The Daily Index — Wednesday, March 20, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

MISCONFIGURED FIREBASE INSTANCES LEAKED 19 MILLION PLAINTEXT PASSWORDS

Three cybersecurity researchers found nearly 19 million plaintext passwords exposed on the internet due to misconfigured Firebase instances. They scanned over five million domains and identified 916 vulnerable websites. These instances revealed more than 125 million sensitive user records that included emails, names, passwords, phone numbers, and bank details.

bleepingcomputer.com · 4 min

TLDR InfoSec

BYPASSING USBGUARD ON LINUX

USBGuard on Linux can be bypassed when not configured with specific vendor and product IDs, allowing attackers to circumvent USB authorization policies. Attackers can present devices as innocuous HID or hub devices while actually being malicious by exploiting the kernel's matching process.

pulsesecurity.co.nz · 11 min

TLDR InfoSec

APEX LEGENDS REGIONAL FINALISTS HACKED MID-MATCH

Summary unavailable

pcgamer.com · 2 min

TLDR InfoSec

GAINING KERNEL CODE EXECUTION ON AN MTE-ENABLED PIXEL 8

This blog post describes a logic bug in the memory management unit of the ARM Mali GPU used in Pixel 8 phones that can be used to bypass Memory Tagging Extension (MTE). This vulnerability, GHSL-2023-005, is related to GPU memory handling, particularly JIT memory, and how it is managed by the kbase_context in the Mali GPU driver. Attackers can cause inconsistencies in GPU memory mapping by exploiting the race window between memory growth triggers.

github.blog · 22 min

TLDR InfoSec

HOW TO EMULATE A RANSOMWARE ATTACK

This blog post delves into how SpecterInsight’s ransomware emulation capability functions and provides insights into the operational flow of a full emulated ransomware deployment kill chain. It details the tools used, the ransomware deployment process, ethical considerations, defense evasion techniques, obfuscation methods in PowerShell and C#, and the user prompt element in the ransom message. It also outlines the responsibilities of the encrypter, loader, ransom message/decrypter, and deployment script components in orchestrating the kill chain.

practicalsecurityanalytics.com · 9 min

TLDR InfoSec

BEYONDCORP AND THE LONG TAIL OF ZERO TRUST

This article discusses the challenges faced by Alphabet in migrating to a BeyondCorp-style architecture, specifically the long tail of difficult use cases where gaps in tooling, available data, management buy-in, or specialized technical knowledge historically prevented users from migrating to a zero-trust model. The article also describes the processes, tools, and solutions created to handle these use cases and provides lessons learned to help others address the long tail of migration to a BeyondCorp-style architecture.

usenix.org · 10 min

TLDR InfoSec

LUDUS (GITLAB REPO)

Ludus is a system built on Proxmox to simplify building easy-to-use cyber environments, or 'ranges', for testing and development. It comes with various templates.

gitlab.com

TLDR InfoSec

TWO BYTES IS PLENTY: FORTIGATE RCE WITH CVE-2024-21762

This document details the steps taken to identify a vulnerability in FortiGate and create a working exploit. It explains the changes made to the function, such as additional length checks and error messages, to address the vulnerability.

assetnote.io · 29 min

TLDR InfoSec

KUBERNETES RBAC

A deep-dive into Kubernetes RBAC. The guide provides an overview of RBAC options in Kubernetes, best practices, and tool comparisons. It explores of how RBAC factored into k8s attacks in 2023 and includes a tutorial on using KSOC.

rad.security · 34 min

TLDR InfoSec

MUDDING AROUND: HACKING FOR GOLD IN TEXT-BASED GAMES

This post describes the process of escalating privileges from a restricted shell to an unrestricted shell in a text-based game. It details a method for using echo and history to read and write arbitrary files when standard tools are restricted.

unix-ninja.com · 5 min

TLDR InfoSec

WHITE HOUSE, EPA WARN WATER SECTOR OF CYBERSECURITY THREATS

The White House and the Environmental Protection Agency have warned US governors that cyberattacks are disabling water systems throughout the country.

cyberscoop.com · 3 min

TLDR InfoSec

FTC WARNS SCAMMERS ARE IMPERSONATING ITS EMPLOYEES TO STEAL MONEY

The US Federal Trade Commission has issued a warning about scammers impersonating its employees to steal money from American citizens.

bleepingcomputer.com · 2 min

TLDR InfoSec

ORACLE WARNS THAT MACOS 14.4 UPDATE BREAKS JAVA ON APPLE CPUS

Oracle has advised Apple users to hold off on installing the macOS 14.4 update on ARM-based Macs due to a bug that causes Java processes to abruptly terminate on affected devices. It affects all Java versions from 8 to the latest JDK 22 builds.

bleepingcomputer.com · 2 min