The Daily Index — Friday, September 22, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

38TB OF DATA ACCIDENTALLY EXPOSED BY MICROSOFT AI RESEARCHERS

Microsoft researchers posted a link with a misconfigured Azure SAS token that granted access to the full storage account as opposed to just the intended dataset while publishing an open-source dataset on GitHub. The 38TB of accidentally-exposed data includes full backups of two employee workstations as well as secrets, private keys, and internal messages.

wiz.io · 10 min

TLDR InfoSec

MORE VULNERABLE

Apple has released security patches to address three zero-day flaws that were actively exploited in iOS, iPadOS, macOS, watchOS, and Safari. This brings the total number of zero-day bugs discovered in Apple's software this year to 16. The flaws include a certificate validation issue in the Security framework, a security flaw in Kernel, and a WebKit flaw that could result in arbitrary code execution.

thehackernews.com · 2 min

TLDR InfoSec

NEW WAYS TO INJECT SYSTEM CA CERTIFICATES IN ANDROID 14

The discussion around Android 14's CA certificate controls has sparked solutions going beyond previous root approaches. While directly writing certs is blocked, root access still enables control by digging into internals. Feedback has produced promising options to regain system-level CA management practically on the latest Android versions.

httptoolkit.com · 10 min

TLDR InfoSec

DEPLOYING AWS BACKUP

A blog post that begins with an overview of what cloud ransomware attacks look like and then an overview of AWS Backup. The post then continues to offer advice for deploying AWS Backup at scale using AWS Organizations. It includes terraform code to aid in deployment.

primeharbor.com · 6 min

TLDR InfoSec

A BIG LOOK AT SECURITY IN OPENAPI

This blog post discusses security options in OpenAPI and what companies are doing regarding API security. Large companies like Facebook and Github use OAuth2 for API security. The post recommends using OAuth2 for authentication, but acknowledges that it can be complex. API keys are still commonly used for security in smaller APIs. Basic authentication is not recommended due to its lack of security.

liblab.com · 9 min

TLDR InfoSec

CISCO TO ACQUIRE SPLUNK IN $28B MEGA DEAL

The biggest enterprise software deal of the year to date goes to Cisco for acquiring the observability behemoth Splunk in a $28B deal, paying a premium of $157 per share on the average of $80 or $90 per share Splunk has had this year.

techcrunch.com · 3 min

TLDR InfoSec

1PASSWORD ROLLS OUT PUBLIC PASSKEY SUPPORT

1Password has completed testing for its passkey support. Users can now create, manage, and sign in with passkeys via 1Password mobile apps and web extensions. Passkeys are a new login technology that is meant to replace passwords. 1Password has not enabled the ability to replace a master password with a passkey but teases that the feature is coming later in the fall.

theverge.com · 2 min

TLDR InfoSec

LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD

This blog post dives into the group LUCR-3. LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875. It is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing intellectual property for extortion. LUCR-3 targets Fortune 2000 companies across various sectors, including but not limited to software, retail, hospitality, manufacturing, and telecom.

permiso.io · 15 min

TLDR InfoSec

PIZZA

Pizza Hut Australia says 190,000 customers' info – including names, delivery addresses, email addresses, phone numbers, and order information – have been accessed. It told customers it learned of the incident in early September and described it as "unauthorized third party" access to a subset of its data.

theregister.com · 5 min

TLDR InfoSec

T-MOBILE APP EXPOSES OTHER USERS’ ACCOUNT DETAILS

T-Mobile customers on X and Reddit reported that they were able to see other accounts’ information in the T-Mobile app. T-Mobile has fixed the issue. The issue was caused by a technology update glitch and was not a cyberattack.

theverge.com · 2 min

TLDR InfoSec

POLAND INVESTIGATES OPENAI OVER PRIVACY CONCERNS

Poland's watchdog is investigating whether ChatGPT breaches EU GDPR data laws, adding to privacy lawsuits OpenAI already faces in the US. The lack of clarity around how the chatbot handles and secures user data is drawing growing regulatory scrutiny.

reuters.com · 3 min

TLDR InfoSec

SERVICES

AWS IAM has added Action Last Accessed support to over 140 services. Action Last Accessed allows admins to see when an IAM identity last accessed an action, which can aid in finding over-privileged identities.

aws.amazon.com · 1 min

TLDR InfoSec

MARVELL DISPUTES CLAIM CAVIUM BACKDOORED CHIPS FOR UNCLE SAM

Marvell has denied allegations that its subsidiary, Cavium, backdoored chips for US intelligence. Documents leaked by Edward Snowden in 2013 identified Cavium as a vendor of semiconductors backdoored for US intelligence. The allegations surfaced again in Jacob Appelbaum's PhD thesis, which was published in March 2022.

packetstormsecurity.com · 5 min