The Daily Index — Monday, October 2, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

JOHNSON CONTROLS INTERNATIONAL DISRUPTED BY MAJOR CYBERATTACK

Johnson Controls International this week reported in a filing with the US Securities and Exchange Commission that it had suffered a cyberattack that caused disruptions to its internal IT infrastructure. The attack was perpetrated by cybergang Dark Angels, who posted a ransom letter claiming the attack. It was done with ransomware that encrypted Johnson Controls’ VMware ESXi machines.

darkreading.com · 2 min

TLDR InfoSec

CRITICAL VULNERABILITIES IN WS_FTP SERVER

Progress Software posted a security advisory for several vulnerabilities affecting WS_FTP Server, a secure file transfer solution. Rapid7 has observed that these vulnerabilities are being actively exploited and provided details of the attack chains it has been seeing.

rapid7.com · 5 min

TLDR InfoSec

DEPENDENCY-TRACK

This article teaches readers how to store and analyze Software Bill of Materials with OWASP Dependency-Track to identify security vulnerabilities in open-source components. It covers how Dependency-Track can be deployed in a production environment and summarizes the pros and cons of the platform.

itnext.io · 8 min

TLDR InfoSec

NOSQL INJECTION EXPLOITATION TECHNIQUES & LABS

NoSQL injection is a vulnerability where hackers can interfere with queries to NoSQL databases. This can let them bypass authentication, steal or edit data, cause denial of service, or execute server code. NoSQL databases do not use SQL, instead favoring non-relational data formats that open up for injection risks through the lack of standards. This blog dives into the different NoSQL injection techniques and provides labs for readers to try to exploit them.

portswigger.net · 15 min

TLDR InfoSec

AUTOMATE LAMBDA CODE SIGNING WITH AWS CODECATALYST AND AWS SIGNER

Code Signing helps ensure the trust and security of deployed code using cryptographic signatures. This post from AWS walks through the process of configuring a CodeCatalyst CI/CD pipeline that uses AWS Signer to automatically sign deployed code.

aws.amazon.com · 6 min

TLDR InfoSec

ENCRYPTED CLIENT HELLO - THE LAST PUZZLE PIECE TO PRIVACY

Cloudflare has announced a new proposed standard called Encrypted Client Hello (ECH) that masks Server Name Indication (SNI), preventing networks from snooping on which websites a user is visiting. ECH is the last puzzle piece to privacy, and Cloudflare hopes that more providers will offer ECH, leading to a more private internet for everyone.

blog.cloudflare.com · 5 min

TLDR InfoSec

Untitled entry

Discern Security has raised $3M to use AI for cybersecurity. Many firms buy expensive tools but don't know how to use them properly. Discern's software maps infrastructure and tools, then makes recommendations to optimize configurations and get the most protection.

forbes.com · 4 min

TLDR InfoSec

SECURITY SWEEP

Palo Alto Networks is in talks to acquire Israeli cybersecurity startups Talon Cyber Security and Dig Security for around $1 billion in total. Talon protects distributed workforces with secure enterprise browsing. Dig secures data across public clouds. The deals would expand Palo Alto's security portfolio as demand grows.

techcrunch.com · 3 min

TLDR InfoSec

OF A SPANISH AEROSPACE COMPANY

ESET researchers uncovered a Lazarus cyberattack on a Spanish aerospace firm. Hackers posed as Meta recruiters on LinkedIn and sent coding challenges containing malware. Once inside the network, Lazarus deployed multiple tools including a new backdoor called LightlessCan. ESET analyzed the attack method and Lazarus' toolset through cooperation with the victim company.

welivesecurity.com · 10 min

TLDR InfoSec

VOLATILITY3: REMOTE ANALYSIS ON CLOUD OBJECT-STORAGE

Volatility3 is a memory forensic framework used for incident response. It recently added support for S3 object storage and released an in-depth blog post on how it was implemented.

forensicxlab.com · 8 min

TLDR InfoSec

WHO’S BEHIND THE 8BASE RANSOMWARE GROUP?

A Krebs on Security reader noted that the 8base ransomware group was leaking a significant amount of information on its public error pages. Brian Krebs used this information to trace the website to a 36-year-old Moldovan programmer. The programmer denied the connection.

krebsonsecurity.com · 5 min

TLDR InfoSec

FACIAL RECOGNITION TECHNOLOGY

A viral TikTok account has amassed a following by utilizing off-the-shelf facial recognition tools to dox random people. The account usually starts by choosing a victim from other viral videos or comments and then goes through the process of processing the image and doxing the person. TikTok has commented that the account does not violate their policies.

404media.co · 8 min

TLDR InfoSec

USING CLOUDFLARE TO BYPASS CLOUDFLARE

Cloudflare has a vulnerability where customer-configured protection mechanisms can be bypassed due to gaps in cross-tenant security controls, potentially exposing customers to attacks Cloudflare is supposed to prevent.

certitude.consulting · 5 min