The Daily Index — Wednesday, April 3, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

SHADOWRAY: FIRST KNOWN ATTACK CAMPAIGN TARGETING AI WORKLOADS ACTIVELY EXPLOITED

This article provides a deep dive into a new critical vulnerability in the open-source AI framework Ray. The vulnerability is due to a lack of authorization in the Jobs API that is disputed and thus unpatched. The article goes in-depth into the framework, the vulnerability, the IoCs, and the impact of exploitation.

oligo.security · 12 min

TLDR InfoSec

OMNI HOTELS EXPERIENCING NATIONWIDE IT OUTAGE

Omni Hotels has been experiencing a widespread outage affecting its reservation, hotel room door lock, and point of sale systems since Friday. All locations are open and accepting new customers but front desk employees have been experiencing widespread issues. Omni Hotels hasn't released any details on the cause, but internal IT employees have said that services are being built from scratch.

bleepingcomputer.com · 3 min

TLDR InfoSec

SECURITY CODE CHALLENGE FOR DEVELOPERS & ETHICAL HACKERS – THE DAMN VULNERABLE RESTAURANT

Damn Vulnerable RESTaurant is an intentionally vulnerable API service designed as a learning and training platform for developers, ethical hackers, and security engineers. It covers popular API vulnerabilities, including OWASP Top 10 API Security Risks, providing an interactive environment to identify and fix vulnerabilities, exploit them manually or through automation tools, and test security mechanisms.

devsec-blog.com · 10 min

TLDR InfoSec

MALICIOUS XZ BACKDOOR REVEALS FRAGILITY OF OPEN SOURCE

The backdoor in the widely-used open-source xz compression library could have led to a significant security disaster had it not been fortuitously detected by a curious Microsoft engineer investigating latency issues. This near-miss scenario has raised alarms about the potential for similar undetected compromises in software infrastructure. This post analyzes the current state of open source software.

theregister.com · 7 min

TLDR InfoSec

USING TAILSCALE FOR PERSISTENCE

This post details a method that uses Tailscale to establish a C2 on a Kubernetes node. In this scenario, an attacker has obtained time limited cluster-admin credentials and wants to utilize those credentials to establish persistence. The described attack involves deploying Tailscale on the node via containerd or a static manifest and utilizing Tailscale ACLs to only allow communication from C2 controller nodes to the infected bot nodes.

raesene.github.io · 5 min

TLDR InfoSec

ZAFRAN (PRODUCT LAUNCH)

Zafran connects to both vulnerability data and the organization’s security controls. It analyzes risk while taking into account controls’ efficacy as well as exploitability factors.

zafran.io

TLDR InfoSec

GOOGLE AGREES TO DESTROY BROWSING DATA COLLECTED IN INCOGNITO MODE

Google agreed to a proposed $5 billion class-action settlement requiring it to destroy or de-identify billions of web browsing data records collected from users in "Incognito mode," mandate better disclosures about data collection in Incognito, and impose limits on future data gathering. If approved, the settlement could apply to 136 million Google users who accused the company of illegally tracking their private browsing behavior.

bit.ly · 3 min

TLDR InfoSec

OWASP DATA BREACH CAUSED BY SERVER MISCONFIGURATION

The OWASP Foundation announced a data breach exposing personal information provided by aspiring members in resumes submitted between 2006 and 2014 as part of the old membership process. The breach, caused by a misconfiguration on OWASP's old wiki server, compromised names, addresses, phone numbers, email addresses, and other identifiable information of tens of thousands of members from the non-profit software security community organization.

securityweek.com · 3 min

TLDR InfoSec

THE EFFICIENT SECURITY PRINCIPLE

The Efficient Security Principle is essentially that security is only as good as it needs to be to keep people using the service. This post provides guidance to security practitioners and leaders on how to utilize this principle.

danielmiessler.com · 4 min

TLDR InfoSec

DEOBFUSCATING/UNMINIFYING OBFUSCATED WEB APP CODE (GITHUB GIST)

A GitHub gist that provides some notes and tools for reverse engineers to deobfuscate/unminify obfuscated code.

gist.github.com

TLDR InfoSec

BINARLY RELEASED THE FREE ONLINE SCANNER TO DETECT THE CVE-2024-3094 BACKDOOR

Researchers from the firmware security firm Binarly released a free online scanner to detect the CVE-2024-3094 backdoor.

securityaffairs.com · 2 min

TLDR InfoSec

CHROME TO FIGHT COOKIE THEFT WITH DEVICE BOUND SESSION CREDENTIALS

Chrome is adding Device Bound Session Credentials (DBSC) to enhance user protection against cookie theft, a mechanism that uses a private key tied to the device.

securityweek.com · 3 min