product
Creativity Seamless Photography Backgrounds / Backdrops
A wider photography background paper roll, ideal as a background for product photography or portraiture. The original Seamless photography background paper / photographic studio backdrop in the full range of 50 colours on a 2.72 metre wide x 11m roll (8'11" x 36ft), 140 gsm.
Core size 5cm 2 inches.
This product is no longer in stock
Availability date:


text:
This simple tutorial will guide you in the creation of a Ribbon Stretchy Spine. Nowadays it's not as commonly used as the IK Spine Rig but it fits well in a cartoon rig. It will be fully stretchy and will have twist from the three controls we are going to create.
First of all we have to create a NURBS plane. The spine will have 5 joints so the NURBS plane needs 5 V patches and must have a Cubic Surface degree.
This will create a NURBS plane along the Y axis with 5 V patches and 1 U patches and three degrees in both U and V. But we'll have to rebuild the curve so it only has 1 degree in U because we only need three degrees in V.
To do that we select the NURBS plane and click (in the Surfaces module) on Edit NURBS>Rebuild Surfaces. In the option window we select the U direction, set the U spans to 1 and the U degree to 1. The V values will be ignored.
Now the NURBS plane should look like this:
In the next step we have to attach a Hair System to the NURBS plane to use it as the drivers for the joints that will be skinned to the model.
We have to select the NURBS plane and click (in the Dynamics module) on Hair>Create Hair. The U count must be set to 1 and the V count must be set to 5.
This will create a full Hair System but we only need the follicles so we have to delete the output curves and the hairSystem node.
Now we have to create the joints. Place then individually at the same position as the follicles and then parent them under each follicle.
Now if we move any Control Vertex of the NURBS plane the joints will follow the plane perfectly.
The next step is to create the driver system for the spine rig.
First of all create a joint structure for the top, middle and bottom parts of the NURBS plane and place them as the image below.
Now create the controls that will drive the joints and locators that will be used to Aim Constraint from top to bottom and vice versa, and also locators that will be used as the Up Object for those Aim Constraints.
The scene and Hypergraph should look as the image below.
Now we place the joints under each Aim locator.
The next step is to Aim Constraint the locators.
First, select the topCtl object, then shift-select the btmAim locator and click (in the Animation module) on Constraint>Aim Constraint.
Set the Aim Vector to Y, the Up Vector to X and the World Up Type to Object and type btmUp.
Next, select the btmCtl object, then shift-select the topAim locator and click (in the Animation module) on Constraint>Aim Constraint.
Set the Aim Vector to -Y, the Up Vector to X and the World Up Type to Object and type topUp.
Now select both topCtl and btmCtl and then shift-select midCtlGrp and create a Point Constraint.
After that we have to aim the middle control to the top control, so select the topCtl and then shift-select the midAim locator and create an Aim Constraint. Set the Aim Vector to Y, the Up Vector to X and the World Up Type to Object and type midUp.
The system should now look like this when you move it around.
Now we have to bind the driver joints to the NURBS plane so the system we created can drive the joints that will be smooth binded to the geometry.
Select the topDriver00, midDriver00 and bottomDriver00 joints and then shift-select the NURBS plane. Then click (in the Animation module) on Skin>Smooth Bind with these options.
Now, when you move, for instance, the center control, the NURBS plane will deform, moving in the process the joints placed in the NURBS plane. We will have to change the weighting on the Control Vertex so we can draw a perfect arc when we move the middle control.
Select the Control Vertex and click Window>General Editors>ComponentEditor. Go to the Smooth Skins tab and change the weight values until it look like this or until you have the deformation you're looking for.
Finally the Ribbon Stretchy Spine is finished. You may like it or not, but it's just another way to rig an stretchy spine, a long neck or to rig anything you may find this system suitable for.
You can also read this tutorial here: https://joseantoniomartinmartin.com/2010/06/20/tutorial-ribbon-stretchy-spine-rig/
Author: Jose Antonio Martin Martin
Submitted: 2010-06-20 11:11:53 UTC
Tags: maya, Rig, spine, and ribbon
Software: Maya
Views: 56,877
Related Items
Fire Ant Maya Rig 0.0.1 for Maya
Meerkat Maya Rig 0.0.1 for Maya
Nick-Maya Rig With Advance Facial Setup for Maya 0.1.0
3D Sphynx Cat Maya Rig 0.0.1 for Maya
3D Silver Cyborg Maya Rig 0.0.1 for Maya
A Chipmunk or Squirrel Maya Rig and Model 3D Model
Tanner Saurus Rex - 3D Maya rig 3D Model
Crab Rig for Maya 1.0.0
Fairy Rig for Maya 1.0.0


