The Daily Index — Monday, November 13, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MARINA BAY SANDS DISCLOSES DATA BREACH IMPACTING 665K CUSTOMERS

Singapore’s Marina Bay Sands luxury resort revealed that 665,000 of its customers were impacted by a recent data breach on Tuesday. Personal information such as name, email address, and phone numbers were affected but no credit card data was compromised.

securityweek.com · 3 min

TLDR InfoSec

1.3 MILLION MAINE RESIDENTS IMPACTED BY MOVEIT HACK

The State of Maine is the latest entity to disclose a significant impact from the cyberattack targeting a zero-day in Progress Software’s MOVEit file transfer tool earlier this year. The Maine Department of Health and Human Services and the Maine Department of Education were the most affected organizations.

maine.gov · 4 min

TLDR InfoSec

DEMYSTIFYING COBALT STRIKE’S “MAKE_TOKEN” COMMAND

This article explains the inner workings of Cobalt Strike's "make_token" command, which allows users to impersonate other users through their credentials with the goal of enumerating or moving laterally to remote systems.

research.nccgroup.com · 9 min

TLDR InfoSec

BYPASSING ANDROID 13 RESTRICTIONS WITH SECURIDROPPER

This post examines SecuriDropper, the first widely distributed Android dropper bypassing Android 13's Restricted Settings defense. Droppers separate attack execution from payload install, which is offered for Malware as a Service (MaaS). SecuriDropper shows that actors are quickly adapting to platform protections, highlighting the ongoing cat-and-mouse game around Android malware distribution.

threatfabric.com · 8 min

TLDR InfoSec

UNDER THE LENS: THE LNK FILE INVESTIGATION

Shortcut files (.lnk files) might look innocent, but they can cause devastating damage. This post dives into how shortcut files can be exploited for ransomware and more, compromising your computer and the data within it.

medium.com · 9 min

TLDR InfoSec

CAVELO (PRODUCT LAUNCH)

Cavelo provides organizations with the necessary means to scan their environments for data that might be at risk in the event of a breach, including personally identifiable information (PII) and financial information.

cavelo.com

TLDR InfoSec

IMPATIENT LOCKBIT SAYS IT'S LEAKED 50GB OF STOLEN BOEING FILES AFTER RANSOM FAILS TO LAND

Ransomware group LockBit leaked ~50GB of data allegedly stolen from Boeing after Boeing refused to pay. The full release of this data includes system backups and compressed archives. Citrix logs suggest a potential CitrixBleed breach vector. Boeing won't verify data or comment on incident specifics, underscoring disclosure challenges after attacks.

theregister.com · 4 min

TLDR InfoSec

THIS TOOL AIMS TO KEEP TERRORISM CONTENT OFF THE INTERNET

Altitude is a free tool created by Jigsaw and Tech Against Terrorism to give smaller platforms the ability to detect and remove terrorism content on their network. Many groups have moved to smaller platforms as larger platforms have dedicated tools to remove content from groups like ISIS. Altitude seeks to aid these platforms in identifying and contextualizing terrorism content.

wired.com · 5 min

TLDR InfoSec

SPAMMERS ABUSE GOOGLE FORMS QUIZZES TO DELIVER SCAMS

Spammers are using Google Forms quizzes to deliver email scams. They are creating a new quiz in Google Forms, using the victim’s email address to respond to the quiz, and then abusing the “Release Scores” feature to deliver their spam.

blog.talosintelligence.com · 4 min

TLDR InfoSec

OVERVIEW AND COMPARISON OF A FEW POPULAR CYBERSECURITY FRAMEWORKS: NIST, SOC 2, AND ISO 27001

This post compares the three major standards — NIST, SOC 2, and ISO 27001 — and breaks them down in an easy-to-consume manner.

medium.com · 4 min

TLDR InfoSec

KEY TAKEAWAYS FROM THE WIZ 2023 KUBERNETES SECURITY REPORT

Wiz observed that Kubernetes clusters are being discovered and targeted quickly and noted that container security and other native security features of Kubernetes are frequently underutilized, leading to lateral movement and privilege escalation being increasingly easy after initial access.

wiz.io · 4 min

TLDR InfoSec

CYBER ATTACK FORCES WORLD’S BIGGEST BANK TO TRADE VIA USB STICK

The Industrial & Commercial Bank of China’s US branch was hit by a ransomware attack that forced systems to be disconnected from the network. Trades had to be carried out by sending USB sticks via messengers through Manhattan.

time.com · 3 min