The Daily Index — Friday, August 25, 2023

ATTACKS & VULNERABILITIES

TLDR Cybersecurity

AWS-TARGETING CRED STEALER EXPANDS TO AZURE, GCP

Cloud credentials stealing campaigns continue to grow. Cloud service credentials are increasingly targeted because teams are finding more ways to profit from them. One actor has expanded its tooling from AWS to target Azure and Google Cloud Platform. This report dives into how the tooling interacts with the cloud providers and what is new with the latest version.

sentinelone.com · 8 min

TLDR Cybersecurity

WI-FI EVERY MINUTE

Secureworks researchers witnessed the Smoke Loader botnet dropping a custom Wi-Fi scanning executable to infected systems. The researchers named the malware ‘Whiffy Recon’. It triangulates infected systems' positions using nearby Wi-Fi access points and Google's geolocation API.

secureworks.com · 6 min

TLDR Cybersecurity

FROSTY TRAILS: THREAT-HUNTING FOR IDENTITY THREATS IN SNOWFLAKE

rezonate.io · 16 min

TLDR Cybersecurity

Untitled entry

BitLocker's protection depends on its configuration, so with a discrete Trusted Platform Module and no password, the BitLocker decryption gets bound to the hardware. This article navigates through how to use physical hacking to obtain the decryption key and hack into a BitLocker-protected computer.

errno.fr · 12 min

TLDR Cybersecurity

STRATEGIES FOR FINDING SSRF VULNERABILITIES IN BUG BOUNTIES

This X thread shares strategies for finding Server Side Request Forgery (SSRF) attacks for bug bounties. These include trying different URL schemes, stealing NT LAN Manager hashes with Responder, trying alternative representations of IP addresses, and searching for references to Kubernetes and hitting its API. The author of the thread suggests being aware of a target's technologies and using open redirects to find SSRF vulnerabilities.

twitter.com · 2 min

TLDR Cybersecurity

GOOGLE WORKSPACE ANNOUNCES NEW ANTI-PHISHING CONTROLS

Google Workspace has announced 11 new defensive controls to protect against social engineering attacks. Multi-party approval will require sensitive enterprise actions to be approved by a separate admin than the one that initiated the change. Other features include DLP, AI, and logging support.

zdnet.com · 3 min

TLDR Cybersecurity

IAMBIC

IAMbic is designed to be a version control system for IAM systems. IAMbic monitors IAM sources for any changes and makes a commit to a git repository containing the details of the change. At present, AWS, Azure AD, Google Workspace, and Okta are supported.

noq.dev · 1 min

TLDR Cybersecurity

BOTS ARE BETTER AND FASTER AT SOLVING CAPTCHAS THAN HUMANS

Bots can solve captchas nearly instantly and with high accuracy. In a recent study, humans solved captchas with a 50-84% accuracy, taking between 9-15 seconds, while bots had an accuracy rate of 85-100% and solved captchas in less than a second.

sciencetimes.com · 2 min

TLDR Cybersecurity

TORNADO CASH CRYPTO MIXER DEVS CHARGED WITH MONEY LAUNDERING

US prosecutors have charged two of the developers of the crypto mixer, Tornado Cash, with money laundering. The prosecutors allege that Roman Semenov and Roman Storm facilitated the anonymization of hacked funds on the platform while knowing that the funds were stolen.

packetstormsecurity.com · 3 min

TLDR Cybersecurity

FBI: PATCHES FOR RECENT BARRACUDA ESG ZERO-DAY INEFFECTIVE

The FBI has warned that the patches Barracuda recently released for an Email Security Gateway (ESG) vulnerability were not effective and that the flaw is still being targeted in the wild. It is advising organizations to remove all affected ESG appliances immediately and scan their networks for abnormal activity.

securityweek.com · 2 min

TLDR Cybersecurity

DEFAULT BEHAVIOR STICKS

This blog post describes an instance where 40% of their users directly copied an example domain from their documentation when setting up custom DNS zones as well as other places where examples were given in documentation. This can lead to more easily identifiable canaries. The post concludes with lessons learned about the dangers of defaults and examples.

blog.thinkst.com · 2 min

TLDR Cybersecurity

HACKERS

The FBI published 6 cryptocurrency wallets linked to North Korean hackers, holding ~$40M+ in likely stolen funds. The cryptocurrency was stolen by the Democratic People’s Republic of Korea's TraderTraitor-affiliated actors (also known as the Lazarus Group and APT38).

securityweek.com · 2 min

TLDR Cybersecurity

MALWARE FOOTPRINT

Microsoft has discovered a Chinese government-backed APT actor called Flax Typhoon that targets Taiwanese organizations with minimal malware use and stealthily persists by exploiting legitimate software tools. Flax Typhoon uses known vulnerabilities in public-facing servers and legitimate tools built into the Windows operating system to quietly remain in these networks, making it challenging to detect and mitigate the attack.

securityweek.com · 3 min