The Daily Index — Wednesday, December 13, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

FORESCOUT VEDERE LABS DISCLOSES 21 VULNERABILITIES AFFECTING OT/IOT CELLULAR ROUTERS

Forescout Vedere Labs has identified a total of 21 new vulnerabilities affecting Sierra Wireless Airlink cellular routers and their dependencies. Of these vulnerabilities, 1 is rated critical and 9 are rated as high. Over 86,000 internet-facing devices were discovered by the researchers, with less than 10% being fully patched. This article includes mitigation and patching instructions.

forescout.com · 5 min

TLDR InfoSec

NEW 5GHOUL ATTACK IMPACTS PHONES WITH QUALCOMM, MEDIATEK CHIPS

A group of researchers from Singapore discovered a series of 14 vulnerabilities that impact a total of 710 5G smartphone models from Android, Apple, routers, and USB modems. The 5Ghoul attacks range from temporary service disruption to network downgrade and can be executed without any secret knowledge of the victim, such as SIM card details. The flaws involve impersonating a legitimate 5G base station with proof-of-concept exploits available.

bleepingcomputer.com · 3 min

TLDR InfoSec

NEW MICROSOFT INCIDENT RESPONSE TEAM GUIDE SHARES BEST PRACTICES FOR SECURITY TEAMS AND LEADERS

This guidance is focused on people and processes, so organizations can effectively respond during critical incidents. The guide explains how to structure the human elements of incident responses with best practices to help navigate the crucial hours after breach detection and help security teams and leaders steer an investigation when plunged into an incident.

microsoft.com · 4 min

TLDR InfoSec

KUBERNETES SECURITY FUNDAMENTALS: API SECURITY

This post is part 2 of a blog series by Datadog focusing on Kubernetes security fundamentals. It details the attack surface of the Kubernetes API in both managed and unmanaged clusters. The post provides guidance on how to reduce the network exposure of these API endpoints and how to encrypt communication.

securitylabs.datadoghq.com · 6 min

TLDR InfoSec

ANALYZING ASYNCRAT'S CODE INJECTION INTO ASPNET_COMPILER.EXE ACROSS MULTIPLE INCIDENT RESPONSE CASES

The Trend Micro Managed XDR team discusses how the aspnet_compiler.exe, a legitimate Microsoft Process, is used to inject the AsyncRAT payload. The investigation revealed different tactics employed by the attackers, including phishing campaigns, code injection, and the use of dynamic DNS servers as well as the ability to evade detection by Antivirus software.

trendmicro.com · 10 min

TLDR InfoSec

AMAZON INSPECTOR LAUNCHES NEW CAPABILITIES

Amazon Inspector has launched a set of open source plugins and an API to enable container scanning at build time directly from a CI/CD plugin. Inspector has also launched a new capability to enable agent-less continuous monitoring of EC2 instances. It added a new feature that utilizes generative AI to provide assisted code remediation for Lambda functions.

aws.amazon.com · 4 min

TLDR InfoSec

OPERATION BLACKSMITH: LAZARUS TARGETS ORGANIZATIONS WORLDWIDE USING NOVEL TELEGRAM-BASED MALWARE WRITTEN IN DLANG

Cisco Talos has discovered a new campaign by the Lazarus Group called "Operation Blacksmith." The campaign involves the use of three new malware families written in DLang, including two remote access trojans (RATs) that use Telegram for command and control. The malware families discovered in Operation Blacksmith demonstrate a shift in Lazarus Group's tactics and the use of DLang as a programming language.

blog.talosintelligence.com · 10 min

TLDR InfoSec

CLOUD ENGINEER WREAKS HAVOC ON BANK NETWORK AFTER GETTING FIRED

An ex-employee from First Republic Bank allegedly deployed malware, broke services, and damaged the cloud environment after getting fired for watching pornography on his work laptop. He also impersonated a colleague who got the promotion he wanted. According to the bank, the total damage exceeded $220,000.

theregister.com · 4 min

TLDR InfoSec

OVER 30% OF LOG4J APPS USE A VULNERABLE VERSION OF THE LIBRARY

Log4J took the world by storm when it was first disclosed as being actively exploited in December 2021. A report from Veracode shows that roughly 38% of Log4J applications are still using vulnerable versions of the library.

bleepingcomputer.com · 3 min

TLDR InfoSec

FBI ISSUES GUIDANCE FOR DELAYING SEC-REQUIRED DATA BREACH DISCLOSURE

FBI has issued a clarification to SEC-required data breach disclosure requirements, allowing for a 30 to 60-day delay in cases of national emergency, but not exceeding 120 days without an exemptive order from the SEC.

securityweek.com · 2 min

TLDR InfoSec

Your First 100 Days as a vCISO - 5 Steps to Success

This playbook was developed to help vCISOs in their journey, covering vCISO goals, pitfalls to avoid, 5 phases (research, understand, prioritize, execute, and report), and the key activities for each phase.

bit.ly · 12 min

TLDR InfoSec

AWS SECRETS MANAGER ANNOUNCES 99.99% SLA

AWS Secrets Manager recently announced a 99.99% availability SLA. In the event that AWS fails to meet this SLA in a given billing period, users will be eligible for a credit.

aws.amazon.com · 1 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech