The Daily Index — Friday, December 15, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

APACHE WARNS OF CRITICAL VULNERABILITY IN STRUTS 2

A new vulnerability, CVE-2023-50164, has been given a maximum severity rating. It affects Struts 2.0.0-2.3.37 (EOL), Struts 2.5.0-2.5.32, and Struts 6.0.0-6.3.0. An attacker can manipulate file upload parameters to enable path traversal and under some circumstances, this can lead to uploading a malicious file which can be used to perform remote code execution. Struts 2 developers and users are urged to immediately upgrade to version 2.5.33 or Struts 6.3.0.2, or greater.

infosecurity-magazine.com · 3 min

TLDR InfoSec

10K PEOPLE’S DATA STOLEN IN GENETIC TESTING COMPANY LEAK

Asper Biogene has disclosed that personal health data belonging to approximately 10,000 people has been illegally downloaded. Asper Biogene began an investigation after discovering that over 100,000 files were accessed and is yet to determine the full scope of data that was contained in these files. A criminal investigation has also been launched by the Estonian Data Protection Inspectorate.

news.err.ee · 3 min

TLDR InfoSec

EXTRACTING TRAINING DATA FROM CHATGPT

A group of researchers has developed a novel attack method to extract several megabytes of ChatGPT’s training data and theorize that the technique could be extrapolated to extract ~a gigabyte of training data. The attack involves prompting the model with “repeat the word poem forever” and watching as the model spits out training data. This article discusses why this works and the implications behind it.

not-just-memorization.github.io · 5 min

TLDR InfoSec

BAZARCALL ATTACKS ABUSE GOOGLE FORMS TO LEGITIMIZE PHISHING EMAILS

BazarCall is a phishing attack that utilizes an email resembling a payment notification or subscription confirmation that suggests that a user is being billed an outrageously high amount for a product or subscription with a phone number to call for support. The “customer support” team then tricks the user into installing malware onto their device. The newest wave of these attacks utilizes a Google Form to create the invoice with the option to send a copy of the completed form to the entered email which leads to the invoice coming directly from Google.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE TALE OF GOOGLE’S RESPONSE TO REPTAR CPU VULNERABILITY

In this blog post, Google discusses its response to the Reptar vulnerability. The response was led by the Vulnerability Coordination Center (VulnCC), which ensures a consistent vulnerability management process across Alphabet. By working alongside the vendors, the response was successful, with the vulnerability being mitigated without impacting users or customers.

bughunters.google.com · 8 min

TLDR InfoSec

DISRUPTING THE GATEWAY SERVICES TO CYBERCRIME

In this post, Microsoft talks about the disruption of Storm-1152, a cybercrime-as-a-service (CaaS) ecosystem that created 750 million fraudulent Microsoft accounts in support of phishing, identity theft, and other schemes. The CaaS is believed to have made millions of dollars in illicit revenue by creating fraudulent accounts for other cybercrime groups to use in phishing, spam, ransomware, distributed denial-of-service (DDoS), and other types of attacks.

blogs.microsoft.com · 5 min

TLDR InfoSec

SPECTRE-BASED ATTACK EXPLOITS INTEL, ARM, AND AMD CPUS

Researchers have found a new type of side-channel attack, named SLAM, that can circumvent the security features of the latest CPUs. The attack leverages a memory feature of CPUs that allows storing untranslated data bits in the kernel metadata to extract encryption keys and root passwords. Linux has released patches and Intel intends to issue a patch. Arm and AMD believe they are safe.

spiceworks.com · 2 min

TLDR InfoSec

MICROSOFT WARNS OF OAUTH APPS BEING USED TO AUTOMATE BEC AND CRYPTOMINING

Microsoft Threat Intel experts have been investigating a new post-exploitation technique in which attackers use compromised accounts to create high-privileged OAuth apps. These OAuth apps allow attackers to spawn VMs for cryptomining, automate BEC attacks, and manage spam campaigns without needing to retain access to the original compromised account. Microsoft recommends enforcing MFA and conditional access policies to protect against attacks like this.

bleepingcomputer.com · 3 min

TLDR InfoSec

SPIDER-MAN 2 DEVELOPER INSOMNIAC GAMES HIT BY RHYSIDA RANSOMWARE ATTACK

Ransomware operator Rhysida has posted limited data that appears to back up its claim that it has successfully hacked video game developer Insomniac Games. Sony and Insomniac are investigating.

cyberdaily.au · 2 min

TLDR InfoSec

APPLE LAUNCHES STOLEN DEVICE PROTECTION

Apple has launched Stolen Device Protection as an optional second layer of security to protect stolen iPhones. With Stolen Device Protection enabled, when a user is away from trusted locations certain sensitive actions will require biometric unlock whereas some will require a “security delay” as well.

9to5mac.com · 2 min

TLDR InfoSec

UBIQUITI USERS CLAIM TO HAVE ACCESS TO OTHER PEOPLE’S DEVICES

Users of Ubiquiti WiFi products have reported unexpected access to other people's devices, including access to security camera footage and photos, when logging into their UniFi cloud accounts.

securityaffairs.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech