The Daily Index — Wednesday, October 11, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

PHISHERS SPOOF USPS, 12 OTHER US NATL’ POSTAL SERVICES

There has been an increase in SMS phishing targeting USPS customers to steal personal and financial data. The scams spoof USPS and other postal services with landing pages impersonating their sites. They trick users to input address info and then request additional sensitive details. The attacks highlight the ongoing effectiveness of basic phishing page impersonation tactics. Users should be wary of unsolicited security messages and verify legitimacy before clicking.

krebsonsecurity.com · 7 min

TLDR InfoSec

GNOME LINUX SYSTEMS EXPOSED TO RCE VIA FILE DOWNLOADS

A memory corruption vulnerability in the cue sheet parsing library libcue can be used for 1-click RCEs on systems running the GNOME desktop environment. This is caused by Tracker Miners, which is included by default in GNOME, automatically indexing all downloaded files to update the search index on GNOME Linux systems. A proof of concept is provided in the article.

bleepingcomputer.com · 4 min

TLDR InfoSec

HOW AWS PROTECTS CUSTOMERS FROM DDOS EVENTS

A post from the AWS security team on how CloudFront automatically detected and mitigated a new form of DDoS. This DDoS attack is known as an HTTP/2 rapid reset attack. In this attack, an attacker issues multiple requests for streams and then issues a reset for each of those requests. This causes the server to waste resources generating logs even if nothing is returned to the clients.

aws.amazon.com · 3 min

TLDR InfoSec

HOW TO HANDLE SECRETS IN PYTHON

A blog post covering four different patterns for managing secrets in Python code. The post begins with more traditional methods such as utilizing a .env file, a secrets.json file, or environment variables before covering some newer approaches like leveraging a cloud secrets store or KMS.

blog.gitguardian.com · 8 min

TLDR InfoSec

AN OVERVIEW OF SOFTWARE SUPPLY CHAIN SECURITY

This is a two-part deep-dive into supply chain security and the various aspects involved. Part 1 provides an overview of three phases of the software supply chain: source, build and deployment, and package, and discusses the risks and processes for securing each stage. Part 2 is a comprehensive analysis of 12+ SSC vendors and their core differentiators within the software development lifecycle.

tldrsec.com · 21 min

TLDR InfoSec

Untitled entry

Gutsy comes out of stealth with an eye-watering $51M seed round, bringing a process-centric view to cybersecurity. They are following the steps of Celonis by working with organizations to understand how their different systems are interconnected, the events that are expected, and their outcomes through process mining applied to cybersecurity.

techcrunch.com · 3 min

TLDR InfoSec

HTTP/2 RAPID RESET: DECONSTRUCTING THE RECORD-BREAKING ATTACK

Cloudflare mitigated a 201 million RPS DDoS, nearly 3X of the previous record, and generated by only 20K bots. This shows the power of new attack methods as the entire web is about 1-3 billion RPS. This blog aims to highlight the growing DDoS threat for all kinds of networks and dive into the record-breaking attack.

blog.cloudflare.com · 15 min

TLDR InfoSec

INDUSTRY

A Secureworks study shows that ransomware dwell time - from initial access to deployment - in two-thirds of the cases analyzed had fallen to 24 hours, down from 4.5 days in 2022, and in 10%+ of cases, under 5 hours. This is consistent across variants and groups, highlighting the speed of modern attacks and how hard it is to react, as shorter dwell time doubles the overall extortion with data theft.

theregister.com · 4 min

TLDR InfoSec

Untitled entry

The UK’s Information Commissioner’s Office (ICO) has issued a preliminary enforcement notice to Snap over concerns over its My AI chatbot feature. The ICO reports that Snap did not adequately assess the privacy and data protection risks associated with its new generative AI chatbot. Snap will have the opportunity to respond to the ICO’s concerns before action is taken.

techcrunch.com · 6 min

TLDR InfoSec

GOOGLE EXPANDS BUG BOUNTY PROGRAM WITH CHROME AND CLOUD CTF EVENTS

Google is launching v8CTF, a CTF focused on V8, the JavaScript engine that powers Chrome. kvmCTF is an upcoming CTF focused on Kernel-based Virtual Machine (KVM) that will be released later in the year.

security.googleblog.com · 2 min

TLDR InfoSec

ACCOUNTS

Google is making passkeys the default option for personal accounts, providing a simpler and more secure way to sign into online accounts. Passkeys use fingerprints, face scans, or PINs and are 40% faster than passwords. Google is encouraging the industry to make the switch to passkeys and eventually make passwords obsolete.

blog.google · 2 min

TLDR InfoSec

CLOUDFLARE IS FREE OF CAPTCHAS

Cloudflare has been working to replace traditional CAPTCHAs that involve visual or audio puzzles with its modern CAPTCHAs.

blog.cloudflare.com · 7 min