The Daily Index — Friday, November 3, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL ATLASSIAN CONFLUENCE FLAW CAN LEAD TO SIGNIFICANT DATA LOSS

Atlassian has issued a warning about a critical security vulnerability affecting all versions of Confluence Data Center and Server, which could lead to significant data loss if exploited by an unauthenticated attacker. The vulnerability is an improper authorization issue. Atlassian is not aware of any attacks exploiting this vulnerability but urges customers to take immediate action to protect their installs.

securityaffairs.com · 1 min

TLDR InfoSec

DOZENS OF NPM PACKAGES CAUGHT ATTEMPTING TO DEPLOY REVERSE SHELL

Phylum's automated risk detection platform alerted them to a campaign involving at least 48 different publications on npm. These packages, published by the npm user "hktalent" with a package called rshNpm, contained obfuscated JavaScript designed to initiate a reverse shell on package install. The attack chain is triggered by package installation via an install hook in the package.json.

blog.phylum.io · 5 min

TLDR InfoSec

MALVERTISING VIA DYNAMIC SEARCH ADS

Malwarebytes detected an incident in which attackers utilized a hacked website to generate dynamic search ads that advertised software containing a Trojan. Dynamic search ads are a feature of Google ads that allows for generating ads based on the content of a webpage. Malwarebytes speculates that the attackers may not have even known that they were creating these malvertising ads.

malwarebytes.com · 3 min

TLDR InfoSec

COMMON CYBERSECURITY MISCONFIGURATIONS IN NETWORKS

The Cyber Security Agency of Singapore has released an advisory detailing common misconfigurations in networks. The 13 item list includes common misconfigurations such as weak authentication, unnecessary open ports, and unencrypted data.

csa.gov.sg · 4 min

TLDR InfoSec

POPPING BLISTERS FOR RESEARCH: AN OVERVIEW OF PAST PAYLOADS AND EXPLORING RECENT DEVELOPMENTS

This article provides an overview of Blister, a malware loader that loads a payload embedded within it. The authors analyze past payloads dropped by Blister loaders based on 137 unpacked samples from the past year and a half and explore recent developments. The analysis shows that Blister is mostly used in a targeted manner with Mythic agents as its payload of choice. The article provides YARA rules and scripts to help analyze the Mythic agent and the packer observed with it.

research.nccgroup.com · 13 min

TLDR InfoSec

AWS EUROPEAN SOVEREIGN CLOUD

AWS has announced a new independent sovereign cloud in Europe. The sovereign cloud is designed for public sector organizations in highly regulated industries that require a distinct cloud that is located solely in the EU. AWS has committed to maintaining the same level of service as the main cloud and providing high availability capabilities through distinct and geographically distant regions and availability zones in the European Sovereign Cloud.

aws.amazon.com · 2 min

TLDR InfoSec

.US HARBORS PROLIFIC MALICIOUS LINK SHORTENING SERVICE

Researchers at Infoblox have been tracking a three year old link shortening service that caters to threat actors. Prior to May 2023, the shortening service primarily used .info domains, but it has now migrated to primarily using .US domains. The .US top-level domain (TLD) is meant to be managed and verified by the National Telecommunications and Information Administration, but researchers have speculated that this management has been outsourced, leading to the TLD hosting many phishing websites.

krebsonsecurity.com · 5 min

TLDR InfoSec

NORTH KOREAN HACKERS TARGETING CRYPTO EXPERTS WITH KANDYKORN MACOS MALWARE

North Korean state-sponsored hackers have targeted blockchain engineers of an unnamed crypto exchange platform via Discord using macOS malware named KANDYKORN. Security researchers have linked the activity, which began in April 2023, to the Lazarus Group. The attackers lured victims by impersonating blockchain engineers on a public Discord server. The malware is a full-featured memory resident RAT with built-in capabilities to enumerate files, run additional malware, exfiltrate data, terminate processes, and run arbitrary commands.

thehackernews.com · 3 min

TLDR InfoSec

THIS TINY DEVICE (FLIPPER ZERO) IS SENDING UPDATED IPHONES INTO A NEVER-ENDING DOS LOOP

A security researcher experienced a series of pop-up windows that made it nearly impossible to use his iPhone while traveling by train in the Netherlands. The culprit, it turned out, was using a Flipper Zero device to send Bluetooth pairing requests to all iPhones within radio range. This slim, lightweight device has been available since 2020, but in recent months, it has become much more visible.

arstechnica.com · 4 min

TLDR InfoSec

INFOSECMAP (WEBAPP)

InfoSecMap is a searchable database of different events and meetups related to information security.

infosecmap.com

TLDR InfoSec

BOEING CONFIRMS CYBERATTACK AMID LOCKBIT RANSOMWARE CLAIMS

Aerospace company Boeing has confirmed that it is investigating a cyberattack that affected its parts and distribution business. This comes after LockBit ransomware claimed that it had breached the company's network and stolen data. Boeing has stated that the incident did not affect flight safety, and it is collaborating with law enforcement and regulatory agencies.

bleepingcomputer.com · 2 min

TLDR InfoSec

DOZENS OF COUNTRIES WILL PLEDGE TO STOP PAYING RANSOMWARE GANGS

An alliance of 40 countries will sign a pledge to stop paying ransoms demanded by cybercriminal groups during the third annual International Counter-Ransomware Initiative summit in Washington, D.C. The initiative is in response to record ransomware risks worldwide, with the U.S. being the target of approximately 46% of these incidents. The summit will also focus on strategies to block the funds used by ransomware groups to finance their operations.

bleepingcomputer.com · 2 min