The Daily Index — Wednesday, November 29, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL VULNERABILITY FOUND IN RAY AI FRAMEWORK

A critical vulnerability in Ray, an open source compute framework for AI, could allow unauthorized access to all nodes. Tracked as CVE-2023-48023, the vulnerability allows remote attackers to submit or delete jobs without authentication. Furthermore, an attacker could retrieve sensitive information and execute arbitrary code.

securityweek.com · 4 min

TLDR InfoSec

GOOGLE CHROME EMERGENCY UPDATE FIXES 6TH ZERO-DAY EXPLOITED IN 2023

Google released an advisory that it was aware of the active exploitation of CVE-2023-6345. This CVE addresses an integer overflow vulnerability in the Skia 2D graphics library. A fix is being rolled out to users.

bleepingcomputer.com · 3 min

TLDR InfoSec

ANALYZING THE LITTERDRIFTER MALWARE

This article takes a deep dive into Gamaredon’s new LitterDrifter malware. LitterDrifter is a worm written in VBS that spreads via USB devices and communicates with a flexible C2 infrastructure. The article also contains indicators of compromise.

research.checkpoint.com · 8 min

TLDR InfoSec

POST-EXPLOITING A COMPROMISED ETCD CLUSTER

This post from NCCGroup presents a technique for compromising Kubernetes clusters given a root-compromised etcd host. The post provides an overview of how Kubernetes interacts with etcd and then delves into how to use a compromised etcd host to gain access to a cluster, followed by bypassing AdmissionControllers. The post concludes with some potential mitigation techniques.

research.nccgroup.com · 12 min

TLDR InfoSec

ADVERSARIAL ATTACKS ON LLMS

This thorough article by Lilian Weng dives deep into different types of attacks on Large Language Models (LLMs). Weng discusses various attacks and prevention strategies in depth.

lilianweng.github.io · 22 min

TLDR InfoSec

ICEKUBE: FINDING COMPLEX ATTACK PATHS IN KUBERNETES CLUSTERS

IceKube is an open-source tool that creates graph databases of resource configurations and relationships in Kubernetes clusters. It can analyze these relationships and identify potential attacks by combining them to query for routes using one or more of the 25 attack techniques it currently implements.

labs.withsecure.com · 8 min

TLDR InfoSec

ABUSING MICROSOFT ACCESS “LINKED TABLE” FEATURE TO PERFORM NTLM FORCED AUTHENTICATION ATTACKS

This post goes through how Microsoft Access can be used to perform a remote attack. It is done by using the "linking to remote SQL Server tables" feature, enabling attackers to leak the Windows user’s NTLM tokens to any attacker-controlled server. The attack can be launched as long as the victim opens an .accdb or .mdb file.

research.checkpoint.com · 8 min

TLDR InfoSec

EUROPOL ARREST HACKERS ALLEGEDLY BEHIND STRING OF RANSOMWARE ATTACKS

Europol has arrested five individuals who have been accused of a string of ransomware attacks affecting more than 1,800 victims worldwide. The police also seized cryptocurrency assets, including almost four million hryvnias (around $110,000), and other alleged evidence of illegal activities.

techcrunch.com · 3 min

TLDR InfoSec

IRANIAN HACKER GROUP CYBER AV3NGERS HACKED THE MUNICIPAL WATER AUTHORITY OF ALIQUIPPA IN PENNSYLVANIA

Over the weekend, Iranian hacker group Cyber Av3ngers hacked the Municipal Water Authority of Aliquippa in Pennsylvania and took control of one of its booster stations. However, the attack did not impact the operations at the facility, the water supply, or the drinking water.

securityaffairs.com · 2 min

TLDR InfoSec

2023 AI CODE SECURITY REPORT

This report surveyed 537 people about AI code completion tools and their use for secure development and found that 96% of teams use AI coding tools and over half said that AI coding tools commonly generate insecure code suggestions.

snyk.io · 10 min

TLDR InfoSec

GUIDELINES FOR SECURE AI SYSTEM DEVELOPMENT

The US and UK cybersecurity agencies CISA and NCSC have published security-focused guidance for the developers of systems that leverage AI, promoting the implementation of secure-by-design principles in AI/ML development.

ncsc.gov.uk · 10 min

TLDR InfoSec

PLEX UPDATE RAISES PRIVACY CONCERNS

Plex has rolled out a new feature called Discover Together. It is enabled by default and allows friends and those with access to the Plex server to view anything that a user watched or rated. Many Plex users are enraged by this update and feel that it violates the principles of self-hosting.

techspot.com · 4 min