The Daily Index — Monday, August 28, 2023

ATTACKS & VULNERABILITIES

TLDR Cybersecurity

MOVEIT, THE BIGGEST HACK OF THE YEAR, BY THE NUMBERS

The mass exploitation of MOVEit's Transfer software has rapidly cemented itself as the largest hack of the year so far. While the full impact of the attack will likely remain unknown for months to come, there are now more than 1,000 known victims of the MOVEit breach, according to cybersecurity company Emsisoft. This report looks into the MOVEit attack by the numbers.

techcrunch.com · 6 min

TLDR Cybersecurity

DUOLINGO DATA LEAK POSTED ON HACKING FORUM

Duolingo suffered a data breach when a public API endpoint leaked non-public profile information such as email addresses. The dataset was released on BreachForums for the equivalent of $2.13.

bleepingcomputer.com · 2 min

TLDR Cybersecurity

NVME: NEW VULNERABILITIES MADE EASY

This blog post showcases how researchers at CyberArk used Static Code Analysis tools to find a Pre-Auth Remote DoS vulnerability (CVE-2023-0122) caused by a NULL Pointer Dereference in the NVMe driver of the Linux kernel.

cyberark.com · 15 min

TLDR Cybersecurity

BYPASS TWO-FACTOR AUTHENTICATION OF FACEBOOK ACCOUNTS ($25,300)

This write-up explains how Facebook's Two-Factor Authentication was bypassed during Meta’s bug bounty Researchers conference in Seoul, South Korea, in 2023. The author was awarded $25,300 and ranked 2nd place on the conference Leaderboard.

medium.com · 6 min

TLDR Cybersecurity

METHODS TO BACKDOOR AN AWS ACCOUNT

An exploration of the different AWS mechanisms that an attacker that has gained privileged access to an AWS account can use to establish persistence. This is part three of a series - the previous two parts focus on escalating privileges on a compromised AWS account.

mystic0x1.github.io · 14 min

TLDR Cybersecurity

APPLICATION

Cerby has received capital to secure non-standard applications. Research has found that 52% of organizations have experienced cybersecurity incidents caused by their inability to secure these kinds of applications. Applications are defined as nonstandard if they do not support common identity and security standards such as SAML and SCIM.

cerby.com · 4 min

TLDR Cybersecurity

LANDSCAPES

This document is a comprehensive overview of modern cybersecurity. It discusses the various threats that exist in the digital realm, such as ransomware, phishing, and various forms of social engineering. It also explores the role of nation-states in cyber warfare and the importance of fortifying one's digital stronghold. The document emphasizes the ongoing nature of cybersecurity and the need for vigilance and continuous learning.

hackread.com · 5 min

TLDR Cybersecurity

BROWSER EXTENSION RISK REPORT: HIGH RISKS FOR SAAS DATA

Researchers at Spin.AI assessed 300,000 Chromium browser extensions and found that 51% of all installed extensions were high risk and had the potential to cause extensive damage to the organizations using them. The extensions all had the ability to capture sensitive data from enterprise apps, run malicious JavaScript, and surreptitiously send protected data, including banking details and login credentials, to external parties.

spin.ai · 8 min

TLDR Cybersecurity

LAPSUS$: COURT FINDS TEENAGERS CARRIED OUT HACKING SPREE

An 18-year-old from Oxford has been found guilty of being a part of an international cyber-crime gang responsible for a hacking spree against major tech firms such as Uber, Nvidia, and Rockstar Games.

bbc.co.uk · 2 min

TLDR Cybersecurity

EXPANDING TESTING FOR END-TO-END ENCRYPTION ON FACEBOOK MESSENGER

Meta has once again reaffirmed its plans to roll out support for end-to-end encryption by default for one-to-one chats on Messenger by the end of the year.

messengernews.fb.com · 3 min

TLDR Cybersecurity

MICROSOFT SIGNING KEYS KEEP GETTING HIJACKED

Microsoft’s digital keys have been hijacked to sign yet more malware for use by a previously unknown threat actor in a supply-chain attack that infected roughly 100 carefully selected victims.

arstechnica.com · 4 min

TLDR Cybersecurity

CRYPTO STARTUP BANKRUPT AFTER LOSING PASSWORD TO WALLET

Prime Trust is a crypto startup designed to help other startups provide crypto retirement funds. It had to file for bankruptcy after losing the password to a physical crypto wallet with $38.9 million in it.

404media.co · 2 min

TLDR Cybersecurity

RISKS IN AWS SSM PORT FORWARDING

AWS Systems Manager Session Manager (SSM) allows for IAM users to access EC2 instances. One common use case for this is port forwarding to other services such as RDS. The SSM-SessionManagerRunShell document may be implicitly granted to the user. This article details how to fix this.

ramimac.me · 4 min