The Daily Index — Monday, March 25, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW LOOP DOS ATTACK MAY IMPACT UP TO 300,000 ONLINE SYSTEMS

A new DoS attack relies on a vulnerability in the UDP protocol that allows for IP spoofing. If an attacker launches an attack against a vulnerable server with the spoofed IP of another vulnerable server, the servers will continuously respond with errors to each other until all resources are exhausted. It is estimated that 300,000 servers are vulnerable to this attack.

bleepingcomputer.com · 2 min

TLDR InfoSec

KDE ADVISES EXTREME CAUTION AFTER THEME WIPES USER’S FILES

In light of a Reddit user reporting that installing a KDE Plasma theme wiped all of their files, KDE has issued a warning to vet themes before installing them. This is because themes can be uploaded by anyone and by the nature of how they change the behavior of KDE, they must execute arbitrary code. KDE has promised to make its security warnings more clear and, resources permitting, begin to vet themes.

bleepingcomputer.com · 3 min

TLDR InfoSec

REMOTE CODE EXECUTION (RCE) LATERAL MOVEMENT TACTICS IN CLOUD EXPLOITATION

This blog post discusses Remote Code Execution (RCE) in the context of cloud environments, specifically focusing on AWS. It explains the steps attackers can use to exploit RCE vulnerabilities in the cloud with blurbs about how Uptycs can help, but the advice and insights should be common enough to be applicable to other tools too.

uptycs.com · 6 min

TLDR InfoSec

PASSKEYS – UNDER THE HOOD

This article covers the technical details on how Passkeys work under the hood and how to use this technology for your organization as a replacement for passwords. Passkeys offer advantages like synchronization to multiple devices. Their implementation and security measures vary among services. The shift in threat models from hardware security keys to passkeys requires careful consideration based on user requirements.

research.kudelskisecurity.com · 6 min

TLDR InfoSec

OPA 1.0 IS COMING. HERE’S WHAT YOU NEED TO KNOW

Summary unavailable

blog.openpolicyagent.org · 7 min

TLDR InfoSec

THE FAMILY OF SAFE GOLANG LIBRARIES IS GROWING

Google has released three new Golang libraries built to be secure by default. SafeText is used for processing YAML templates and templating shell commands. SafeOpen is designed to protect against path traversal attacks when opening files. SafeArchive is meant to protect against attacks related to dealing with archive files.

bughunters.google.com · 4 min

TLDR InfoSec

INTRODUCING POIEX - POINTS OF INTERSECTION EXPLORER

The Doyensec team developed PoIEx to aid in its code audit efforts. Points of Intersection are areas in application code that interact with IaC infrastructure. PoIEx creates a graph of IaC infrastructure and allows for jumping to application code that references it using semgrep rules.

blog.doyensec.com · 5 min

TLDR InfoSec

WEAUDIT

weAudit is a VS Code extension that aids teams of code reviewers. It allows reviewers to add bookmarks with findings or notes to code as well as mark files as reviewed. weAudit tracks bookmarks and notes in shareable files to enable collaboration and allow for the creation of GitHub issues.

blog.trailofbits.com · 3 min

TLDR InfoSec

MICROSOFT TO SHUT DOWN 50 CLOUD SERVICES FOR RUSSIAN BUSINESSES

Microsoft is set to shut down access to over fifty cloud services for Russian organizations by the end of March in compliance with EU sanctions. The decision was influenced by EU Council Regulation 2023/2873, which prohibits supplying certain software, including cloud solutions, to entities in Russia.

bleepingcomputer.com · 3 min

TLDR InfoSec

RUSSIAN HACKERS USE 'WINELOADER' MALWARE TO TARGET GERMAN POLITICAL PARTIES

Russian hackers linked to Russia's Foreign Intelligence Service (SVR) have been using the WINELOADER malware to target German political parties through phishing emails with logos from the Christian Democratic Union (CDU).

thehackernews.com · 2 min

TLDR InfoSec

GERMAN AUTHORITIES SHUT DOWN ONLINE MARKETPLACE FOR DRUGS, DATA, AND CYBERCRIME SERVICES

German authorities have shut down the Nemesis Market, an online marketplace dealing in drugs, cybercrime services, and fraudulently obtained credit card data.

securityweek.com · 1 min

TLDR InfoSec

HACKERS CAN UNLOCK OVER 3 MILLION HOTEL DOORS IN SECONDS

A group of security researchers discovered a technique called Unsaflok that allows hackers to open Saflok-brand RFID-based keycard locks in hotel rooms worldwide.

packetstormsecurity.com · 1 min

TLDR InfoSec

RESPONDING TO A CYBER INCIDENT – A GUIDE FOR CEOS

The UK's National Cyber Security Centre has released a set of guidelines for public and private sector leaders to navigate cyber security incidents effectively.

ncsc.gov.uk · 5 min