The Daily Index — Monday, February 5, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

CLOROX SAYS CYBERATTACK COSTS EXCEED $49 MILLION

Clorox disclosed that a 2023 cyber attack has already cost it $49M. The company estimates that the attack will cost another $50-60M in FY24. There are still no details about the attack but it is suspected that it was a ransomware attack.

securityweek.com · 3 min

TLDR InfoSec

ANYDESK SAYS HACKERS BREACHED ITS PRODUCTION SERVERS

AnyDesk reported that it suffered a cyberattack in which threat actors breached production systems. The attackers stole source code and code signing keys. AnyDesk has released a new version with new code signing keys and has reset the web portal passwords of all users.

bleepingcomputer.com · 3 min

TLDR InfoSec

EC2 PRIVILEGE ESCALATION THROUGH USER DATA

This post enumerates methods for escalating privileges on EC2 instances to root/System by modifying the instance’s user data. An attacker can create a new user data script if an instance has the ec2:ModifyInstanceAttribute permissions, replace the old user data with it, and restart the instance. The post covers a method that can be used if the EC2 instance pulls user data scripts or artifacts from S3 and has permissions to modify those buckets.

hackingthe.cloud · 4 min

TLDR InfoSec

THE CURIOUS CASE OF DANGERDEV@PROTONMAIL.ME

This post provides a deep dive into an incident that Invictus responded to. The threat actor was unique in that it utilized a new method of persistence in which it set up a cross-account role. The post divides the threat actor's activities into three primary phases of attack and delves into the motives and impact of each one.

invictus-ir.com · 10 min

TLDR InfoSec

MICROSOFT BREACH — WHAT HAPPENED? WHAT SHOULD AZURE ADMINS DO?

This article covers the sequence of events that led to the Microsoft breach disclosed on January 25, 2024. The article contains diagrams that describe the flow of events as well as information about the breached systems. It also provides detailed instructions for identifying and investigating these applications using the Azure portal.

posts.specterops.io · 11 min

TLDR InfoSec

PROMPT SECURITY (PRODUCT LAUNCH)

Prompt Security safeguards every interaction with GenAI in its organization, such as internal AI tools and commercial products with AI features, by checking each prompt and model response to protect against exposure of sensitive data, block harmful content, and prevent other GenAI-specific attacks.

prompt.security

TLDR InfoSec

HEADCRAB 2.0: EVOLVING THREAT IN REDIS MALWARE LANDSCAPE

The HeadCrab malware that targets Redis databases has been updated with new evasion techniques like fileless loading nearly a year after it was first disclosed. The crypto-mining campaign now has over 2,300 infected servers, which shows the threat actor is adapting to stay under the radar. HeadCrab 2.0 uses advanced techniques for stealth and persistence, demonstrating the attacker's sophistication as it aims to secretly mine cryptocurrency.

aquasec.com · 13 min

TLDR InfoSec

CONFIRMING LARGE-SCALE PEGASUS SURVEILLANCE OF JORDAN-BASED CIVIL SOCIETY

Access Now, in collaboration with Citizen Lab and other organizations, conducted a forensic analysis of iPhones belonging to members of Jordan-based civil society. It confirmed that nine individuals were targeted and/or infected with Pegasus spyware, including journalists, lawyers, and members of civil society.

citizenlab.ca · 2 min

TLDR InfoSec

CISA ORDERS IVANTI DEVICES TARGETED BY CHINESE HACKERS BE DISCONNECTED

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to disconnect Ivanti Connect Secure or Ivanti Policy Secure devices from their networks due to reports of Chinese hackers targeting these devices for espionage operations. It has issued instructions for updating and bringing the devices back online.

cyberscoop.com · 3 min

TLDR InfoSec

DRAFTKINGS HACKER GETS 18-MONTH SENTENCE AIMED AT ‘DETERRING’ SIMILAR CRIMES

Joseph Garrison was sentenced to 18 months for a credential-stuffing attack on DraftKings. He stole $600K total from around 1,600 accounts by adding new payment methods.

washingtonpost.com · 3 min

TLDR InfoSec

JOB HUNTER’S GUIDE TO THE TOP CYBERSECURITY COMPANIES HIRING IN 2024

VentureBeat has published an analysis and spreadsheet of the best companies hiring for cybersecurity in 2024 based on LinkedIn postings and GlassDoor rankings. Kaspersky Lab, ServiceNow, and Cisco Systems lead the rankings.

venturebeat.com · 5 min

TLDR InfoSec

MASTODON FIXED A FLAW THAT CAN ALLOW THE TAKEOVER OF ANY ACCOUNT

Mastodon, a decentralized social network, has fixed a vulnerability that could be exploited by threat actors to impersonate and take over any account.

securityaffairs.com · 1 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech