The Daily Index — Friday, November 10, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SUMO LOGIC DISCLOSES SECURITY BREACH

Sumo Logic reported that an attacker used stolen credentials to access a Sumo Logic AWS account. It stated that it immediately quarantined the environment, that none of its systems or networks were impacted, and that customer data was encrypted at all times. Sumo Logic is advising customers to rotate their API keys.

bleepingcomputer.com · 2 min

TLDR InfoSec

MONERO’S COMMUNITY WALLET LOSES ALL FUNDS AFTER ATTACK

A September attack compromised Monero’s Community Wallet and wiped its entire balance. The Monero Community Wallet is used to fund development projects from its members. Monero developer Luigi disclosed the attack on November 2 but has not yet identified the source.

cointelegraph.com · 1 min

TLDR InfoSec

ROOT BY ACCIDENT, PRIVILEGE ESCALATION USING DOCKER

Docker makes many tasks easier for us. It is interesting to consider the surface risk it opens from a security perspective and the possibilities it offers for privilege escalation. This blog dives into the dangers of Docker and how having access to the Docker daemon opens the door to using it as an attack vector.

medium.com · 7 min

TLDR InfoSec

FROM AKAMAI TO F5 TO NTLM... WITH LOVE

The blog post details how the author was able to abuse Akamai services to attack F5s and subsequently steal internal data including authorization and session tokens from their customers. It provides detailed explanations of how normal GET requests and malformed POST requests using a smuggling gadget can affect backend servers and potentially poison the response queue or cache.

blog.malicious.group · 19 min

TLDR InfoSec

50 SHADES OF VULNERABILITIES: UNCOVERING FLAWS IN OPEN-SOURCE VULNERABILITY DISCLOSURES

Aqua Nautilus researchers found flaws in the vulnerability disclosure process for tens of thousands of open-source projects. These flaws allowed vulnerabilities to be harvested before they were patched and announced, potentially enabling attackers to exploit security holes before users were alerted. The research also introduces two additional states in the vulnerability disclosure process: 'Half-Day' and '0.75-Day' Vulnerability.

blog.aquasec.com · 11 min

TLDR InfoSec

MALVERTISER COPIES PC NEWS SITE TO DELIVER INFOSTEALER

Researchers observed a malvertising campaign mimicking the legitimate Windows news site WindowsReport.com to distribute malware posing as the popular tool CPU-Z. The campaign leverages trusted site replicas instead of vendor sites and is part of a larger effort also targeting Notepad++, Citrix, and VNC Viewer.

malwarebytes.com · 6 min

TLDR InfoSec

WHAT TO DO WITH A CLOUD INTRUSION TOOLKIT IN 2023? SLAP A CHAT ASSISTANT ON IT, DUH

The Predator AI pen testing tool can exploit misconfigurations in 30+ web services, but also has a semi-functional AI chatbot assistant. It is offered for "education" purposes but it could probe defenses or enable attacks. It looks for common flaws like CORS, Git exposure, SQLi, and XSS in a nice convenient package.

theregister.com · 4 min

TLDR InfoSec

HACKERS, SCRAPERS, & FAKERS

In this blog post, Troy Hunt of HaveIBeenPwned examines the recently released LinkedIn data breach. An attacker claims that they breached LinkedIn and have leaked full names, profile data, phone numbers, emails, and other confidential information of users. After analysis, Hunt notes that the data is a combination of scraped and publicly available information and fabricated emails.

troyhunt.com · 3 min

TLDR InfoSec

MEDICAL COMPANY FINED $450,000 BY NEW YORK AG OVER DATA BREACH

US Radiology Specialists, a major private radiology group, was targeted in a ransomware attack in December 2021. The incident resulted in the personal and health information of nearly 200,000 patients, including 92,000 New Yorkers, getting compromised. The group was fined $450,000.

securityweek.com · 3 min

TLDR InfoSec

WHAT’S NEW IN CVSS 4.0

This blog post covers the new vulnerability scoring framework, CVSS 4.0, which was released on November 1, 2023.

snyk.io · 6 min

TLDR InfoSec

ATLASSIAN INCREASES CVSS SCORE OF LATEST CVE TO 10

Atlassian updated the CVSS score of the recently disclosed CVE-2023-22518 after discovering that an unauthenticated attacker could fully reset Confluence and create an administrator account. This vulnerability is actively being exploited.

theregister.com · 3 min