The Daily Index — Friday, September 29, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

RUSSIAN ZERO-DAY SELLER OFFERS $20M FOR HACKING PHONES

Operation Zero, a Russian company specializing in buying and selling zero-day software exploits, has increased its payments for zero-day vulnerabilities in iPhones and Android devices from $200,000 to $20 million. While traditionally, bug bounty platforms inform vendors of vulnerabilities, companies like Operation Zero sell these vulnerabilities to governments, leading to a lucrative yet unregulated gray market where prices and customer identities remain opaque.

techcrunch.com · 2 min

TLDR InfoSec

PASSWORDS

A threat actor is using an alias of GitHub’s Dependabot feature to install password-stealing malware. By mimicking the Dependabot, which automatically scans projects for vulnerabilities, the attacker has convinced users to accept malicious commits.

itpro.com · 2 min

TLDR InfoSec

OKTA FOR RED TEAMERS

An article providing an overview of some Okta features that are useful for red teaming. The first portion of the article discusses features that allow running Okta with Active Directory environments and how to pivot between the two. The article also includes a discussion of using a fake SAML provider with Okta.

trustedsec.com · 10 min

TLDR InfoSec

MEET MADPOT, A THREAT INTELLIGENCE TOOL FROM AMAZON

MadPot is a large-scale honeypot network that Amazon runs to catch threats and gain threat intelligence which it shares publicly or with government agencies. MadPot intercepts over 100 million attempts per day and the insights can feed into AWS to bolster their threat detection and prevention offerings such as GuardDuty.

aboutamazon.com · 2 min

TLDR InfoSec

CISA LAUNCHES NATIONAL CAMPAIGN TO RAISE ONLINE SECURITY AWARENESS

The Cybersecurity and Infrastructure Security Agency has launched a nationwide cybersecurity campaign called "Secure Our World". The campaign is part of CISA's Cybersecurity Awareness Program, which aims to raise public awareness of cyber threats and online security.

executivegov.com · 1 min

TLDR InfoSec

PASSKEYS ARE GENERALLY AVAILABLE ON GITHUB

GitHub has made passkeys available to all users on its platform, following the successful beta launch in July.

github.blog · 4 min

TLDR InfoSec

THE MYSTERY OF THE CVES THAT ARE NOT VULNERABILITIES

An unknown party submitted a large number of backdated CVEs with high CVSS scores. The problem with this is that a researcher has found that many of these are just automatic submissions that are not actually vulnerabilities. This could cause issues when these CVEs are pulled in by systems that don’t check whether they are disputed.

malwarebytes.com · 2 min

TLDR InfoSec

SONY LAUNCHES INVESTIGATION AFTER POTENTIAL BREACH

A ransomware group named Ransomed.vc claims to have breached Sony's systems and has threatened to sell the stolen data. Although the claims remain unconfirmed, Cyber Security Connect reported that the group provided evidence such as screenshots of internal pages and Java files.

ign.com · 1 min

TLDR InfoSec

SECURITY RESEARCHERS HIGHLIGHT TWO POTENTIAL ICLOUD KEYCHAIN ISSUES

Potential iCloud Keychain issues have been identified by security researchers in iOS 17 and macOS Sonoma. The first problem is that the feature may automatically activate upon upgrading, even if it was previously turned off. The second issue is that if users disable iCloud Keychain, the data might not be deleted from Apple's servers, contrary to past practice.

9to5mac.com · 2 min

TLDR InfoSec

GOVERNMENT SHUTDOWN COULD BENCH 80% OF CISA STAFF

Roughly 80% of the staff at US cybersecurity agency CISA may be furloughed if a government shutdown occurs this week. While some personnel involved with cybersecurity operations are likely to be classified as essential and exempt from furlough, there will be fewer staff available for security monitoring and response.

securityweek.com · 2 min

TLDR InfoSec

MISCONFIGURED TESLAMATE INSTANCES PUT TESLA CAR OWNERS AT RISK

Misconfigured instances of third-party data logging application TeslaMate may potentially expose Tesla cars and their drivers to malicious attacks, according to IoT security intelligence firm Redinent. While TeslaMate is a useful tool for tracking car data, it poses a significant risk if not properly configured.

packetstormsecurity.com · 2 min