The Daily Index — Friday, October 6, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

GLIBC’S LD.SO

Qualys discovered a glibc dynamic loader vulnerability that enables a local privilege escalation that grants full root privileges on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13. It is recommended to update as soon as possible as it is a critical vulnerability.

blog.qualys.com · 5 min

TLDR InfoSec

HIGH SEVERITY VULNERABILITY FOUND IN LIBCURL AND CURL

The maintainer of the curl project posted an update that a security issue is “probably the worst security problem found in curl in a long time.” The patched version will be released on October 11 along with details of the CVEs.

snyk.io · 4 min

TLDR InfoSec

THE EVOLUTIONARY TALE OF A PERSISTENT PYTHON THREAT

The Checkmarx Software Supply Chain Security team has been tracking a threat actor that has been publishing malicious Python packages since April. The team has broken down the ways that the threat actor has gradually evolved their techniques from using plaintext payloads, to encrypting malicious functionality, and finally layers of obfuscation and evasion.

checkmarx.com · 7 min

TLDR InfoSec

BYPASSING BING CHAT’S GUARDRAILS TO SOLVE CAPTCHAS

Bing Chat is a public implementation of the GPT-4 LLM and includes guardrails to prevent certain forms of malicious usage. One user demonstrated that Bing Chat successfully detected that it was being asked to solve a CAPTCHA and refused when it was just prompted with a picture of the text. However, the same user showed that if they edited the CAPTCHA onto a picture of a locket and presented a context of it belonging to their dead grandmother, Bing Chat would transcribe the CAPTCHA.

arstechnica.com · 3 min

TLDR InfoSec

ANALYZING & PATCHING A DLL REVERSE SHELL

The document describes the process of analyzing and patching a DLL reverse shell. The author starts by conducting initial triage with VirusTotal and Shodan and follows up with analyzing the files to find the IP address and patching to a local VM to get the shell to the host.

archcloudlabs.com · 4 min

TLDR InfoSec

GEM SECURITY RAISES $23M FOR ITS CLOUD SECURITY PLATFORM

Cloud detection and response company Gem Security has raised a $23 million Series A round led by GGV Capital with participation from IBM Ventures and Silicon Valley CISO Investments. This comes after its February $11 million seed round led by Team8, which also participated in this new round.

techcrunch.com · 3 min

TLDR InfoSec

KUBEHOUND

Kubehound is a tool from DataDog that is inspired by the popular Active Directory tool BloodHound. KubeHound can build graphs of Kubernetes clusters and visualize common attack paths. This article contains a tutorial with some example use cases and queries.

securitylabs.datadoghq.com · 15 min

TLDR InfoSec

CENTER AND SERVER

Atlassian has released fixes to contain an actively exploited critical zero-day flaw impacting publicly accessible Confluence Data Center and Server instances. The vulnerability, tracked as CVE-2023-22515, is remotely exploitable and allows external attackers to create unauthorized Confluence administrator accounts and access Confluence servers.

confluence.atlassian.com · 3 min

TLDR InfoSec

ABOUT IT

Malwarebytes has released a new report that underscores how the online behaviors of consumers are often at odds with ensuring safety and privacy. Seventy percent of surveyed respondents experienced some kind of cybersecurity threat such as online scams and viruses or malware and roughly one tenth have experienced serious personal violations like stalkerware/spyware and ransomware.

malwarebytes.com · 15 min

TLDR InfoSec

FILES (LNK) AND VIRTUAL HARD DISK FILES (VHD)

This blog post discusses the importance of investigating file types that are often overlooked in threat actor campaigns. It dives into the world of Shell Link files (LNK) and Virtual Hard Disk files (VHD) and explains how Rapid7 is releasing a new feature in Velociraptor that can parse LNK files.

rapid7.com · 7 min

TLDR InfoSec

STATE OF DEVOPS REPORT 2023

Google brings back their yearly state of DevOps report where they go into depth of the maturity of companies in their adoption of DevOps. Some of the key takeaways this year include the importance of company culture, collaboration, documentation, and being customer-centric.

services.google.com · 30 min

TLDR InfoSec

GOOGLE AND YAHOO WILL CRACK DOWN ON SPAM

Yahoo announced that bulk senders will now need to implement more robust email authentication as well as comply with unsubscribe requests within two days. Google posted a similar announcement stating that bulk senders (>5000 messages per day) must implement more robust authentication, comply with unsubscribe requests within two days, and comply with a spam rate threshold.

therecord.media · 2 min

TLDR InfoSec

SAFE, SECURE, ANONYMOUS, AND OTHER MISLEADING CLAIMS

This article deconstructs the idea of online anonymity. It argues that even anonymous services tend to collect personally identifiable information that’s just waiting for a breach to expose it.

troyhunt.com · 3 min