The Daily Index — Wednesday, March 6, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

AMERICAN EXPRESS CREDIT CARDS EXPOSED IN THIRD-PARTY DATA BREACH

Some of American Express' customers' credit card data was exposed after a merchant processor was hacked. American Express itself was not breached. The breach at the third-party service provider led to unauthorized access to customers' account numbers, names, and card expiration dates. It is unclear how many customers were impacted.

bleepingcomputer.com · 3 min

TLDR InfoSec

JETBRAINS RELEASES URGENT ADVISORY ON VULNERABILITIES AFFECTING TEAMCITY

JetBrains has advised users to urgently patch two vulnerabilities in TeamCity servers. The less severe vulnerability allows unauthenticated users to obtain a limited amount of information disclosure and modification while the more severe vulnerability allows for a total server compromise. Cloud instances have been patched and show no evidence of exploitation.

therecord.media · 3 min

TLDR InfoSec

UNLEASHING ZERO-CLICK WORMS THAT TARGET GENAI-POWERED APPLICATIONS

Researchers created a computer worm called Morris II that targets AI-powered applications by using adversarial self-replicating prompts. They demonstrated it against AI email assistants for spamming and data exfiltration across different models and input types. The worm replicates itself through prompts that make AI models engage in malicious activities and propagation.

sites.google.com · 20 min

TLDR InfoSec

THE ELI5 GUIDE TO PROMPT INJECTION

An in-depth guide on different types of Prompt Injection attacks. The guide also includes real-world examples of some attacks, best practices for preventing prompt injection, and tools that can aid in defending against prompt injection.

lakera.ai · 18 min

TLDR InfoSec

HOW TO MAKE NMAP RECOGNIZE NEW SERVICES

A guided tutorial on adding a new service detection to nmap. It walks through the process of cloning nmap, understanding the OPC UA specification, writing a script to capture the relevant probe, and adding the probe to nmap. It also includes details for testing and contributing the change to the official nmap project.

shufflingbytes.com · 5 min

TLDR InfoSec

FIREWALL FOR AI FROM CLOUDFLARE (PRODUCT LAUNCH)

Cloudflare is launching Firewall for AI, a protection layer to identify abuses against large language models before they reach the models. It will include features like rate limiting, sensitive data detection, and prompt validation to detect exploits and data extraction attempts, leveraging Cloudflare's network to protect users and LLMs.

blog.cloudflare.com

TLDR InfoSec

FREE CERTIFICATE EXPIRY MONITORING VIA RSS

A free service that allows users to subscribe to TlS certificate expiry notifications via RSS. No sign-up is required and notifications are generated at 30 days, 7 days, and 1 day until expiration.

raphting.dev · 1 min

TLDR InfoSec

RAPID7 THROWS JETBRAINS UNDER THE BUS FOR 'UNCOORDINATED VULNERABILITY DISCLOSURE'

Security firm Rapid7 criticized JetBrains for silently patching two vulnerabilities in TeamCity before public disclosure, violating coordinated vulnerability disclosure norms. Despite Rapid7's policy against silent patching, JetBrains released patches without an advisory or notifying researchers. Rapid7 then published details of the vulnerabilities after JetBrains ignored inquiries.

theregister.com · 5 min

TLDR InfoSec

FAKE RANSOMWARE GANG ADMITS IT MADE UP EPIC GAMES HACK

A fake ransomware group called Mogilevich admitted to lying about hacking Fortnite maker Epic Games in an attempt to trick hackers into buying tools from them. The group claimed to have accessed Epic's data but later revealed they fabricated the incident to quickly gain visibility and scam victims through their trafficking scheme.

ign.com · 2 min

TLDR InfoSec

RETIRED ARMY OFFICER CHARGED WITH SHARING CLASSIFIED INFORMATION ABOUT UKRAINE ON FOREIGN DATING SITE

A retired Army lieutenant colonel, David Slater, was arrested and accused of disclosing sensitive national defense information. Slater was the victim of a romance scam and disclosed information about Ukraine including details of officials and command centers. Some of the information provided was classified as secret.

cbsnews.com · 3 min

TLDR InfoSec

BLACKCAT RANSOMWARE GROUP IMPLODES AFTER APPARENT $22M PAYMENT BY CHANGE HEALTHCARE

Change Healthcare reportedly made a $22 million payment to the BlackCat ransomware group. However, the FBI seized BlackCat's website and the group attempted an exit scam by withholding ransomware payment commissions and shutting down.

krebsonsecurity.com · 5 min

TLDR InfoSec

THESE VIDEO DOORBELLS HAVE TERRIBLE SECURITY. AMAZON SELLS THEM ANYWAY

Many widely used internet-connected video doorbells have significant security flaws. These devices often expose sensitive information like home IP addresses and WiFi network names without encryption, leaving them vulnerable to cyber-attacks.

consumerreports.org · 10 min