The Daily Index — Monday, January 8, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

HOW 50% OF TELCO ORANGE SPAIN’S TRAFFIC GOT HIJACKED — A WEAK PASSWORD

This article describes how Telco Orange Spain experienced an outage due to a BGP hijack that resulted in a 50% drop in traffic from Orange Spain customers. The threat actor gained access to Orange's RIPE account, which manages internet IP addresses. The account had weak security measures, such as no two-step authentication and a lack of password policy.

doublepulsar.com · 2 min

TLDR InfoSec

A CYBER ATTACK HIT THE BEIRUT INTERNATIONAL AIRPORT

Hackers breached the Flight Information Display System and Baggage Handling System at Beirut International Airport Rafic Hariri in Lebanon. The cyber attack disrupted the baggage inspection system, forcing personnel to use police dogs to complete the inspection procedures. No threat actor has claimed responsibility for the attack.

securityaffairs.com · 1 min

TLDR InfoSec

LAB SETUP FOR VULNERABILITY ASSESSMENT AND PENETRATION TESTING

This article shares a collection of scripts and tools that helps anyone get started with vulnerability assessments and penetration testing with an optimized workflow. The setup identifies open ports, missing headers, weak crypto, hidden files, subdomains, and more, requiring only the target domain name. It runs on any Docker-compatible OS.

medium.com · 4 min

TLDR InfoSec

SCALING VULNERABILITY MANAGEMENT ACROSS THOUSANDS OF SERVICES AND MORE THAN 150 MILLION FINDINGS

A post from GitHub explaining how it tamed its disparate vulnerability remediation processes with the creation of a Security Findings tool. The tool features a dynamic UI that can aggregate findings from various sources and display them at various levels to suit developer experience. The post also discusses the changing requirements that led to folding security exceptions into the tool.

github.blog · 7 min

TLDR InfoSec

SETTING SECURE DEFAULTS ON AWS AND AVOIDING MISCONFIGURATIONS

This blog post discusses preventative measures that can be taken to ensure secure defaults in AWS. The post includes tools to prevent public exposure of resources, prevent some risky behaviors, and enforce security measures. This is part of a series and assumes that SCPs from a previous post have been applied.

wiz.io · 14 min

TLDR InfoSec

GHOST IN THE WEB SHELL: INTRODUCING SHELLSWEEP

ShellSweep is a tool that detects potential web shells in servers. The tool includes three utilities that work together (ShellScan, ShellCSV, and ShellSweep) to provide a comprehensive defense against web shells. The article suggests using the tools alongside regular audits.

splunk.com · 8 min

TLDR InfoSec

FIRE SALE: ZEPPELIN RANSOMWARE SOURCE CODE SELLS FOR $500 ON DARK WEB

A threat actor recently sold the Zeppelin ransomware source code for just $500, potentially reviving the Russian ransomware, which has been used in the past in attacks on critical US infrastructure. Zeppelin is a VegaLocker derivative written in Delphi. The CISA and FBI released IoCs on Zeppelin TTPs in 2022. This cheap sale may signal a ransomware-as-a-service revival.

darkreading.com · 4 min

TLDR InfoSec

BITWARDEN HEIST - HOW TO BREAK INTO PASSWORD VAULTS WITHOUT USING PASSWORDS

Bitwarden's Windows Hello implementation had an unexpected consequence - allowing remote theft of credentials without knowing the password or requiring biometric authentication. The issue enabled accessing Bitwarden vaults on compromised workstations without end-user interaction. It has since been fixed in v2023.4.0.

blog.redteam-pentesting.de · 7 min

TLDR InfoSec

DEEP DIVE INTO THE NEW AMAZON EKS CLUSTER ACCESS MANAGEMENT FEATURES

AWS launched a new feature of EKS called Cluster Access Management to simplify granting and managing access to EKS clusters. This new feature broadly allows managing access to an EKS cluster via the AWS API. This allows for mapping AWS identities to pre-defined AWS-managed Kubernetes permissions, mapping AWS identities to Kubernetes groups, and gaining visibility into shadow admins.

securitylabs.datadoghq.com · 7 min

TLDR InfoSec

2023 CVE DATA REVIEW

This post dives into the newly released CVEs of 2023. We ended 2023 with 28,902 published CVEs, up over 15% from the 25,081 CVEs published in 2022.

jerrygamblin.com · 4 min

TLDR InfoSec

MERCK SETTLES WITH INSURERS REGARDING A $1.4 BILLION CLAIM OVER NOTPETYA DAMAGES

Merck has settled a dispute with insurers over a $1.4 billion claim related to the NotPetya malware incident that disrupted its operations worldwide in 2017.

securityaffairs.com · 2 min

TLDR InfoSec

KEYBASE ROOT CA EXPIRED

Keybase suffered an outage as the New Year started that was caused by a root CA expiring. Users must manually update their apps to restore functionality.

x.com · 1 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech