The Daily Index — Friday, November 17, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

ROYAL MAIL’S RECOVERY FROM RANSOMWARE ATTACK WILL COST BUSINESS AT LEAST $12M

Royal Mail’s parent company has revealed the infrastructure cost associated with the LockBit attack in January will cost the business £10 million ($12.4 million). The total costs related to the attack are likely to be higher, but no figures have been shared.

theregister.com · 3 min

TLDR InfoSec

WP FASTEST CACHE SQLI EXPOSES 600K VULNERABLE WORDPRESS SITES

The is_user_admin function of the WP Fastest Cache plugin extracts the username from cookies to check if a user is an admin. However, the username is not sanitized and thereby can lead to SQL injection. A patched version of the plugin has been released. WPScan will be releasing its proof-of-concept exploit on November 27, 2023.

bleepingcomputer.com · 2 min

TLDR InfoSec

REGO 101: INTRODUCTION TO REGO

This blog post series offers a gentle introduction to Rego, the policy language from the creators of the Open Policy Agent (OPA) engine. The series goes over basic Rego concepts and how to get started with OPA, intermediate Rego syntax, and types of values and rules.

snyk.io · 10 min

TLDR InfoSec

FBI SHARES TACTICS OF NOTORIOUS SCATTERED SPIDER HACKER COLLECTIVE

The FBI and Cybersecurity and Infrastructure Security Agency (CISA) have released an advisory about Scattered Spider, a hacking collective that collaborates with ALPHV/BlackCat ransomware. Scattered Spider uses social engineering tactics and phishing to gain initial network access. It is a network of individuals with different threat actors participating in each attack.

bleepingcomputer.com · 4 min

TLDR InfoSec

HOW TO CREATE AN AMI HARDENING PIPELINE AND AUTOMATE UPDATES TO YOUR ECS FLEET

Amazon ECS allows for the use of EC2 instances as a container host to increase user control over the ECS environment. This tutorial from AWS walks through the process of setting up an EC2 Image Builder pipeline that begins with an Amazon ECS Optimized AMI and then applies the CIS Docker host benchmarks to the AMI. It then goes through how to use a Lambda step function to update the ECS fleet with the new AMI. The walkthrough includes a CloudFormation stack to deploy the infrastructure automatically.

aws.amazon.com · 5 min

TLDR InfoSec

AIKIDO (PRODUCT LAUNCH)

Aikido is an all-in-one solution that brings together multiple aspects of application security in one platform, including SAST, DAST, SCA, and CSPM.

aikido.dev

TLDR InfoSec

ADMINISTRATOR OF DARKODE HACKING FORUM SENTENCED TO PRISON

Thomas Kennedy McCormick, aka ‘Fubar’, a 30-year-old from Cambridge, Massachusetts, has been sentenced to 18 years in prison for his role in running Darkode. Investigators said Fubar was involved in the distribution of malware, hacking websites, as well as the theft and sale of personally identifiable information, payment cards, and bank account credentials.

securityweek.com · 3 min

TLDR InfoSec

DEVELOPERS CAN’T SEEM TO STOP EXPOSING CREDENTIALS IN PUBLICLY ACCESSIBLE CODE

Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000 projects submitted to PyPI, the official code repository for the Python programming language. Nearly 3,000 projects contained at least one unique secret. Many secrets were leaked more than once, bringing the total number of exposed secrets to almost 57,000.

arstechnica.com · 4 min

TLDR InfoSec

THE MIRAI CONFESSIONS

An in-depth look at the three young cybercriminals behind the Mirai botnet. While none of the cybercriminals involved fit the mold of traditional cybercriminals, they successfully took down large swaths of the internet.

wired.com · 18 min

TLDR InfoSec

CISA, FBI, AND MS-ISAC RELEASE ADVISORY ON RHYSIDA RANSOMWARE

Rhysida - a ransomware-as-a-service - that has compromised organizations in education, manufacturing, and information technology, has been released by the CISA, FBI, and MS-ISAC as an advisory.

cisa.gov · 2 min

TLDR InfoSec

ALPHV FILES SEC COMPLAINT AGAINST MERIDIANLINK FOR NOT DISCLOSING BREACH

Following a lack of direct response from MeridianLink, AlphV, who has claimed to have breached Meridian Link, filed a complaint to the SEC alleging that MeridianLink did not disclose a breach of customer data. MeridianLink claims that no production data was accessed.

databreaches.net · 1 min

TLDR InfoSec

STATE OF CLOUD SECURITY

A report from Datadog analyzing the security posture data from a sample of thousands of organizations using AWS, Azure, or Google Cloud found that many cloud workloads are excessively privileged. Specifically, long-lived credentials, MFA for cloud access, and IMDSv2 are not sufficiently enforced.

datadoghq.com · 17 min