The Daily Index — Monday, December 18, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

RUSSIAN HACKERS ATTACK JETBRAINS’ TEAMCITY SERVERS

Russian-backed hackers have been exploiting a critical vulnerability in JetBrains’ TeamCity servers since September, infiltrating the servers via authorization bypass and arbitrary code execution. The threat actor, CozyBear, has affected more than 30,000 JetBrains customers, compromising dozens of companies and more than a hundred devices in the United States, Europe, Asia, and Australia. JetBrains recommends updating on-premises servers to version 2023.05.4 or later to prevent exploitation.

packetstormsecurity.com · 4 min

TLDR InfoSec

NEW KV-BOTNET TARGETING CISCO, DRAYTEK, AND FORTINET DEVICES FOR STEALTHY ATTACKS

A new botnet called KV-botnet is targeting firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR for covert data transfer by advanced persistent threat actors, including the China-linked threat actor Volt Typhoon. The botnet consists of two activity clusters, KY and JDY, which work together to access high-profile victims and establish covert infrastructure.

thehackernews.com · 2 min

TLDR InfoSec

USING AI TO AUTOMATICALLY FUZZ RUST PROJECTS FROM SCRATCH

A group of researchers have developed a tool called Fuzzomatic that automatically fuzzes Rust projects using AI. The tool attempts to find sample usage to generate a fuzz target by checking the project’s README, any source files under an examples directory, unit tests, benchmarks, or public functions in the project. The researchers tested their tool on 37 of the top 50 starred GitHub projects written in Rust and found new bugs in 14 of them.

research.kudelskisecurity.com · 10 min

TLDR InfoSec

BULK ANALYSIS OF COBALT STRIKE'S BEACON CONFIGURATIONS

This post shares a dataset of Cobalt Strike Beacon payloads and their extracted configurations going back to November 2021. Analysis of the dataset shows that 88.97% of payloads leverage the CreateThread API call for process injection. Nearly 62.81% of the samples in the dataset have the default sleep time of 60,000 milliseconds.

archcloudlabs.com · 3 min

TLDR InfoSec

NEW MICROSOFT INCIDENT RESPONSE TEAM GUIDE SHARES BEST PRACTICES FOR SECURITY TEAMS AND LEADERS

Microsoft has created a downloadable guide called "Navigating the Maze of Incident Response" that focuses on the key factors of people and process in effective incident response. The guide helps organizations structure their incident response teams and define roles and responsibilities, including the need for non-technical support from leadership and other parts of the business.

microsoft.com · 4 min

TLDR InfoSec

to effectively leverage Vulnerability Threat Intelligence (VTI)

to prioritize threats and shape strategies for risk acceptance. Throughout the webinar, they will discuss how to use Vulnerability Threat Intelligence to gauge the true impact of vulnerabilities, shift from patch prioritization to an informed strategy, and preemptively tackle zero-day vulnerabilities and other imminent cyber threats.

tracking.tldrnewsletter.com

TLDR InfoSec

SAVE YOUR SPOT IN THE UPCOMING LIVE WEBINAR

Summary unavailable

tracking.tldrnewsletter.com

TLDR InfoSec

YOUR SMART TV KNOWS WHAT YOU’RE WATCHING

Most modern Smart TVs are sold with Automatic Content Recognition enabled by default. This technology is used to collect data on everything you view and store it in a proprietary database for ad targeting. This article contains steps to disable Automatic Content Recognition on Roku, Samsung, and LG Smart TVs.

themarkup.org · 3 min

TLDR InfoSec

WHAT TO DO WHEN RECEIVING UNPROMPTED MFA OTP CODES

This article discusses what to do after receiving an unprompted MFA OTP code. Assume that the credentials for the site have been compromised and reset passwords for affected sites. Do not click any links in such messages and go directly to the site's URL.

bleepingcomputer.com · 3 min

TLDR InfoSec

CISA RELEASES SCUBA GOOGLE WORKSPACE SECURE CONFIGURATION BASELINES FOR PUBLIC COMMENT

The Cybersecurity and Infrastructure Security Agency (CISA) has released the draft Secure Cloud Business Applications (SCuBA) Google Workspace (GWS) Secure Configuration Baselines for public comment. The draft baselines provide minimum viable security configurations for various GWS services. CISA is encouraging federal agencies and other organizations to adopt these baselines, tailored to their needs, and provide feedback.

cisa.gov · 1 min

TLDR InfoSec

10 YEARS LATER, NEW CLUES IN THE TARGET BREACH

KrebsOnSecurity first reported on a data breach affecting Target perpetrated by a cybercriminal known as Rescator in 2013. This retrospective details the research that KrebsOnSecurity has compiled over the past 10 years on uncovering the identity of Rescator.

krebsonsecurity.com · 8 min

TLDR InfoSec

QUICK TIP: MINIMIZING TERRAFORMED SCPS

AWS Service Control Policies have strict character limits that include whitespace. However, Terraform does not automatically minimize whitespace, which could lead to character count issues.

ramimac.me · 2 min

TLDR InfoSec

CHINA'S MIIT INTRODUCES COLOR-CODED ACTION PLAN FOR DATA SECURITY INCIDENTS

China's Ministry of Industry and Information Technology (MIIT) has introduced a color-coded action plan to address data security incidents in the country.

thehackernews.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech