The Daily Index — Wednesday, August 23, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR Cybersecurity

TLDR Cybersecurity

IVANTI SENTRY EXPLOITED IN THE WILD, PATCHES EMITTED

Ivanti has disclosed the exploitation of a critical MobileIron/Ivanti Sentry gateway authentication bypass bug, CVE-2023-38035. The vulnerability allows the takeover of sensitive network components. It requires access to admin port 8443 and impacts unpatched Sentry v9.18 and earlier.

theregister.com · 4 min

TLDR Cybersecurity

OFFICENOTE APP

XLoader malware has re-emerged without Java dependencies, using native Objective-C/C code and signed as a fake "OfficeNote" productivity app. This post examines the new variant’s technical details and threat hunting indicators.

sentinelone.com · 8 min

TLDR Cybersecurity

HOW TO IDENTIFY WHEN YOU’VE LOST CONTROL OF YOUR SIEM

An article discussing how to reduce complexity in SIEM deployments. This article begins with some symptoms of an overly complex SIEM and then discusses helpful questions to try and reduce the complexity to more manageable levels and regain control of it.

expel.com · 7 min

TLDR Cybersecurity

UNMASKING EVLF DEV - THE CREATOR OF CYPHERRAT AND CRAXSRAT

The CYFIRMA research team has discovered a new Malware-as-a-service (MaaS) operator that goes by the moniker EVLF DEV. This threat actor is responsible for the development of CypherRAT and CraxsRAT, which in the last 3 years was purchased by over 100 distinct threat actors on a lifetime license. In this research report, they discuss the MaaS operator and the malware being developed by them.

cyfirma.com · 10 min

TLDR Cybersecurity

AUTOMATING PARTS OF ACTIVE DIRECTORY PENTESTS WITH BLOODHOUND CE

The latest BloodHound CE release brings useful enhancements, but the tool's Neo4j database also enables powerful custom queries to automatically find Active Directory weaknesses. This post demonstrates examples of querying the database directly or via API to uncover basic flaws and augment BloodHound's graph visualizations and attack path planning.

8com.de · 12 min

TLDR Cybersecurity

WHAT’S NEW FOR SECURITY IN KUBERNETES 1.28

Kubernetes version 1.28 is now available. In this version, Validating Admission Policy reaches beta status as a more complex and flexible admission controller than Pod Security Admission. This release also adds an authorization API for users to query data about themselves

securitylabs.datadoghq.com · 4 min

TLDR Cybersecurity

HACKER CONVERSATIONS WITH CRIS THOMAS (L0PHT HEAVY INDUSTRIES)

In this post, Cris Thomas (AKA Space Rogue) from L0pht Heavy Industries discusses the blurry boundary between researchers and hackers, with researchers being a subset of Whitehats. Thomas believes that researchers take a more formal approach to investigations, whereas hackers hack on stuff and experiment with things to see what breaks and what still works.

securityweek.com · 8 min

TLDR Cybersecurity

THE PHYSICAL IMPACT OF CYBER ATTACKS ON CITIES

Ransomware attacks on US local governments rose in 2022, highlighting risks as cities digitize. Hybrid attacks that start digital and eventually impact physical infrastructure will persist without preparation. Cities must find weaknesses, expect threats, and strategically communicate, both internally and externally, to ensure community resilience and recovery.

darkreading.com · 4 min

TLDR Cybersecurity

WHY US TECH GIANTS ARE THREATENING TO LEAVE THE UK

The UK has introduced several controversial proposals to try to rein in Big Tech. Some companies are saying there is a “tipping point” where they will leave the market instead of complying. The "tipping point" is upcoming UK regulations like the Online Safety Bill that is due to pass in the autumn.

bbc.com · 2 min

TLDR Cybersecurity

SAAS SECURITY POSTURE MANAGEMENT REPORT 2023

A new State of SaaS Security Posture Management Report from AppOmni indicates that Cybersecurity, IT, and business leaders alike recognize SaaS cybersecurity as an increasingly important part of the cyber threat landscape.

6705456.fs1.hubspotusercontent-na1.net · 10 min

TLDR Cybersecurity

VULNERABILITIES

Uptycs published its quarterly threat bulletin that notes a significant increase in the sophistication and complexity of threats faced by organizations globally. It also notes that in Q2 2023, rundll32.exe was the most abused utility for Windows malware. Crontab was the most abused in Linux, while OpenSSL and curl were prevalent in macOS.

uptycs.com · 1 min