The Deep Purple Sec – May 2025
A monthly round-up of interesting articles, reports and tools for tech experts, covering both offensive and defensive topics.
🔴 Red Team
📝Hacking My Car, and probably yours— Security Flaws in Volkswagen’s App
Vishal discovered security flaws in the My Volkswagen app, which allowed unauthorised access to personal and vehicle data using the car’s VIN. He was unable to set up the app because a four-digit one-time password (OTP) had been sent to the previous owner’s phone, and he was unable to contact them.
Frustrated, Vishal used a brute-force attack on the OTP using Burp Suite and a Python script, gaining access to the app. He discovered serious vulnerabilities, including leaked internal credentials and personal details that could be accessed via the VIN. He reported these to Volkswagen’s security team, who responded quickly but took months to resolve the issues.
📝Shadow Roles: AWS Defaults Can Open the Door to Service Takeover
The blog post discusses security concerns relating to default AWS service roles, which are automatically created or recommended during setup and grant overly broad permissions, such as full S3 access. These roles can be exploited to carry out administrative actions and breach isolation boundaries between services, potentially leading to a full account compromise.
The post provides examples of these risks in AWS Glue, SageMaker and EMR, as well as in open-source projects such as Ray. The authors recommend restricting overly permissive access to S3 and auditing AWS roles to minimise risk.
📌 Source: https://www.aquasec.com/blog/shadow-roles-aws-defaults-lead-to-service-takeover/
📝Top-Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
SentinelOne shared its experiences of being targeted by various adversaries, including IT workers from the DPRK, ransomware operators and Chinese state-sponsored actors. The attacks ranged from job application scams to attempts to gain access to their platform.
SentinelOne emphasised the importance of collaboration between different teams and automation in defending against these threats and preventing infiltration. They also highlighted the growing trend of adversaries exploiting sales processes and the need for security vendors to treat every access vector as part of their attack surface.
🔵 Blue Team
📝‘It’s Not Paranoia If They’re Really After You’: How Announcing Deception Technology Can Change Attackers’ Decisions – ThinkScapes Q1 2025
This research examined how knowledge of deception technologies, such as honeypots, affects attacker behaviour. Participants used BloodHound to plan attack paths in a simulated network. When aware of decoys, 40% was unable to create new paths, and alternative paths were longer but more stealthy in environments with few decoys. Despite limitations such as a small sample size, the study demonstrates how attackers’ strategies adapt to anticipated deception, offering insights into their mindset and decision-making.
📌 Source: https://thinkst.com/ts/
📝Lumma Stealer: Analysing the delivery techniques and capabilities of a prolific infostealer
The blog post discusses Lumma Stealer, a data-stealing malware used by financially motivated threat actors. It can steal data from browsers and applications, including cryptocurrency wallets, and install other malware. It is distributed via phishing emails, malvertising and compromised websites.
Lumma Stealer evades detection by refining its techniques and rotating domains, exploiting ad networks, and using cloud services. Microsoft Threat Intelligence tracks its use by ransomware actors. Recommendations to mitigate this threat include strengthening Microsoft Defender for Endpoint and using phishing-resistant authentication.
📝TrailAlerts: Take Control of Cloud Detection in AWS
The author developed TrailAlerts, a serverless cloud-detection tool for AWS users that uses Sigma syntax for alerts.
Adan created TrailAlerts to tackle recurring AWS attacks and simplify the management of CloudWatch and EventBridge rules, giving teams greater control without the complexity of a SIEM.
TrailAlerts detects suspicious activities such as the creation of IAM users and simulates attacks using Stratus Red Team, focusing on cost-efficiency and the detection of IAM administrator persistence.
📌 Source: https://medium.com/@adan.alvarez/trailalerts-take-control-of-cloud-detection-in-aws-9e7761f49509