The Daily Index — Monday, November 6, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

ACE HARDWARE SAYS 1,202 DEVICES WERE HIT DURING CYBERATTACK

Ace Hardware, a hardware store retailer-owned cooperative with 5,700 shops across the United States, China, Panama, and the UAE, suffered a cyberattack that has affected over 1,200 devices and is preventing stores and customers from placing orders. The company is working to restore 196 servers and has engaged with IT experts to help them restore the impacted systems.

bleepingcomputer.com · 3 min

TLDR InfoSec

SOCKS5SYSTEMZ PROXY SERVICE INFECTS 10,000 SYSTEMS WORLDWIDE

The Socks5Systemz proxy botnet has infected 10,000 systems worldwide, turning them into traffic-forwarding proxies for malicious or anonymous traffic. The botnet has been operating since at least 2016 but has recently gained attention. The malware is distributed through phishing, exploit kits, malvertising, and trojanized executables.

bleepingcomputer.com · 3 min

TLDR InfoSec

THE WIKI-SLACK ATTACK

The Wiki-Slack Attack is a social engineering attack that redirects business professionals to attacker-controlled websites using Wikipedia and Slack. Browser-based attacks, such as the Wiki-Slack Attack, are becoming the primary infection vector for ransomware. This article provides security recommendations to protect against browser-based attacks and increase cyber resilience.

esentire.com · 6 min

TLDR InfoSec

APPLYING LLMS TO THREAT INTELLIGENCE

This article discusses the use of Large Language Models (LLMs) to enhance the capabilities of threat intelligence analysts. It explains what prompt engineering is and provides an example of an ideally crafted prompt. The article also explores the practical applications of LLMs, including few-shot prompting and retrieval augmented generation (RAG) as well as embeddings.

blog.securitybreak.io · 13 min

TLDR InfoSec

FILE ACCESS MONITORING WITH OSQUERY ON MACOS

File Integrity Monitoring is limited in the modern age as files containing things like access keys, API keys, and secrets are frequently used. Osquery on macOS can hook into the es_process_file_events table to allow users to define a set of sensitive files to monitor for any accesses or changes. This post contains a tutorial for enabling and configuring Osquery.

material.security · 3 min

TLDR InfoSec

ANNOUNCING THE EKS CLUSTER GAMES

A new CTF from Wiz that focuses on an Amazon EKS cluster. The challenge contains 5 challenges with common EKS misconfigurations. A certificate is available upon completion.

wiz.io · 1 min

TLDR InfoSec

GOOGLE PLAY STORE INTRODUCES 'INDEPENDENT SECURITY REVIEW' BADGE FOR APPS

Google Play Store has introduced an "Independent security review" badge for Android apps that have undergone a Mobile Application Security Assessment (MASA) audit. The badge is initially being launched for VPN apps due to the sensitive nature of the user data they handle. The MASA audit allows developers to have their apps independently validated against global security standards, providing more transparency and enabling users to make informed choices before downloading.

thehackernews.com · 2 min

TLDR InfoSec

WHAT IS A PASSKEY?

Part one of a series by the EFF on passkeys. A passkey is composed of 100-1400 bytes of random data stored on your computer in a safe location. They can be registered with a browser for a website and used to sign in. Passkeys can build in 2FA support which can increase security and convenience.

eff.org · 3 min

TLDR InfoSec

FIRST HANDSET WITH (MEMORY TAGGING EXTENSIONS) MTE ON THE MARKET

The Pixel 8/8 Pro are the first phones to enable ARM's MTE, a security feature that detects memory corruption at first occurrence. It's only available on Pixel as a developer option but can be configured for all apps. This article describes how to enable it on Android phones.

googleprojectzero.blogspot.com · 7 min

TLDR InfoSec

APPLE 'FIND MY' NETWORK CAN BE ABUSED TO STEAL KEYLOGGED PASSWORDS

Apple's 'Find My' network could be abused by attackers to transmit sensitive information captured by keyloggers installed in keyboards. Researchers have created a PoC hardware device to highlight the risk to the public by integrating a Bluetooth transmitter into a USB keyboard. They demonstrated that it is possible to relay passwords and sensitive data typed on the keyboard through the 'Find My' network.

bleepingcomputer.com · 3 min

TLDR InfoSec

LATIO VENDOR AWARDS: GLOBAL OWASP CONFERENCE

James Bethoty recaps some of the best vendors in various categories that he met with during the Global OWASP Conference. Categories range from buzzword of the year to best API security and best overall.

latio.beehiiv.com · 5 min

TLDR InfoSec

DISCORD WILL SWITCH TO TEMPORARY FILE LINKS TO BLOCK MALWARE DELIVERY

Discord will switch to temporary file links for all users by the end of the year to prevent attackers from using its CDN to host and distribute malware. All links to files uploaded to Discord servers will expire after 24 hours after the change rolls out. The new links will come with three parameters that will add expiration timestamps and unique signatures that will remain valid until the links expire, preventing the use of Discord's CDN for permanent file hosting.

bleepingcomputer.com · 2 min

TLDR InfoSec

USE WASM TO BYPASS LATEST CHROME V8SBX AGAIN

This author attended the POC2023 conference and presented on Chrome exploit chains. He discovered a new WASM bypass method for the V8 sandbox. The author notes that the vulnerabilities were exploited through trial and error.

medium.com · 5 min