The Daily Index — Monday, September 11, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SPYWARE

Several malicious Telegram clones for Android on Google Play were installed over 60,000 times, infecting people with spyware that steals user messages, contact lists, and other data.

bleepingcomputer.com · 2 min

TLDR InfoSec

DEVICES

Advanced Persistent threat actors were found to have exploited two vulnerabilities, CVE-2022-47966 (Zoho Suite) and CVE-2022-42475 (FortiOS devices), to gain unauthorized access and establish persistence on an organization's network. The Cybersecurity and Infrastructure Security Agency and co-sealers have released a joint Cybersecurity Advisory to provide network defenders with tactics, techniques, and procedures, IOCs, and methods to detect and protect against similar exploitation.

cisa.gov · 20 min

TLDR InfoSec

7 WAYS TO ESCAPE A CONTAINER

A blog post containing 7 different techniques that an attacker could use to escape from a container boundary. Each technique includes a list of required Linux capabilities for the attack, a description of the attack, an example command to launch a vulnerable container, and an example command to escape the container.

panoptica.app · 10 min

TLDR InfoSec

WORKFLOWS

The recommended method for pinning GitHub Actions per GitHub is to pin the action to a full commit hash which causes the tarball of the action to be downloaded. However, some actions can still be exploited through supply chain attacks if they depend upon unpinned external dependencies (docker containers, other actions, etc). A total of 32% of the top started actions were deemed unpinnable. This article concludes with advice to mitigate unpinnable action attacks

paloaltonetworks.com · 10 min

TLDR InfoSec

CODE VULNERABILITIES PUT PROTONMAIL AT RISK

A blog post from the Sonar research team detailing their findings in Proton Mail. The post includes an in-depth breakdown of the vulnerability that they discovered and the patch that was issued.

sonarsource.com · 12 min

TLDR InfoSec

US CYBER BOARD TO INVESTIGATE MICROSOFT HACK OF GOVERNMENT EMAILS

A U.S. review board tasked with investigating major cybersecurity incidents said it will begin looking at the recent intrusion of U.S. government email systems provided by Microsoft, whose handling of the incident drew ire and scrutiny from federal lawmakers and the wider security community.

techcrunch.com · 2 min

TLDR InfoSec

TWO REAL-LIFE EXAMPLES OF WHY LIMITING PERMISSIONS WORKS

A blog post from the AWS Customer Incident Response Team detailing two cases that they worked on. In both of these cases, real-world examples of least privilege are given in actual customer environments.

aws.amazon.com · 6 min

TLDR InfoSec

CLOUD DETECTION AND RESPONSE NEEDS TO BREAK DOWN BOUNDARIES

A post that partially leverages the Crowdstrike “Nowhere to Hide” threat hunting report to analyze the current state of cloud detection and response. It notes that many modern attacks and breaches leverage credentials to pivot between systems (such as IDPs, cloud environments, and CI/CD environments). However, most tooling is siloed to a specific environment. The post argues that tooling needs to adapt to these more complex environments and provides advice for teams.

permiso.io · 5 min

TLDR InfoSec

WEEK?

The University of Michigan was without internet for a large part of last week. CTO of SensCy Dave Kelly said that proactively taking down systems pointed to a security breach. Some sources said that the university found malware in its WiFi network.

cbsnews.com · 1 min

TLDR InfoSec

VITALIK BUTERIN’S X ACCOUNT HACKED, LEADING TO $691K IN LOSSES

Vitalik Buterin, Ethereum’s co-founder, allegedly had his X account compromised. According to prominent blockchain investigator ZachXBT, the incident has led to victims collectively losing over $691,000 after clicking on a malicious link.

cointelegraph.com · 2 min

TLDR InfoSec

THE INTERNATIONAL CRIMINAL COURT WILL NOW PROSECUTE CYBERWAR CRIMES

The International Criminal Court's lead prosecutor, Karim Khan, has announced that the Hague will investigate and prosecute cybercrimes that potentially violate the Rome Statute, including war crimes, crimes against humanity, and genocide. The ICC will collect and review evidence of hacking that impacts critical infrastructure such as medical facilities or control systems for power generation.

arstechnica.com · 3 min