The Daily Index — Monday, April 15, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

PALO ALTO NETWORKS WARNS OF EXPLOITED FIREWALL VULNERABILITY

Threat actors are exploiting a critical command injection vulnerability (CVE-2024-3400) in Palo Alto Networks firewalls that allows unauthenticated attackers to execute arbitrary code with root privileges. The vulnerability, with a severity score of 10/10, affects the GlobalProtect feature in PAN-OS versions 10.2, 11.0, and 11.1.

securityweek.com · 3 min

TLDR InfoSec

CANADIAN RETAIL CHAIN GIANT TIGER DATA BREACH MAY HAVE IMPACTED MILLIONS OF CUSTOMERS

A hacker breached Canadian retail chain Giant Tiger, exposing 2.8 million customer records with personal information. The compromised data included email addresses, names, phone numbers, and physical addresses, but financial information was not affected. Customers can check if their data was leaked using the HaveIBeenPwned service.

securityaffairs.com · 2 min

TLDR InfoSec

SOC PROJECT WITH FULL AUTOMATION LAB

This blog summarizes the architecture of a fully-featured open source SOC lab consisting of powerful technologies used by Fortune 500 companies. Despite being open source, these tools offer comprehensive security incident detection, response, automation, and threat intelligence capabilities.

thecyberonix.medium.com · 4 min

TLDR InfoSec

SECCOMP INTERNALS DEEP DIVE – PART 1

This blog post explores the internals of seccomp including its architecture, key concepts, and practical applications. The post provides kernel code examples that refer to x86_64 architecture with Linux kernel version 6.7.1. The second part of the post is expected to cover seccomp notifications.

armosec.io · 10 min

TLDR InfoSec

WHAT WE NEED TO TAKE AWAY FROM THE XZ BACKDOOR

This article discusses a significant security breach involving the XZ compression tool, used widely in Linux distributions, which was discovered to contain a malicious backdoor. This backdoor specifically targeted distribution builds using GCC and glibc, raising serious concerns about supply chain security. The openSUSE team, upon discovering the threat, acted swiftly to remove the compromised software and rebuild affected packages to ensure system integrity. The scenario emphasizes the need for heightened security measures and more robust community vigilance in open-source projects.

news.opensuse.org · 12 min

TLDR InfoSec

SIMBIAN (PRODUCT LAUNCH)

Simbian is an autonomous security platform for enterprises. Humans make all the strategic decisions while AI implements those decisions.

simbian.ai

TLDR InfoSec

EX-SECURITY ENGINEER JAILED 3 YEARS FOR $12.3 MILLION CRYPTO EXCHANGE THEFTS

A former security engineer at Amazon, Shakeeb Ahmed was sentenced to three years in prison for hacking two cryptocurrency exchanges in July 2022 and stealing over $12.3 million. He pled guilty to computer fraud charges in December 2023 following his arrest in July. Ahmed exploited security flaws to insert fake pricing data and fraudulently generate inflated fees, which he then withdrew.

thehackernews.com · 2 min

TLDR InfoSec

NEW TECHNIQUE TO TRICK DEVELOPERS DETECTED IN AN OPEN SOURCE SUPPLY CHAIN ATTACK

Attackers are manipulating GitHub search rankings by creating malicious repositories with popular names and topics and using automated updates and fake stars to deceive users. The recent campaign involves a large malware executable that targets cryptocurrency wallets, establishing persistence through a scheduled task.

checkmarx.com · 10 min

TLDR InfoSec

UK FLOODED WITH FORGED STAMPS DESPITE USING BARCODES — TO PREVENT JUST THAT

Royal Mail introduced barcoded stamps to enhance security and prevent forgeries, but counterfeit stamps have flooded the UK. Customers face fines for unknowingly using fake stamps purchased at Post Offices. The transition to barcoded stamps raised privacy concerns due to the potential loss of anonymity in mail.

bleepingcomputer.com · 5 min

TLDR InfoSec

FBI WARNS OF MASSIVE WAVE OF ROAD TOLL SMS PHISHING ATTACKS

The FBI warns of a large wave of text message scams that trick people into clicking links to pay unpaid tolls.

bleepingcomputer.com · 2 min

TLDR InfoSec

LASTPASS DODGES DEEPFAKE SCAM: CEO IMPERSONATION ATTEMPT THWARTED

LastPass avoided a security breach in which an employee was targeted with a deepfake scam impersonating the CEO.

hackread.com · 2 min

TLDR InfoSec

CHROME ENTERPRISE GETS PREMIUM SECURITY BUT YOU HAVE TO PAY FOR IT

Google has introduced Chrome Enterprise Premium, a new version of its browser for organizations that offers advanced security features for a monthly fee per user.

bleepingcomputer.com · 2 min