The Daily Index — Wednesday, February 28, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

MALICIOUS CODE FOUND IN TORNADO CASH GOVERNANCE PROPOSAL

Tornado Cash enables users to make transactions on the Ethereum network without leaving a trace. However, it was recently discovered that a developer snuck a snippet of malicious code into a governance proposal on January 1st that funneled deposit notes to an attacker-controlled server. The exploit only affects transactions made through an IPFS gateway.

cryptopolitan.com · 2 min

TLDR InfoSec

PHARMACEUTICAL GIANT CENCORA SAYS DATA WAS STOLEN IN A CYBERATTACK

Pharmaceutical giant Cencora, formerly AmerisourceBergen, experienced a cyberattack where data was stolen from its IT systems, potentially including personal information. The company contained the breach and is collaborating with authorities and cybersecurity experts to investigate further. No ransomware groups have claimed responsibility for the breach yet but Cencora has clarified that this isn't related to the Optum Change Healthcare ransomware incident.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE NIST CYBERSECURITY FRAMEWORK (CSF) 2.0

This is the official release of version 2.0 of the NIST Cybersecurity Framework (CSF), the first major update since the framework's creation a decade ago. The CSF 2.0 is designed to help all organizations reduce risks, regardless of sector, size, or level of security sophistication.

nvlpubs.nist.gov · 30 min

TLDR InfoSec

ATTACK TECHNIQUES IN OKTA - A REALLY DEEP DIVE INTO OKTA TERMS

Part 1 in a 3 part series on attacking Okta. The first part is a thorough introduction to Okta terminology and the Okta environment, covering primitives as well as a focus on authentication methods. It has a slight attacker perspective but could be useful for defenders looking to increase their Okta knowledge as well.

xmcyber.com · 8 min

TLDR InfoSec

AWS RANSOMWARE ANALYSIS

This post discusses a recent customer engagement that entailed responding to an AWS ransomware attack. The attacker deleted several S3 buckets and then left a ransom note (included in the post) and a recovery binary. The post goes through the CloudTrail actions taken by the attackers as well as an analysis of the recovery binary. It concludes by noting that the binary does not make any connections to AWS (or the internet in general) and would not be able to recover the data.

dfir.ch · 5 min

TLDR InfoSec

INTRODUCING PQL, A PIPELINED QUERY LANGUAGE THAT COMPILES TO SQL (WRITTEN IN GO)

Security logging solutions vendor RunReveal introduced pql to offer an open-source alternative to proprietary languages used by major security vendors. The language is designed to easily integrate with existing products supporting SQL, allowing security teams to query logs efficiently. pql aims to become a standard query language for security professionals, providing an alternative to established platforms.

blog.runreveal.com · 5 min

TLDR InfoSec

LOCKBIT'S LEAK SITE REEMERGES, A WEEK AFTER 'COMPLETE COMPROMISE'

The LockBit ransomware group has relaunched its leak site just a week after a major coordinated takedown by global law enforcement on Feb. 19. The takedown operation seized infrastructure, code, stolen data, keys, and arrested affiliates. LockBit's backup systems remained untouched, enabling the operation to bounce back quickly.

darkreading.com · 4 min

TLDR InfoSec

WHAT HAPPENS TO YOUR SENSITIVE DATA WHEN A DATA BROKER GOES BANKRUPT?

Near was a data broker that specialized in location data. It claimed that it had the location data of 1.6B people across 44 countries. Sen. Ron Wyden requested that the FTC prevent the sale of this data when Near filed for bankruptcy, which they granted. This incident brought many to question who can acquire and license data from data brokers.

themarkup.org · 3 min

TLDR InfoSec

US BLACKLISTS SANDVINE FOR CENSORSHIP, WEB MONITORING IN EGYPT

The US Commerce Department has blacklisted Sandvine Inc., a computer networking company, for supplying technology to the government of Egypt that enabled web monitoring and censorship, going against US national security and foreign policy interests. Sandvine's deep-packet inspection technology was used for internet surveillance and censorship in Egypt, leading to its ban from acquiring US technology components.

bnnbloomberg.ca · 2 min

TLDR InfoSec

2023 PHISHERS' FAVORITES REPORT

This report deep dives into the top industries and companies preferred by phishers. Amongst all industries, the social media sector accounted for the largest YoY increase in phishing URLs at 110%.

vadesecure.com · 15 min

TLDR InfoSec

WHITE HOUSE CALLS FOR GREATER USE OF MEMORY-SAFE LANGUAGES

The Office of the National Cyber Director released a report calling on organizations to reduce the use of memory-unsafe languages like C and C++ in favor of memory-safe languages. The report specifically calls out Rust, Python, and Java as safer alternatives.

therecord.media · 2 min

TLDR InfoSec

A CYBER ATTACK HIT THYSSENKRUPP AUTOMOTIVE BODY SOLUTIONS BUSINESS UNIT

ThyssenKrupp's Automotive division in Saarland suffered a cyber attack, leading to the shutdown of IT systems.

securityaffairs.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech