The Daily Index — Wednesday, August 16, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR Cybersecurity

TLDR Cybersecurity

COLORADO WARNS 4 MILLION OF DATA STOLEN IN IBM MOVEIT BREACH

More than 4 million people had their sensitive medical and health information stolen after hackers exploited a zero-day vulnerability in the widely used MOVEit file transfer software.

bleepingcomputer.com · 3 min

TLDR Cybersecurity

Untitled entry

Canadian dental benefits administrator Alberta Dental Service Corporation (ADSC) has started informing roughly 1.47 million individuals about a ransomware attack discovered on July 9 in which their personal information was compromised. The ADSC stated that less than 7,300 records contained personal banking information.

securityweek.com · 3 min

TLDR Cybersecurity

HASHICORP VAULT MONITORING

A guide from HashiCorp on monitoring Vault at scale. It covers threats facing Vault, the various logs and data sources available, core metrics, and tips on monitoring and reporting.

hashicorp.com · 12 min

TLDR Cybersecurity

KNOCKING ON HELL'S GATE - EDR EVASION THROUGH DIRECT SYSCALLS

This educational post covers dynamic syscall ID extraction using Hell's Gate and C++ to build basic malware as a springboard for more advanced evasion. While open source tools provide some bypass potential, truly effective and subtle red team engagements require custom malware resilient to signature/behavioral detection. Mastering fundamentals like Hell's Gate lays the groundwork for advanced techniques.

labs.en1gma.co · 20 min

TLDR Cybersecurity

A PAIN IN THE NAS: EXPLOITING CLOUD CONNECTIVITY TO PWN YOUR NAS

Team82 deep dive into how it created a technique to impersonate NAS devices to redirect users to an attacker-controlled device, allowing attackers to access a user’s remote device, steal personal information, and access stored data.

claroty.com · 15 min

TLDR Cybersecurity

AWS LAUNCHES LOGICALLY AIR-GAPPED VAULT FOR BACKUP

AWS Backup is a feature for backing up and isolating data in the event of a ransomware attack. It allows for a further level of data isolation. This announcement post includes details of how the capability works and how to use it.

aws.amazon.com · 4 min

TLDR Cybersecurity

ILLINOIS MAKES IT POSSIBLE TO SUE FOR DOXXING

Illinois has just unanimously passed the Civil Liability for Doxing Act. This law will allow for victims of doxxing recover damages and request a temporary restraining order from their attackers.

arstechnica.com · 4 min

TLDR Cybersecurity

THREAT ACTORS USE BETA APPS TO BYPASS MOBILE APP STORE SECURITY

Cybercriminals are using maliciously crafted cryptocurrency investment apps as beta versions to steal cryptocurrency from mobile app stores. The malicious apps are submitted as betas, which are not subjected to a thorough code review process and are only superficially examined for safety. The FBI warns that the apps can be used to steal personally identifiable information, financial account access, and take over devices.

bleepingcomputer.com · 2 min

TLDR Cybersecurity

ADAPT

The current economic downturn has affected CISOs. 54% of cybersecurity budgets have been frozen or reduced. Startups have opportunities through cost/customization advantages, though vendors overall need to offer flexibility like free trials. Even in times of financial restraint, cyber remains a priority, and smart vendors can creatively align to needs.

techcrunch.com · 6 min

TLDR Cybersecurity

AWS NLBS NOW SUPPORT SECURITY GROUPS

AWS Network Load Balancers (NLBs) allow for load balancing arbitrary traffic in AWS. With this new update, security groups can be applied to NLBs. This allows for more advanced NLB filtering.

aws.amazon.com · 1 min

TLDR Cybersecurity

HACKING ATMS

Synack Red Team has discovered that French company Iagona's ScrutisWeb ATM monitoring software has several vulnerabilities that could be exploited by hackers to remotely hack ATMs, including check deposit machines and payment terminals. The flaws were patched by the vendor in July 2023 with the release of ScrutisWeb version 2.1.38. The vulnerabilities include path traversal, authorization bypass, hard coded cryptographic key, and arbitrary file upload issues that can be exploited by remote, unauthenticated attackers.

packetstormsecurity.com · 2 min