The Daily Index — Wednesday, November 15, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRYPTOGRAPHIC KEYS PROTECTING SSH CONNECTIONS STOLEN IN NEW ATTACK

The private key material of cryptographic keys can be leaked due to naturally occurring errors in SSH connections. Researchers were able to reconstruct private key material using lattice-based cryptography by comparing faulty signatures generated as part of the connection setup with successful signatures. The attack only affects RSA keys and can be mitigated by error correction in many common implementations of SSH.

arstechnica.com · 4 min

TLDR InfoSec

CACHEWARP AMD CPU ATTACK LETS HACKERS GAIN ROOT IN LINUX VMS

Researchers have discovered a new exploit in AMD’s SEV protection. SEV is designed to protect against malicious hypervisors by encrypting VM data and protecting against its modification. This attack exploits the ability to modify cache lines to a previous state which can allow for manipulating authentication variables or return addresses.

bleepingcomputer.com · 3 min

TLDR InfoSec

GPTS AND ASSISTANTS API: DATA EXFILTRATION AND BACKDOOR RISKS IN CODE INTERPRETER

This article talks about the new tools introduced by OpenAI on DevDay and how they can be used to exfiltrate data and files, as well as perform backdoor insertion using the Code Interpreter. Attackers may be able to access personal files and manipulate code through malicious prompts on websites, posing a threat to large populations.

evren.ninja · 2 min

TLDR InfoSec

PYTHON OBFUSCATION TRAPS

Developers have been targeted by malicious Python packages disguised as legitimate obfuscation tools, with the most recent package being "pyobfgood". The package has a destructive payload, "BlazeStealer", that retrieves an additional malicious script from an external source, enabling a Discord bot that gives attackers complete control over the victim's computer.

checkmarx.com · 3 min

TLDR InfoSec

TERRAFORM SECURITY BEST PRACTICES

This post provides an overview of Terraform and some common security best practices. It covers auditing terraform manifest files (using scanning tools), managing credentials and secrets, and creating and using modules.

sysdig.com · 18 min

TLDR InfoSec

AWS LAUNCHES BLOCK PUBLIC SHARING OF EBS SNAPSHOTS

AWS has launched a new feature that allows for blocking of all or new public sharing of EBS snapshots. EBS snapshots could be heavily sensitive as they contain the full content of EBS disks. The setting must be applied per region and per account.

aws.amazon.com · 2 min

TLDR InfoSec

ACSC AND CISA RELEASE BUSINESS CONTINUITY IN A BOX

The Australian Cyber Security Centre (ACSC) and the Cybersecurity and Infrastructure Security Agency (CISA) have jointly launched Business Continuity in a Box, a tool designed to help organizations quickly and securely set up critical business functions during or after a cyber attack.

cisa.gov · 1 min

TLDR InfoSec

POST-QUANTUM CRYPTOGRAPHY: IT’S ALREADY HERE AND IT’S NOT AS SCARY AS IT SOUNDS

This article talks about the various approaches to Post-Quantum Cryptography (PQC). PQC algorithms have been specially designed to ensure information is kept safe in the future. There are currently four main types of PQC algorithms: lattice-based, code-based, multivariate polynomial, and hash-based. The article talks about how lattice-based cryptography is straightforward but adds complexity.

medium.com · 4 min

TLDR InfoSec

NEW REPTAR CPU FLAW IMPACTS INTEL DESKTOP AND SERVER SYSTEMS

Intel has patched CVE-2023-23583, also called a 'Redundant Prefix Issue' or 'Reptar' by teams within Google that also independently discovered it. CVE-2023-23583 can be exploited by attackers to escalate privileges, gain access to sensitive information, or trigger a denial of service state.

bleepingcomputer.com · 3 min

TLDR InfoSec

POLICE TAKES DOWN BULLETPROFTLINK

The Malaysian police managed to dismantle the BulletProftLink Phishing-as-a-service company in collaboration with the FBI and the Australian Federal Police. As of April 2023, BulletProftLink was estimated to have 8,138 subscribers with 327 phishing page templates.

bleepingcomputer.com · 3 min

TLDR InfoSec

USE THESE CHEAT SHEETS TO INCREASE YOUR CTF SPEED

This cheat sheet provides essential commands for use in CTFs, THM boxes, and cybersecurity.

infosecwriteups.com · 2 min

TLDR InfoSec

ETHEREUM FEATURE ABUSED TO STEAL $60 MILLION FROM 99K VICTIMS

Malicious actors exploited Ethereum's Create2 function to bypass wallet security alerts and steal $60 million worth of cryptocurrency from 99,000 people in six months.

bleepingcomputer.com · 2 min