The Daily Index — Monday, October 9, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CYBERATTACK

MGM Resorts has confirmed hackers stole an unspecified amount of customers’ personal information during a September cyberattack that will cost the hotel and casino giant an estimated $100 million. MGM has seen no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud yet.

techcrunch.com · 3 min

TLDR InfoSec

LATERAL MOVEMENT

Microsoft security researchers recently identified a campaign where attackers attempted to move laterally to a cloud environment through a SQL Server instance. In this blog post, Microsoft elaborates on the attack flow and focuses on the main technique that was observed: SQL Server to cloud lateral movement. It also shows how to detect this type of threat and help mitigate such attacks.

microsoft.com · 13 min

TLDR InfoSec

FROM BAD TO WORSE: HOW DUAL RANSOMWARE AMPLIFIES CYBER THREATS

Dual Ransomware, a sinister dance of encryption and exfiltration, doesn’t just lock you out: it takes your secrets and threatens to spill them into the boundless abyss of the dark web. Your data, once merely shackled, is now a pawn in a high-stakes game of cyber blackmail and espionage. This blog post goes through the history of dual ransomware, how it works, and real life examples.

ensarseker1.medium.com · 10 min

TLDR InfoSec

MULTI CLOUD WORKLOADS

A tutorial from AWS on how to utilize Secrets Manager in on-prem and multi-cloud workloads utilizing IAM Roles Anywhere. It includes example use cases and works through a sample application.

aws.amazon.com · 12 min

TLDR InfoSec

GITHUB IMPROVES SECRETS SCANNING WITH EXPANDED TOKEN VALIDITY

GitHub introduced secrets scanning in early 2023 and since then added validity checks to the secrets scanning feature. It just announced that validity checks have been expanded to include AWS, Google, Microsoft, and Slack tokens.

securityweek.com · 2 min

TLDR InfoSec

RANSOMWARE GANG QAKBOT RESURFACES AFTER FEDS’ BOTNET TAKEDOWN

The Qakbot malware gang has been staging cyberattacks with Ransom Knight ransomware and the Remcos backdoor via phishing emails, according to Cisco Talos. Despite authorities seizing the gang's infrastructure and financial assets, key members of the group have likely regrouped and continued committing cybercrimes.

scmagazine.com · 2 min

TLDR InfoSec

MISCONFIGURATIONS

The ten most common network misconfigurations, the two agencies say, include default software configurations, improper separation of privileges, lack of network segmentation, insufficient network monitoring, poor patch management, bypass of access controls, poor credential hygiene, improper multi-factor authentication (MFA) methods, insufficient access control lists (ACLs) on network shares, and unrestricted code execution.

cisa.gov · 20 min

TLDR InfoSec

THE GREAT ZELLE POOL SCAM

An investigation into how scammers utilize Zelle to trick unsuspecting customers into scams. The investigation is told as a story wherein the protagonist was scammed by a Business Email Compromise into sending $31,500 via Zelle.

businessinsider.com · 22 min

TLDR InfoSec

90S VULNS IN 90S SOFTWARE (EXIM) - IS THE SKY FALLING?

ZDI has gone public with no less than six 0days in the popular mail server Exim. Ranging from ‘potentially world-ending' through to ‘a bit of a damp squib’, these bugs were apparently discovered way back in June 2022 (!) - but they were published last week.

labs.watchtowr.com · 8 min

TLDR InfoSec

AWS WILL REQUIRE MFA FOR ROOT USER CONSOLE ACCESS

AWS announced that as of mid 2024, users signing into the AWS management console with root user accounts will be required to use MFA. AWS will communicate this to affected customers through multiple channels. There are plans to expand the MFA requirements but no concrete timelines.

siliconangle.com · 1 min

TLDR InfoSec

WORKERS

The Modernizing the Acquisition of Cybersecurity Experts Act (MACE Act) aims to address shortages in cybersecurity positions by expanding the pool of eligible applicants. Under the legislation, agencies would only be allowed to consider an applicant’s education if it directly reflects the competencies required for the position. The bill will now move to the Senate for consideration.

fedscoop.com · 2 min