The Daily Index — Monday, January 15, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

GITLAB WARNS OF CRITICAL ZERO-CLICK ACCOUNT HIJACKING VULNERABILITY

GitLab has released updates for two critical vulnerabilities, including CVE-2023-7028 for account takeover without user interaction by resetting passwords via unverified emails. CVE-2023-7028 has a 10.0 CVSS score. GitLab has released patches to address the critical flaws.

bleepingcomputer.com · 3 min

TLDR InfoSec

HACKERS CAN HIJACK YOUR BOSCH THERMOSTAT AND INSTALL MALWARE

Bitdefender Labs discovered that the Bosch BCC100 thermostat is vulnerable to cyber attacks that allow attackers to manipulate settings and install malware on the device. The vulnerability was discovered on August 29, 2023, and Bitdefender responsibly disclosed the flaw on January 11, 2024.

hackread.com · 3 min

TLDR InfoSec

15 TOP OPEN-SOURCE INTELLIGENCE TOOLS

Open-source intelligence (OSINT) involves collecting and analyzing publicly available information. It is used by security pros, hackers, and intelligence agencies to uncover sensitive details. OSINT complements operational security (OPSEC). Organizations use it to find exposed data that could help attackers. This list goes into what are some top OSINT tools for analyzing public data, identifying security risks, and improving practices.

medium.com · 16 min

TLDR InfoSec

NEW PYTHON-BASED FBOT HACKING TOOLKIT AIMS AT CLOUD AND SAAS PLATFORMS

SentinelOne researchers have reported a new hacking toolkit called Fbot. The tool features credential harvesting techniques, AWS account hijacking tools, and functions to enable attacks against PayPal and other SaaS accounts. It utilizes a Lithuanian fashion retailer to validate PayPal credentials.

thehackernews.com · 2 min

TLDR InfoSec

HUNTING M365 INVADERS

This blog post provides an overview of available data sources and methods for detecting initial access to Microsoft 365 environments. It covers how the Unified Audit Log and Azure AD logs can be utilized for detection. It then covers techniques and queries for detecting the following attack methods: password spraying, illicit consent grants, device code phishing, MFA fatigue, MFA enumeration, and adversary in the middle.

splunk.com · 8 min

TLDR InfoSec

SECGPT (CHATGPT AGENT)

Jason Haddix has published his personal GPT for offensive security. It is meant to act as a peer to aid ethical hackers with up-to-date research and methodology.

chat.openai.com

TLDR InfoSec

MEDUSA RANSOMWARE TURNING YOUR FILES INTO STONE

The Medusa ransomware group has increased attacks after launching a dark web leak site in February 2023 to publish data from victims refusing to comply with demands. The group's multi-extortion strategy offers victims options like extensions or data deletion for a price. Medusa emerged in 2022 and targets diverse sectors, impacting 74 organizations in 2023. Its attacks exploit internet-facing vulnerabilities and hijack accounts, often using initial access brokers for network access.

unit42.paloaltonetworks.com · 8 min

TLDR InfoSec

APACHE APPLICATIONS TARGETED BY STEALTHY ATTACKER

Researchers have identified attacks exploiting Apache Hadoop and Flink misconfigurations to deploy crypto miners. The malware uses packers and rootkits to hide, delete contents, and modify configs for evasion. Hadoop attacks abuse a YARN ResourceManager misconfiguration, allowing remote code execution via crafted requests and Flink attacks similarly to achieve unauthenticated remote code execution by targeting a misconfiguration.

blog.aquasec.com · 8 min

TLDR InfoSec

FINLAND WARNS OF AKIRA RANSOMWARE WIPING NAS AND TAPE BACKUP DEVICES

The Finnish National Cybersecurity Center has warned of increased activity of the Akira ransomware in December, with six out of seven ransomware incidents reported last month being attributed to the ransomware. The ransomware has been wiping backups, which amplifies the damage of the attack and puts more pressure on victims to pay the ransom.

bleepingcomputer.com · 2 min

TLDR InfoSec

FCC CHAIR ASKS AUTOMAKERS ABOUT PLANS TO STOP ABUSE FROM USING CAR ELECTRONICS TO STALK PARTNERS

The chair of the FCC has formally requested that automakers provide plans to prevent abusive partners from using car features that collect location data to stalk partners.

apnews.com · 3 min

TLDR InfoSec

A GEOFENCE WARRANT TYPO CAST A LOCATION DRAGNET SPANNING TWO MILES OVER SAN FRANCISCO

The ACLU recently discovered a typo in a geofence warrant that led to the collection of personal information of users in a two-mile span of San Francisco. The ACLU is using this issue to put a spotlight on the overly wide reach of geofence warrants.

techcrunch.com · 2 min

TLDR InfoSec

29-YEAR-OLD UKRAINIAN CRYPTOJACKING KINGPIN ARRESTED FOR EXPLOITING CLOUD SERVICES

A 29-year-old Ukrainian national has been arrested for running a sophisticated cryptojacking scheme that earned them over $2 million in illicit profits.

thehackernews.com · 1 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech