The Daily Index — Friday, March 8, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

APPLE FIXES TWO NEW IOS ZERO-DAYS EXPLOITED IN ATTACKS ON IPHONES

Apple has released fixes for two new iOS and iPadOS vulnerabilities. The first vulnerability is in the iOS Kernel and the second is in RTKit. Both vulnerabilities allow attackers with arbitrary kernel read and write permissions to bypass kernel memory permissions.

bleepingcomputer.com · 2 min

TLDR InfoSec

WOGRAT MALWARE ABUSES ONLINE NOTEPAD SERVICES TO STORE MALWARE

A new malware strain that targets both Windows and Linux is being distributed as a base64 encoded payload from the aNotepad service. The WogRAT malware on Windows is loaded as a DLL and communicates with C2 servers via POST requests to receive commands for uploading and downloading files, waiting, running arbitrary commands, and terminating. The Linux version behaves similarly except that it uses a TinySHell backdoor to communicate with the C2 server over a reverse shell.

bleepingcomputer.com · 3 min

TLDR InfoSec

FROM CYBERCRIME TO CYBERSECURITY: THE REDEMPTION AND REVOLUTION OF THE FOUNDER OF HIVE FORENSICS

This interview delves into the extraordinary journey of Sam Paniagua, founder of fraud prevention firm Hive Forensics. An unconventional path, Paniagua's story is one of transformation, redemption, and unwavering determination in using cybersecurity innovation to safeguard dreams, livelihoods, and digital society's foundations.

medium.com · 4 min

TLDR InfoSec

HOW TO HUNT FOR UEFI MALWARE USING VELOCIRAPTOR

UEFI attacks, which require advanced techniques, are becoming more prevalent. This article begins with an overview of the UEFI system and common attacks on UEFI malware. It then works through Rapid7’s Velociraptor tool’s capabilities for performing forensic investigations on UEFI malware-infected systems.

rapid7.com · 7 min

TLDR InfoSec

MEET SILVER SAML: GOLDEN SAML IN THE CLOUD

Golden SAML is a post-exploitation attack technique that involves extracting signing certificates from Active Directory Federation Services to forge signing certificates. In the wake of the Solar Winds attack, organizations were urged to move to a cloud-based SAML like Entra ID to prevent Golden SAML attacks. This post presents a new attack method that leverages externally generated SAML certificates to forge authentication responses from an Entra ID SAML server.

semperis.com · 15 min

TLDR InfoSec

HOW CISA FIGHTS CYBER THREATS DURING ELECTION PRIMARY SEASON

CISA has set up an Election Operations Center to coordinate threat responses for the 2024 primaries and elections, providing cybersecurity training, guidelines, and a Protect2024 website with resources for state officials. No credible threats have been detected yet. CISA is focused on potential DDoS, ransomware, and emerging AI risks to secure the electoral process.

darkreading.com · 6 min

TLDR InfoSec

JAPAN ORDERS LOCAL GIANTS LINE AND NAVER TO DISENTANGLE THEIR TECH STACKS

Japan ordered messaging app LINE and its parent company NAVER to separate their tech stacks after a data breach exposed over 510,000 users' data. The government cited deep entanglements between the companies' systems and authentication services that enabled unauthorized access. They must now implement their own authentication tools and minimize interconnections.

theregister.com · 3 min

TLDR InfoSec

NSA RELEASES MATURITY GUIDANCE FOR THE ZERO TRUST NETWORK AND ENVIRONMENT PILLAR

The NSA has released a Cybersecurity information sheet that provides guidance on how to strengthen internal network control and contain network intrusions to a segmented portion of the network using Zero Trust principles. It is assisting DoD customers in piloting Zero Trust systems and is developing additional guidance for incorporating Zero Trust principles and designs into enterprise networks.

nsa.gov · 2 min

TLDR InfoSec

WORLDCOIN HIT WITH TEMPORARY BAN IN SPAIN OVER PRIVACY CONCERNS

Spain’s data protection authority has ordered Worldcoin to temporarily stop collecting and processing personal data from the market.

techcrunch.com · 2 min

TLDR InfoSec

FLIPPER ZERO WIFI ATTACK CAN UNLOCK AND STEAL TESLA CARS

Security researchers report that Flipper Zero devices can be used to execute an easy phishing attack that can compromise Tesla accounts and unlock and steal cars.

bleepingcomputer.com · 3 min

TLDR InfoSec

FBI: U.S. LOST RECORD $12.5 BILLION TO ONLINE CRIME IN 2023

The FBI's Internet Crime Complaint Center (IC3) reported a record $12.5 billion in online crime losses in 2023, a 22% increase from the previous year, with 880,000 complaints received.

bleepingcomputer.com · 2 min