The Daily Index — Friday, February 2, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

LEAKY VESSELS: DOCKER AND RUNC CONTAINER BREAKOUT VULNERABILITIES

Snyk found four "Leaky Vessels" vulnerabilities in core container components that allow container escape to access host OSes. This could let attackers steal sensitive data and further attacks. Users should urgently check for security updates from container vendors and upgrade engines/tools once fixes are available.

snyk.io · 6 min

TLDR InfoSec

CACTUS RANSOMWARE GANG CLAIMS THE SCHNEIDER ELECTRIC HACK

Schneider Electric suffered a data breach after a Cactus ransomware attack hit its Sustainability Business division. The hackers claim to have stolen terabytes of data. The attack impacted the Resource Advisor cloud platform, causing outages.

securityaffairs.com · 2 min

TLDR InfoSec

NEW LINUX GLIBC FLAW LETS ATTACKERS GET ROOT ON MAJOR DISTROS

A new glibc vulnerability that could lead to local privilege escalation in Debian, Ubuntu, and Fedora systems has been discovered. The vulnerability is a heap-based buffer overflow in glibc’s __vsyslog__internal() function, which is used by syslog and vsyslog. Researchers also uncovered three other vulnerabilities in this function and another one in glibc’s qsort() function.

bleepingcomputer.com · 2 min

TLDR InfoSec

MALICIOUS PYPI PACKAGES SLIP WHITESNAKE INFOSTEALER MALWARE ONTO WINDOWS MACHINES

A threat actor known as WS has uploaded 9 malicious Python packages to the PyPI index. The packages contain base64 encoded PE files that drop and execute the WhiteSnake malware onto an infected device. The WhiteSnake malware is an InfoStealer that contains Anti-VM mechanisms. It utilizes Tor to communicate with a C2 server.

thehackernews.com · 3 min

TLDR InfoSec

30 NEW SEMGREP RULES AND A PRIMER ON GENERIC AND YAML FEATURES

This post from Trail of Bits contains 30 new freely available Semgrep rules that it created for Ansible, Java, Kotlin, shell scripts, and Docker Compose. It also contains a detailed discussion of the pros and cons of Generic mode as a means of searching without syntax awareness, as well as an overview of the advantages of using YAML mode for scanning YAML files.

blog.trailofbits.com · 5 min

TLDR InfoSec

004 - ANALYZING A C2 AGENT - PART 2: THE AGENT

This article is the second part of a series analyzing a C2 agent. In this part, the author focuses on the static analysis of the binary to understand its workings, determine if it corresponds to a C2 agent, and identify indicators of compromise. They use tools like PEStudio and dnSpy to analyze the binary and determine that it is a C2 agent binary.

threatanatomy.io · 8 min

TLDR InfoSec

AIM (PRODUCT LAUNCH)

Aim Security is a GenAI security platform designed to protect generative AI apps from prompting attacks and prevent malicious/non-compliant outputs with a focus on safeguarding privacy and stopping data leaks.

aim.security

TLDR InfoSec

HACKERS STEAL $112 MILLION OF XRP RIPPLE CRYPTOCURRENCY

Ripple co-founder Chris Larsen disclosed hackers stole around $112M in XRP crypto from his personal wallets on Tuesday. He caught the unauthorized access quickly, freezing affected accounts and notifying exchanges and law enforcement.

techcrunch.com · 3 min

TLDR InfoSec

MERCEDES-BENZ SOURCE CODE AT RISK: GITHUB TOKEN MISHAP SPARKS MAJOR SECURITY CONCERNS

A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server.

redhuntlabs.com · 3 min

TLDR InfoSec

U.S. GOVERNMENT DISRUPTS BOTNET PEOPLE’S REPUBLIC OF CHINA USED TO CONCEAL HACKING OF CRITICAL INFRASTRUCTURE

The U.S. government has disrupted a botnet that was used by state-sponsored hackers from the People's Republic of China (PRC) to conceal hacking activities targeting critical infrastructure organizations in the United States and other countries. The operation removed the malware from the routers and severed their connection to the botnet.

justice.gov · 4 min

TLDR InfoSec

JOHNSON CONTROLS RANSOMWARE CLEANUP COSTS TOP $27M AND COUNTING

Johnson Controls International (JCI) spent $27 million remediating a September 2023 ransomware attack on its systems.

darkreading.com · 2 min

TLDR InfoSec

EUROPCAR SAYS SOMEONE LIKELY USED CHATGPT TO PROMOTE A FAKE DATA BREACH

Europcar has announced that a data breach that alleges to have leaked its customer data is fake. Troy Hunt concurs with this and says that the sample data doesn’t make sense.

techcrunch.com · 2 min

TLDR InfoSec

SIM-SWAPPING RING STOLE $400M IN CRYPTO FROM A US COMPANY

A Chicago man and his co-conspirators have been charged with running the nation’s largest SIM swap scheme yet. They stole over $400M in cryptocurrency by targeting over 50 victims in more than a dozen states.

arstechnica.com · 3 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech