The Daily Index — Friday, September 15, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

SAVE THE CHILDREN HIT BY RANSOMWARE

Cybercrime crew BianLian says it has broken into the IT systems of top nonprofit Save The Children and stolen a ton of files, including what they claim is financial, health, and medical data.

theregister.com · 2 min

TLDR InfoSec

MICROSOFT TEAMS USED TO PUSH DARKGATE MALWARE

A new phishing campaign is sending malicious attachments that install the DarkGate malware loader via Microsoft Teams. The article contains more details about the obfuscation and detection evasion mechanisms that the malware uses.

bleepingcomputer.com · 2 min

TLDR InfoSec

ENFORCING DNS NAME CONSTRAINTS IN AWS PRIVATE CA

A very thorough tutorial on the unintuitive process to enforce DNS name constraints in an AWS private CA. The post includes sample code and tests to verify the constraints.

aws.amazon.com · 5 min

TLDR InfoSec

FINDING A COMMAND INJECTION VULNERABILITY IN KUBERNETES

Akamai details the newly released CVE-2023-3676 which is a command injection vulnerability in Kubernetes on Windows hosts. This article details the vulnerability and provides a proof-of-concept YAML file, a method to check if you’re vulnerable, and an OPA rule to block the vulnerability.

akamai.com · 5 min

TLDR InfoSec

HOW TO SECURELY BUILD PRODUCT FEATURES USING AI APIS

This article comprehensively discusses the risks associated with building product features using third-party Large Language Model APIs and offers controls available to mitigate these risks. The article also suggests traditional governance, risk, and compliance controls, as well as provides a lot of reference material on the topic.

tldrsec.com · 12 min

TLDR InfoSec

WINDOWS 11 ADDS NEW FEATURE TO BLOCK NTLM OVER SMB

NTLM over SMB is commonly used when attacking Windows domains in attacks such as pass-the-hash or password cracking. In a new update, Windows 11 will allow administrators to block NTLM responses over SMB to prevent hashes being leaked to external servers. Previously, the only way to achieve this was to disable NTLM completely

bleepingcomputer.com · 3 min

TLDR InfoSec

CYBERCATCH LAUNCHES AI-ENABLED COMPLIANCE SOLUTION FOR NEW SEC CYBERSECURITY INCIDENT REPORTING AND RISK MANAGEMENT RULE

CyberCatch has launched an SEC Compliance Manager solution to enable compliance with the SEC's new Cybersecurity Incident Reporting and Risk Management Rule. The new rule mandates reporting and disclosure of a material cybersecurity incident within four business days and disclosure of cybersecurity risk management, strategy, and governance, including board oversight over cybersecurity risk management.

prnewswire.com · 2 min

TLDR InfoSec

CISA RELEASES ITS OPEN SOURCE SOFTWARE SECURITY ROADMAP

CISA has released a roadmap outlining its Open Source Security strategy. The roadmap outlines what CISA’s role is in the space, how CISA plans to outline key dependencies, and how CISA plans to reduce risk to the government and consumers.

cisa.gov · 1 min

TLDR InfoSec

A CRITICAL WEBP BUG HAS BEEN UNEARTHED

A significant vulnerability in the WebP Codec affecting the heap buffer overflow has been unearthed, prompting major browser vendors, including Google and Mozilla, to expedite the release of updates to address the issue.

stackdiary.com · 2 min

TLDR InfoSec

CODE VULNERABILITIES PUT SKIFF EMAILS AT RISK

The Sonar Research team discovered and responsibly disclosed code vulnerabilities in Skiff's web client that would allow attackers to steal decrypted emails and impersonate victims if they interacted with malicious messages. This article provides technical details of the vulnerabilities found and advice on how to avoid such vulnerabilities in code.

sonarsource.com · 8 min

TLDR InfoSec

WHEN MFA ISN’T ACTUALLY MFA

Retool faced an unauthorized access issue involving 27 cloud customers due to a spear-phishing attack via text message. The breach started with an employee's compromised Google account, underscoring the need for employee training and strong defense measures.

retool.com · 6 min

TLDR InfoSec

RESORTS

The ALPHV/BlackCat ransomware group took responsibility for the MGM Resorts cyber outage on Tuesday, claiming that the conversation that granted initial access took just 10 minutes.

engadget.com · 1 min

TLDR InfoSec

IS NO SOFTWARE SAFE FROM 0-DAYS?

With an unprecedented 70 zero-day vulnerabilities uncovered so far in 2023, apps are being patched at a rapid rate. Apple, Microsoft, Google, Mozilla, Adobe, and Cisco have all been affected, and this month the number of zero-days tracked has been considerably higher than the monthly average.

arstechnica.com · 2 min