text:
The Supreme Court jumps to unanimity on frog case | George Will
The Supreme Court's unanimous ruling on endangered frogs strikes down bureaucratic overreach.
Unanimity is elusive in today's America, but the Supreme Court achieved it last week. Although the dusky gopher frog is endangered, so are property rights and accountable governance. Both would have been further jeopardized if the frog's partisans in the U.S. Fish and Wildlife Service (FWS) had gotten away with designating 1,544 privately owned Louisiana acres as a "critical habitat" for the 3-inch amphibian, which currently lives only in Mississippi and could not live in the Louisiana acres as they are now. The eight justices (the case was argued before Brett Kavanaugh joined the court) rejected both the government's justification for its designation and the government's argument that its action should have received judicial deference, not judicial review.
<< READ MORE: Supreme Court orders new look at case of endangered frog
In his opinion for the court, Chief Justice John Roberts explained that back in the day, you could not sling a brick without conking a dusky gopher frog in the longleaf pine forests of coastal Alabama, Mississippi, and Louisiana. But 98 percent of those forests have been supplanted by urban development, agriculture, and timber harvesting. The species of frog, which was last seen in Louisiana in 1965, was designated endangered in 2001, when about 100 were found at a single pond in southern Mississippi, where the FWS decided the frogs were at risk of extinction from hurricanes or other natural events.
The frog is, like a well-born Victorian maiden, a frail flower, requiring everything to be just so. The frog needs an "open-canopy" forest with suitable ground vegetation and food supplied if the area experiences frequent fires, and breeds only in "ephemeral" ponds that are dry part of the year, thereby protecting the tadpoles from hungry fish. The FWS designated the 1,544 acres a "critical habitat" even though (1) no such frog has inhabited them for half a century and (2) none could live long there unless the land were substantially modified (e.g., trimming the canopy, producing suitable undergrowth, and experiencing fires that the acres' loblolly pines cannot withstand) and (3) the loss of the acres could cost the owners $34 million in lost timber farming and development opportunities.
Writing in the manner of a schoolmarm whose patience has been sorely tried by a slow pupil, Roberts said: "According to the ordinary understanding of how adjectives work, 'critical habitat' must also be 'habitat.' Adjectives modify nouns — they pick out a subset of a category that possesses a certain quality." The 1,544-acre habitat that the FWS says is essential to preserving the species would be, in its unimproved condition, lethal to the species. So, the case has been sent back to a lower court, which is directed to think long and hard about the meaning of habitat, and to reconsider its peculiar theory that there is no "habitability requirement" when designating a "critical habitat."
The Supreme Court also rejected an impertinence that agencies of the administrative state invoke when throwing their weight around. It is the idea that courts should defer to an agency when it makes an arguably reasonable interpretation (e.g., that an uninhabitable habitat is "essential" to the existence of a species of frog) of a less-than-clear statute that the agency is administering.
This idea is the crux of progressivism's case for allowing the administrative state to boss us around without judicial review of its bossiness: This state's agencies say that they possess detailed expertise beyond Congress' ken, and that courts should bow before the agencies' disinterested wisdom when construing Congress' legislative instructions, however much the instructions' ambiguities leave the agencies with vast discretion. Roberts reminded the dusky gopher frog's friends that courts are commanded by law to "set aside any agency action that is 'arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.'"
Roberts cannot hope to replicate the achievement of his greatest predecessor, John Marshall, who as chief justice from 1801 to 1835 presided over a court in which approximately 95 percent of opinions were unanimous. However, in the aftermath of the Kavanaugh confirmation circus, and recent presidential ruminations about judicial partisanship, Roberts must be eager to minimize the number of 5-4 decisions, and to achieve unanimity when possible. So it was serendipitous that the frog case involved government overreaching sufficiently egregious to unite Roberts' colleagues behind an opinion that he must have relished writing.
The 8-0 ruling was doubly beneficial. It was a recuperative moment for the court. And it was a chastisement of the administrative state, the government's fourth branch, which is one too many.
George F. Will writes a twice-weekly column on politics and domestic and foreign affairs. He began his column with The Post in 1974, and he received the Pulitzer Prize for commentary in 1977. @georgewill


text:
What They Are:
Tranquilizers and other depressants calm nerves and relax muscles. They are bright-colored capsules or tablets that are legally available through a doctor for medical reasons, but can be illegally abused.
Sometimes Called:
A-minus, Candy, Downers, Goofballs, Barbs, Yellow Jackets, Ludes, Red Birds, Sleeping Pills, Tooies, Tranks, Zombie Pills
How They're Used:
Depressants are swallowed.
What They Do:
When used as prescribed by a doctor, depressants can calm nerves and relax muscles.
Larger or improperly used doses of depressant drugs can cause confusion, lack of coordination, low blood pressure, and slowed heart rate and breathing. Someone who takes them may have slurred speech and an inability to concentrate, and may fall asleep at work or school. Depressants are addictive and withdrawal symptoms include anxiety, sleeplessness, and seizures.
Depressant drugs are very dangerous if taken with alcohol and some other drugs. Very large doses of depressants can stop breathing and cause death.
Note: All information is for educational purposes only. For specific medical advice, diagnoses, and treatment, consult your doctor.
© 1995- The Nemours Foundation. KidsHealth® is a registered trademark of The Nemours Foundation. All rights reserved.
Images sourced by The Nemours Foundation and Getty Images.


text:
|Experience EASY online shopping with Home Furniture Mart
|Best Value
|Fast Delivery
|Free Shipping
Prime Resources International Moonriver Lift Chair PR-DS-95-002
Manufacturer Details
Prime Resources International is a leader in motion upholstery. Motion furniture continues to be on-trend. Reclining chairs, reclining sofas and love seats, reclining sectionals, and home theater collections enhance the experience of gaming or watching TV. Available through retailers all over the country, PRI products offer the best service, delivery and logistics. Customers find PRI products an enticing mix of superior comfort, style and design, all at entry and middle price points.
Prime Resources International Moonriver Lift Chair PR-DS-95-002


text:
Hi! Simply click below and type your query.
Our experts will reply you very soon.
Find Residential & Commercial Property in Mansarovar Jaipur. Dhruv Reality & Marketing is providing Jaipur Mansarovar Properties Sell Rent Classifieds database . Contact with us for instant Buy sell Residential Plot, Builder Floor, Flats & Apartments, Individual Houses / Villas.
Mansarovar, Jaipur
Bedroom : 3 BHK
Build up Area : 1461 Sq.ft.
Property Type : Builder Floor
46 Lac
Property by Category
Locations in Jaipur
Property by City