The Daily Index — Monday, October 30, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

IPHONES HAVE BEEN EXPOSING YOUR UNIQUE MAC

Apple introduced a feature in iOS 14 that claimed to display a unique, private MAC address for each SSID an iPhone connected to. Two security researchers discovered that this feature doesn’t work on iOS 17.1. They then tested all versions of the feature since it was released and learned that it had never worked. The researchers discovered that the iPhone would send the private MAC address in the source field in multicast messages upon joining a network but the real MAC address would still be sent in a different field.

arstechnica.com · 3 min

TLDR InfoSec

CITRIX WARNS ADMINS TO PATCH CITRIX BLEED

Citrix warns all admins of Netscaler ADC and Gateway appliances to immediately secure their systems from an actively exploited vulnerability dubbed Citrix Bleed (CVE-2023-4966). The 9.4 vulnerability allows unauthenticated attackers to launch a low complexity attack to remotely disclose session tokens and hijack authenticated sessions with no user interaction. This article includes commands to kill all sessions and details of the patched versions.

bleepingcomputer.com · 3 min

TLDR InfoSec

TURNING A BORING FILE MOVE INTO A PRIVILEGE ESCALATION ON MAC

This little blog post walks through how you can turn a simple script that moves folders or files into a privilege escalation on a Mac.

pwn.win · 4 min

TLDR InfoSec

XSS ON THE OAUTH CALLBACK URL WITH CSP BYPASS LEADING TO ZERO-CLICK ACCOUNT TAKEOVER

This blog post goes into depth into how you can exploit an OAuth callback URL to create a zero-click account takeover.

infosecwriteups.com · 6 min

TLDR InfoSec

LEARNING ABOUT SIMULATED ADVERSARIES FROM HUMAN DEFENDERS USING INTERACTIVE CYBER-DEFENSE GAMES

This study looked at the behavior of human defenders against two different attack strategies, Beeline and Meander, and how it affected the emergence of defense strategies. The results showed that although human defenders initially had more difficulty stopping the Beeline adversary, they were able to learn to stop it by taking advantage of their attack strategy.

academic.oup.com · 29 min

TLDR InfoSec

MALWAREBYTES IDENTITY THEFT PROTECTION (PRODUCT LAUNCH)

MalwareBytes has launched a new product, Identity Theft Protection, that is meant to help secure digital identities and defend against identity and online threats. It does this through identity monitoring and alerting, credit monitoring, breach analysis, and identity recovery tools.

malwarebytes.com

TLDR InfoSec

SOPHISTICATED STRIPEDFLY SPY PLATFORM MASQUERADED FOR YEARS AS CRYPTO MINER

The StripedFly malware was first discovered by Kaspersky researchers in 2017 and was initially believed to be a cryptocurrency miner. Researchers discovered that the miner was actually a cover for a highly sophisticated spy platform. The malware uses a custom TOR client to transmit communication and siphoned data between infected systems and the attackers' command and control server and has a ransomware component that has infected a small subset of victims.

zetter-zeroday.com · 8 min

TLDR InfoSec

AMAZON RDS AND AURORA CERTIFICATES EXPIRING SOON

Amazon has released a notice that most Amazon RDS and Aurora SSL/TLS certificates will expire in 2024. After rotating the rds-ca-2019 CA certificates, the new CA certificates will expire in either 40 or 100 years. This article contains a tutorial on how to identify and rotate affected instances.

aws.amazon.com · 12 min

TLDR InfoSec

SHINING A LIGHT IN THE DARK: MEASURING GLOBAL INTERNET SHUTDOWNS

Researchers at Censored Planet and Google’s Jigsaw have been tracking internet blackouts by governments, which impacted 35 countries across 187+ instances in 2022. Outages lasting hours to weeks cut access to vital information for work and family. This post outlines how the researchers built the analysis dashboard and data pipelines to understand the impact of these blackouts.

cloud.google.com · 6 min

TLDR InfoSec

OKTA CYBERSECURITY BREACH WIPES OUT MORE THAN $2 BILLION IN MARKET CAP

After Okta’s recent breach, its shares slumped more than 11% - reducing its market cap by more than $2 billion.

cnbc.com · 2 min

TLDR InfoSec

THE FINANCIAL IMPLICATIONS OF CYBER SECURITY: HOW CATCH RATES IMPACT ORGANIZATIONAL RISK

Many organizations' expanding attack surfaces, from digital transformation and hybrid work, drive cyber risk, with threats rapidly evolving. Quantifying security solution efficacy through metrics like catch rate is challenging with the variables involved. This piece examines what catch rate indicates about financial risk mitigation.

blog.checkpoint.com · 4 min

TLDR InfoSec

CHATBOT HALLUCINATIONS ARE POISONING WEB SEARCH

A study of how generative AI chatbot “hallucinations”, or false information generated by AI chatbots, are harming search results. The study focuses on an example in which a researcher wrote a blog post that was meant to test how an LLM could be tricked into generating a summary using a fictional article. The researcher discovered that their fictional article was highlighted in Bing search results even after they added explicit text in the blog post to try and dissuade the Bing search results.

wired.com · 7 min