The Daily Index — Wednesday, November 22, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS ACCESSED SENSITIVE HEALTH DATA OF WELLTOK PATIENTS

Healthcare engagement platform Welltok confirmed hackers stole 1.6M+ people's data by exploiting MOVEit. It reported that names, dates of birth, addresses, social security numbers, and other sensitive data were leaked

techcrunch.com · 2 min

TLDR InfoSec

MYSQL SERVERS TARGETED BY DDOSTF BOTNET

The Ddostf botnet is targeting MySQL servers for use in its DDOS-as-a-Service platform. The botnet is gaining access by brute-forcing weak admin credentials and then installing User Defined Functions to act as a C2 server for use in the botnet.

bleepingcomputer.com · 2 min

TLDR InfoSec

WPA-WPA2 WI-FI HACKING: A STEP-BY-STEP GUIDE

This is a simple step-by-step learning guide on how to hack WPA-protected Wi-Fi.

medium.com · 4 min

TLDR InfoSec

BOLSTERING SECURITY & AUTOMATING MANAGEMENT OF TARGET AUSTRALIA’S EKS CLUSTERS

This post from Target Australia details the decisions and migrations that it made to improve scalability and security in its EKS clusters. Target Australia moved from manually security-hardening Amazon Linux AMIs to using BottleRocket OS-based AMIs and adopted Karpenter (running on Fargate) to replace Cluster Autoscaler to replace AutoScaling Group-based compute with EC2-based compute for its clusters.

medium.com · 12 min

TLDR InfoSec

DETECT TRANSITIVE ACCESS TO SENSITIVE GOOGLE CLOUD RESOURCES

This article discusses transitive access via service accounts in GCP that could allow users to access services as Service Accounts, gaining access to all the IAM resources tied to those accounts. It details the IAM permissions that allow for this, detection methods like using Google Policy Analyzer, and how to identify these service accounts using Google APIs.

p0.dev · 5 min

TLDR InfoSec

LASSO SECURITY (PRODUCT LAUNCH)

Lasso aims to take over LLM security by detecting and monitoring LLM data flow in real time and alerting for possible breaches of policy, enabling organizations to safely deploy LLMs in production environments.

lasso.security

TLDR InfoSec

HACKTHEBOX LAUNCHES SHERLOCK

HackTheBox has announced the launch of a new set of labs called Sherlock that focuses on DFIR skills. 15 Sherlock labs will be available for free to all users before the labs are split into 8 free labs and the rest being premium.

hackthebox.com · 4 min

TLDR InfoSec

PLAYCRYPT RANSOMWARE-AS-A-SERVICE EXPANDS THREAT FROM SCRIPT KIDDIES AND SOPHISTICATED ATTACKERS

The ransomware strain known as Play is being offered to other threat actors as a service. Adlumin has identified and stopped PlayCrypt attacks that had nearly identical tactics, techniques, and procedures (TTPs), hinting at people buying these attacks as a service, allowing anyone with a wallet to do a ransomware attack.

adlumin.com · 8 min

TLDR InfoSec

GOOGLE’S NEW TITAN SECURITY KEYS ARE READY FOR A WORLD WITHOUT PASSWORDS

Google has released new Titan security keys that support passkeys for passwordless authentication. The new keys are available in USB A or C, support FIDO2, are NFC compatible, and can store up to 250 passkeys.

theverge.com · 1 min

TLDR InfoSec

YOUTUBE WILL SHOW LABELS ON VIDEOS THAT USE AI

YouTube has announced that it will be requiring creators to add labels to realistic content that features AI in the coming months. Creators who consistently fail to add these labels may be suspended from the YouTube Partner Program. Music labels and distributors will be able to request the removal of AI-generated content that mimics artists' voices.

9to5google.com · 2 min

TLDR InfoSec

CELEBRATING TEN YEARS OF THE MICROSOFT BUG BOUNTY PROGRAM AND MORE THAN $60M AWARDED

Microsoft has paid out $63 million in rewards to security researchers participating in its bug bounty programs throughout the last 10 years. Of the $63 million awarded since 2013, $60 million of that was allocated in the last five years.

msrc.microsoft.com · 3 min

TLDR InfoSec

MORGAN STANLEY FINED $6.5 MILLION FOR EXPOSING CUSTOMER INFORMATION

Morgan Stanley has agreed to a $6.5 million settlement over the insecure disposal of hardware containing unencrypted personal information.

securityweek.com · 2 min