The Daily Index — Wednesday, November 8, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

BLUENOROFF HACKERS BACKDOOR MACS WITH NEW OBJCSHELLZ MALWARE

The BlueNoroff hacking group, backed by North Korea, has developed a new macOS malware called ObjCShellz that can open remote shells on compromised devices. BlueNoroff is known for targeting cryptocurrency exchanges and financial organizations.

bleepingcomputer.com · 2 min

TLDR InfoSec

CRITICAL VULNERABILITIES EXPOSE VEEAM ONE SOFTWARE TO CODE EXECUTION

Veeam has issued patches for four severe security vulnerabilities that could expose users of its Veeam ONE product to remote code execution attacks. The flaws include two critical issues with CVSS severity scores of 9.9 out of 10.

securityweek.com · 2 min

TLDR InfoSec

K-MEANS CLUSTERING FOR LATERAL MOVEMENT DETECTION

Summary unavailable

huntandhackett.com · 8 min

TLDR InfoSec

SECURITY CONSIDERATIONS FOR RUNNING CONTAINERS ON ECS

A post from AWS that begins with an introduction to how the shared responsibility model applies to ECS and then launches into some best practices. The topics covered are IAM access to ECS, securing an ECS network, ECS secrets management, securing the ECS task and runtime, ECS logging and monitoring, and ECS security compliance.

aws.amazon.com · 5 min

TLDR InfoSec

FILTER AND STREAM LOGS FROM S3 BUCKETS TO SPLUNK

Summary unavailable

aws.amazon.com · 4 min

TLDR InfoSec

SECRET SCANNING EXPANDS DETECTION TO INCLUDE NON-PROVIDER PATTERNS (BETA)

GitHub has launched a beta version of secret scanning for non-provider patterns like database connection strings for MySQL, Postgres, MongoDB as well as private keys like RSA, SSH, etc.

github.blog · 1 min

TLDR InfoSec

TWO RUSSIAN NATIONALS CHARGED FOR CONSPIRING TO HACK THE TAXI DISPATCH SYSTEM AT JFK AIRPORT

Two Russian nationals, Aleksandr Derebenetc and Kirill Shipulin, have been charged with conspiring to hack the taxi dispatch system at JFK airport with the help of two US citizens, Daniel Abayev and Peter Leyman. The group hacked the system to move certain taxis to the front of the line in exchange for payment, resulting in large numbers of taxi drivers skipping the line.

justice.gov · 4 min

TLDR InfoSec

WHO’S BEHIND THE SWAT USA RESHIPPING SERVICE?

Part 2 of a deep dive from KrebsOnSecurity on unmasking the SWAT USA reshipping service. Krebs traces the operator of SWAT USA from his nickname to another nickname on the Verified forums. This username is then tracked via a password sent in a DM to four email addresses that use that password. A Russian individual is pinpointed through one of these emails.

krebsonsecurity.com · 3 min

TLDR InfoSec

ANDROID’S NEW REAL-TIME APP SCANNING AIMS TO COMBAT MALICIOUS SIDELOADED APPS

Google Play Protect has launched a new feature that enables real-time analysis of an app’s code and blocks installation if it is determined to be malicious. Play Protect will recommend a scan for any never before seen app, including sideloaded apps. The authors of this article tested the feature with 30 different apps ranging from stalkerware to spyware to fake apps and loan scams and found that, while most were caught by the scan, the fake apps and some of the loan scams were allowed.

techcrunch.com · 3 min

TLDR InfoSec

FAKE LEDGER LIVE APP IN MICROSOFT STORE STEALS $768,000 IN CRYPTO

A fraudulent version of the Ledger Live app for cryptocurrency management was discovered in the Microsoft Store, resulting in users losing at least $768,000 worth of cryptocurrency assets. The fake app, named Ledger Live Web3, had been present in the Microsoft Store since October 19. The fraudster was able to transfer over $768,000 from victims before Microsoft removed the app.

bleepingcomputer.com · 2 min

TLDR InfoSec

LOONEY TUNABLES VULNERABILITY EXPLOITED BY KINSING

Aqua Security has discovered that the Kinsing threat actor has shifted tactics in a new experimental campaign targeting cloud environments. The threat actor manually exploited the Looney Tunables vulnerability in GNU libc’s ld.so, marking the first known instance of such an exploit. This vulnerability was reported in October. Any unpatched systems should be patched urgently.

blog.aquasec.com · 8 min

TLDR InfoSec

UK MAY DEMAND TECH WORLD TELL IT ABOUT UPCOMING SECURITY FEATURES

The UK government may introduce legislation requiring tech companies to inform them in advance of new security technologies and possibly disable them when necessary. The proposed Investigatory Powers (Amendment) Bill would update the "notices regime" to provide advance access to technical details of security measures employed by major tech companies, enabling access to user data and monitoring nefarious activity.

theregister.com · 2 min