The Daily Index — Friday, January 12, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

FIDELITY NATIONAL FINANCIAL SAYS HACKERS STOLE DATA ON 1.3 MILLION CUSTOMERS

Real estate giant Fidelity National Financial (FNF) has confirmed hackers stole 1.3 million customer records in a November cyberattack. FNF said unauthorized third parties accessed systems, deployed malware, and exfiltrated data. The company notified affected customers, applicable state attorneys general, and regulators. The stolen data appears to be sensitive as FNF is providing credit monitoring to impacted customers.

techcrunch.com · 3 min

TLDR InfoSec

FRAMEWORK DISCLOSES DATA BREACH AFTER ACCOUNTANT GETS PHISHED

Framework Computer disclosed a data breach caused by an employee of its accounting service provider being phished. The accountant shared a spreadsheet containing full names, email addresses, and outstanding balances of employees with unpaid balances to an attacker impersonating the CEO of Framework. Affected customers have been notified.

bleepingcomputer.com · 2 min

TLDR InfoSec

PANIC!! AT THE YAML

This post contains a deep dive into a remote code execution vulnerability in the SnakeYAML library. The post begins with describing how !! fields work in YAML and how the deserialization vulnerability allows for instantiating Java classes. It then goes through the process of developing an exploit against the vulnerability to eventually achieve remote code execution.

labs.greynoise.io · 5 min

TLDR InfoSec

A GAMER TURNED MALWARE DEVELOPER: DIVING INTO SILVERRAT AND ITS SYRIAN ROOTS

An in-depth analysis of the SilverRAT malware. The article includes an analysis of how SilverRAT operates, the code builder platform and options that are sold with it, and the admin panel that is used for C2 operations. It concludes with OSINT to delve into the developers’ backgrounds and IOCs for the malware.

cyfirma.com · 8 min

TLDR InfoSec

WHEN EXTRACTION MEETS ANALYSIS: CELLEBRITE PHYSICAL ANALYZER

In this blog post, ElcomSoft discusses using its Elcomsoft iOS Forensic Toolkit along with other analysis tools like Cellebrite Physical Analyzer. The post provides instructions for opening and analyzing data extracted using Elcomsoft iOS Forensic Toolkit in Cellebrite Physical Analyzer. Elcomsoft is also examining compatibility with other top-tier tools and is open to partnerships and collaborations.

blog.elcomsoft.com · 5 min

TLDR InfoSec

YOU HAD ME AT HI — MIRAI-BASED NOABOT MAKES AN APPEARANCE

Akamai uncovered a new crypto mining campaign active in 2023 spreading via SSH using a custom Mirai botnet called NoaBot. NoaBot has wormable self-spreading capabilities and an SSH key backdoor. It drops a modified XMRig miner with an obfuscated config and custom mining pool. Evidence links it to 2023's P2PInfect worm, but immature names complicate attribution.

akamai.com · 9 min

TLDR InfoSec

SANDWORM PROBABLY WASN’T BEHIND DANISH CRITICAL INFRASTRUCTURE CYBERATTACK, REPORT SAYS

According to cybersecurity firm Forescout, last year's cyberattack against Danish critical infrastructure, which was believed to be conducted by Sandworm, was likely not the work of the Russian hacking group. Forescout's research indicates that the two waves of attacks were unrelated and that Sandworm probably did not have anything to do with it.

cyberscoop.com · 3 min

TLDR InfoSec

HERE’S SOME BITCOIN: OH, AND YOU’VE BEEN SERVED!

A Californian man who lost $100,000 in a SIM-swapping attack has obtained permission from a federal judge to serve and sue the unknown owner of a crypto wallet via delivery of bitcoin to the wallet. This is the first-ever ruling of its kind and may provide new avenues for victims of crypto theft to retrieve funds.

krebsonsecurity.com · 5 min

TLDR InfoSec

MICROSOFT TESTING WINDOWS 11 USB 80GBPS SUPPORT, COPILOT ON LOGIN

Microsoft is testing the USB4 Version 2.0 specification, which supports transfer speeds of up to 80 Gbps over USB Type-C cables, in Windows 11.

bleepingcomputer.com · 2 min

TLDR InfoSec

SECURITY FIRM MANDIANT SAYS IT DIDN’T HAVE 2FA ENABLED ON ITS HACKED TWITTER ACCOUNT

Security firm Mandiant revealed that it did not have two-factor authentication (2FA) enabled on its hacked X account, leaving the account vulnerable to brute-force password attacks.

grahamcluley.com · 3 min

TLDR InfoSec

CROOKS POSE AS RESEARCHERS TO RETARGET RANSOMWARE VICTIMS

Threat actors posing as cybersecurity researchers are contacting victims of the Royal and Akira ransomware gangs, offering to delete files the groups have stolen for a fee.

packetstormsecurity.com · 3 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech