The Daily Index — Wednesday, February 14, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

BANK OF AMERICA WARNS CUSTOMERS OF DATA BREACH AFTER VENDOR HACK

Bank of America is sending notification letters to 57,000 customers to inform them that their personal information was stolen in a data breach at third-party services provider Infosys McCamish System. Losses related to the incident were estimated at $30 million.

bleepingcomputer.com · 3 min

TLDR InfoSec

3.5M EXPOSED IN COVID-19 E-PASSPORT LEAK

A state in India required travelers to obtain a COVID-19 e-pass mandatory. Researchers recently discovered that this data was stored in an open S3 bucket. The leaked data includes names, passport numbers, gender information, mobile numbers, email addresses, travel details, and vehicle numbers.

cybernews.com · 2 min

TLDR InfoSec

🔍 DIVE INTO THE REDLINE STEALER INFECTION CHAIN – PART 1

This post is part of a series that dives into RedLine stealer. RedLine Stealer is a malware available on underground forums for sale as a standalone at $100/$150, depending on the version, or on a subscription basis at $100/month. This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information.

securityinbits.com · 8 min

TLDR InfoSec

EXPLORING RED TEAM PERSISTENCE VIA AWS LEX CHABOT’S

This blog post explores how attackers can hijack AWS Lex Chabots with a “sleeper phrase” that returns the Lambda function’s role credentials. The post goes through the process of debugging to find the relevant intent file to update and the correct formatting to have Lex return the message properly.

medium.com · 9 min

TLDR InfoSec

CONDITIONAL LOVE FOR AWS METADATA ENUMERATION

aws:ResourceAccount, as well as various other global conditions, can be used with the StringLike operand to enumerate account IDs, tags, and other metadata across most AWS APIs. The post includes a tool to automate the process.

blog.plerion.com · 5 min

TLDR InfoSec

SEAL SECURITY (PRODUCT LAUNCH)

Seal is a supply chain security tool that differentiates itself by providing patches to vulnerable packages instead of pushing for updates to the packages.

seal.security

TLDR InfoSec

OPENSSF SECURING SOFTWARE REPOSITORIES WORKING GROUP RELEASES PRINCIPLES FOR PACKAGE REPOSITORY SECURITY

CISA and the OpenSSF Securing Software Repositories Working Group have published a new framework for securing package repositories. Principles for Package Repository Security is a framework aimed at establishing a set of foundational rules for package managers and further harden open-source software ecosystems.

openssf.org · 3 min

TLDR InfoSec

THE NINE LIVES OF COMMANDO CAT

Commando Cat is a novel infostealer malware campaign that targets unsecured Docker API endpoints. The attack begins by launching the malicious Docker container and then escaping to the host. The malware then installs several backdoors and a credential stealer. It removes any other crypto miners and black holes in the Docker registry to prevent competition. This post includes IoCs and Yara rules.

cadosecurity.com · 8 min

TLDR InfoSec

DECRYPTED: RHYSIDA RANSOMWARE

Avast has made the Rhysida decryptor publicly available. It has been available to victims of the Rhysida ransomware since August 2023. This document provides instructions on how to use the decryptor, including parameters that affect the encryption and decryption process, and explains the option to back up encrypted files before decryption.

decoded.avast.io · 3 min

TLDR InfoSec

REWARD OFFERS FOR INFORMATION TO BRING HIVE RANSOMWARE VARIANT CO-CONSPIRATORS TO JUSTICE

The U.S. Department of State has announced monetary rewards of up to $10 million for information about individuals holding key positions within the Hive ransomware operation.

state.gov · 2 min

TLDR InfoSec

MIT STUDENT CLAIMS TO HACK APPLE VISION PRO ON LAUNCH DAY

A PhD student at MIT posted a photo on X alleging to have discovered a kernel exploit in the Apple Vision Pro on launch day.

cybernews.com · 1 min

TLDR InfoSec

WI-FI JAMMING TO KNOCK OUT CAMERAS SUSPECTED IN NINE MINNESOTA BURGLARIES

A serial burglar in Edina, Minnesota is suspected of using a Wi-Fi jammer to disable connected security cameras before committing burglaries.

tomshardware.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech