The Daily Index — Wednesday, March 27, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GERMANY WARNS OF 17K VULNERABLE MICROSOFT EXCHANGE SERVERS EXPOSED ONLINE

The German national cybersecurity authority has identified approximately 17,000 Microsoft Exchange servers in Germany that are exposed online and vulnerable to critical security flaws. Around 45,000 Exchange servers in Germany have Outlook Web Access enabled, with some still using outdated versions of Exchange that have not received security updates.

bleepingcomputer.com · 2 min

TLDR InfoSec

OVER 170K USERS AFFECTED BY ATTACK USING FAKE PYTHON INFRASTRUCTURE

This post reports on a sophisticated cyber attack campaign that affected over 170,000 users by using fake Python infrastructure. The attackers employed various tactics such as account takeovers, contributing malicious code, setting up a custom Python mirror, and publishing malicious packages to the PyPi registry. They also hijacked GitHub accounts, published malicious Python packages, and used social engineering schemes.

checkmarx.com · 9 min

TLDR InfoSec

WISHING: WEBHOOKS PHISHING IN TEAMS

This article presents a rundown of methods to phish users via Microsoft Teams. By default, any user can install a new Incoming Webhook - Microsoft provides no way to add authentication to webhooks. An attacker can leverage this to send phishing messages to channels that look like legitimate messages from connected applications. Teams also supports a channel email feature which enables the same capabilities via a unique email address per channel.

blackhillsinfosec.com · 10 min

TLDR InfoSec

THE DARKSIDE OF THEMOON

This blog post discusses a multi-year campaign that targeted end-of-life small home/small office routers and IoT devices with an updated version of the TheMoon malware. The malware is associated with a proxy service called Faceless, used by cybercriminals for anonymity. The post also describes the global telemetry analysis of Faceless, its proxy server infrastructure, and the behavior of infected devices in the network.

blog.lumen.com · 12 min

TLDR InfoSec

BLAZE'S SECURITY BLOG: ANALYZE, HUNT, AND CLASSIFY MALWARE USING .NET METADATA

This blog post discusses the development of Yara rules for identifying and classifying malware written in .NET based on unique identifiers such as MVID and Typelib. The author mentions tools like GetNetGUIDs for extracting GUID types and clustering malware samples to identify patterns. The tools and Yara rules presented can be used to enhance existing rule sets, classify malware, and extract metadata from .NET assemblies.

bartblaze.blogspot.com · 8 min

TLDR InfoSec

MOZILLA DROPS ONEREP AFTER CEO ADMITS TO RUNNING PEOPLE-SEARCH NETWORKS

Days after KrebsOnSecurity reported that the CEO of Onerep ran several people-search networks, Mozilla has dropped the company from its Monitor Plus product. Onerep is a service that removes users from hundreds of people-search sites. It also has other conflicts of interest such as running ads on data broker websites.

krebsonsecurity.com · 5 min

TLDR InfoSec

RECENT ‘MFA BOMBING’ ATTACKS TARGETING APPLE USERS

Apple users have recently been targeted in phishing attacks where scammers exploit a bug in Apple's password reset feature. The attack inundates target devices with system prompts that must be approved or declined repeatedly. The scammers then call the victims posing as Apple support to obtain one-time codes for account resets.

krebsonsecurity.com · 7 min

TLDR InfoSec

FREE VPN APPS ON GOOGLE PLAY TURNED ANDROID PHONES INTO PROXIES

Over 15 free VPN apps on Google Play were discovered using a malicious software development kit that turned Android devices into residential proxies, potentially for cybercrime. These residential proxies route internet traffic through homes to make it appear legitimate. Google removed apps using the LumiApps SDK from the Play Store and updated Google Play Protect to detect the libraries used in the apps.

bleepingcomputer.com · 4 min

TLDR InfoSec

A FRAMEWORK FOR UNDERSTANDING CYBERSECURITY

Cybersecurity investor Aman Sidhant covers the Cyber Defense Matrix, a framework that can be used to cover most cybersecurity events.

timesofindia.indiatimes.com · 3 min

TLDR InfoSec

AWS ADDS MTLS SUPPORT FOR APPLICATION LOAD BALANCERS

AWS has expanded ALB’s TLS termination abilities to support mTLS with an ACM or user-provided CA.

aws.amazon.com · 4 min

TLDR InfoSec

RANSOMWARE ECOSYSTEM MAP (PDF DOCUMENT)

Orange Cyberdefense team has a collection of ransomware ecosystem tools along with interconnections for a significant number of ransomware since 2015.

github.com