The Daily Index — Friday, December 1, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

IDENTITY MANAGEMENT COMPANY OKTA REVEALS FAR MORE EXTENSIVE HACK OF ITS SYSTEMS

Okta has revealed that the hack back in September actually affected all its customers instead of 1%. The compromised data includes full names and email addresses, and for a smaller percentage of customers, phone numbers.

edition.cnn.com · 2 min

TLDR InfoSec

EMERGENCY IOS PATCH MARKS 20 ZERO-DAYS IN 2023

Apple has released an emergency patch to fix two new actively exploited zero-day vulnerabilities in the WebKit browser engine. The vulnerabilities allow attackers to gain sensitive information via an out-of-bounds read weakness and code execution via a memory corruption bug. These two vulnerabilities mark 20 zero-days reported in iOS during 2023.

bleepingcomputer.com · 2 min

TLDR InfoSec

HOW A CHARGE POINT OPERATOR ACCIDENTALLY LEAKED AUTHENTICATION INFORMATION OF ALL ITS POTENTIAL CUSTOMERS

This article covers an anonymous responsible disclosure of an API issue to a charge point provider. Omitted per the operator's legal request, the problem was resolved promptly. The piece aims to help developers avoid excessive info disclosure through APIs while making necessary revelations safely.

harmvandenbrink.medium.com · 8 min

TLDR InfoSec

TRAP; RESET; POISON; - TAKING OVER A COUNTRY KAMINSKY STYLE

This post covers the research of an exotic DNS Cache Poisoning vulnerability that could have manipulated DNS name resolution for an entire country. The exploitation of this issue would have allowed threat actors to cause serious harm. This is an in-depth look at all the technical intricacies of the attack and how to TRAP, RESET, and POISON a DNS resolver.

sec-consult.com · 7 min

TLDR InfoSec

ETW INTERNALS FOR SECURITY RESEARCH AND FORENSICS

This post discusses the importance of Event Tracing for Windows (ETW) in endpoint detection and response solutions. It explores the internal workings of ETW and provides techniques to tamper with or bypass ETW-based EDRs, hook system calls, or gain access to ETW providers normally reserved for anti-malware solutions. The post also explains how to identify which processes are consuming ETW events.

blog.trailofbits.com · 11 min

TLDR InfoSec

PIIANO FLOWS (PRODUCT LAUNCH)

Piiano Flows finds potential data leaks inside source code and ensures that sensitive information, such as Personally Identifiable Information (PII), credentials, and financial information, are protected before faulty code reaches production

piiano.com

TLDR InfoSec

FASTLY ANNOUNCES PLAN TO STOP DOMAIN FRONTING

Domain fronting is a technique for bypassing internet censorship by placing a different/forbidden host in an HTTP Host header rather than in the TLS SNI and DNS query. This technique is also commonly used by malware groups to bypass firewalls. Fastly now joins other CDNs like AWS, Cloudflare, and Microsoft in blocking domain fronting.

github.com · 2 min

TLDR InfoSec

MAJORITY OF US SITES ARE UNPROTECTED AGAINST SIMPLE BOTS

DataDome SAS tested over 9,500 of the largest US-based websites to see how they performed against nine different bot attacks. 68% of sites were unprotected against simple bot attacks while only 10% blocked all nine different attacks. E-commerce sites proved to be the most susceptible to bot attacks and gambling sites proved to be the least.

siliconangle.com · 2 min

TLDR InfoSec

HACKERS BREACH US WATER FACILITY VIA EXPOSED UNITRONICS PLCS

Hackers have breached a US water facility by hacking into Unitronics Programmable Logic Controllers (PLCs) exposed online. CISA is warning that this could lead to severe repercussions, such as water supply contamination through manipulating the device to alter chemical dosing, service disruption leading to a halt in water supply, and physical damage to the infrastructure.

bleepingcomputer.com · 2 min

TLDR InfoSec

SECURE BY DESIGN ALERT: HOW SOFTWARE MANUFACTURERS CAN SHIELD WEB MANAGEMENT INTERFACES FROM MALICIOUS CYBER ACTIVITY

CISA has started a new series of alerts aimed at underlining the harm caused by not implementing security in the software development lifecycle.

cisa.gov · 3 min

TLDR InfoSec

POLICE DEPARTMENTS AND NEWS SITES SPREAD MISINFORMATION ABOUT IOS NAMEDROP

Several local news stations and police departments have been sharing warnings that falsely imply that contact information can be shared using Namedrop, a feature introduced by Apple In iOS 17.1 and WatchOS 10.1, without user interaction.

macrumors.com · 3 min

TLDR InfoSec

RESEARCHERS FIGURE OUT HOW TO BYPASS THE FINGERPRINT READERS IN MOST WINDOWS PCS

Researchers have found ways to bypass the fingerprint readers in most Windows PCs.

arstechnica.com · 3 min