The Daily Index — Monday, April 29, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

BOGUS POST OFFICE TEXTS DELIVER A SHOCKING AMOUNT OF TRAFFIC TO SCAM WEBSITES

According to research done by Akamai, fake USPS smishing attacks delivered traffic to fake USPS sites that were on par, or even exceeding, traffic to the legitimate USPS website. Akamai conducted a fairly conservative analysis by deriving a malicious domain list from one smishing text that an employee received. The attacks have been successful, despite many public awareness campaigns to protect users from them.

therecord.media · 2 min

TLDR InfoSec

OVER 1,400 CRUSHFTP INSTANCES VULNERABLE TO EXPLOITED ZERO-DAY

A critical zero-day vulnerability (CVE-2024-4040) in CrushFTP, a managed file transfer software, remains unpatched in over 1,400 instances. The flaw allows remote code execution by escaping the VFS sandbox. CrushFTP is urging customers to update after disclosing in-the-wild exploitation.

securityweek.com · 3 min

TLDR InfoSec

S3 BUCKET ENCRYPTION DOESN'T WORK THE WAY YOU THINK IT WORKS

S3 Bucket Encryption options all equate to access control more than encryption. In nearly every S3 encryption option (default SSE, KMS, and SSE-C), the user can either download the decrypted file if they have permissions to the encryption material or cannot download the file. Since a user never actually interacts with the encrypted file, the encryption feels more like access control.

blog.plerion.com · 4 min

TLDR InfoSec

REMEDIATING AWS IMDSV1

This article provides an overview of the benefits of IMDSv2 vs IMDSv1. It covers detection methods to identify EC2 instances with IMDSv1 enabled and CloudWatch queries to identify access to the service. It also details how to disable the service and place guardrails to prevent instances being launched with it enabled.

latacora.com · 15 min

TLDR InfoSec

AUTOMATING API VULNERABILITY TESTING USING POSTMAN WORKFLOWS

This blog post discusses automating API vulnerability testing using Postman Workflows, a feature that streamlines the process of demonstrating API vulnerabilities without programming. By creating sequences of HTTP requests within Postman, users can automate tasks like identifying Broken Object-Level Authorization (BOLA) vulnerabilities and retrieving sensitive data. Postman Workflows offer a visual drag-and-drop approach to building automated flows for API testing and exploitation.

haymiz.dev · 4 min

TLDR InfoSec

PROPHET SECURITY (PRODUCT LAUNCH)

Prophet AI for Security Operations filters incoming alerts and, for each of them, gathers, correlates, and analyzes data from multiple sources to provide a determination and a detailed summary of the investigation.

prophet.security

TLDR InfoSec

MICROSOFT NEEDS TO WIN BACK TRUST

Microsoft is grappling with a series of high-profile security incidents that have undermined trust in the tech giant. Hackers have spied on Microsoft's senior leadership emails, exploited Microsoft Exchange and Cloud services to access business and government email accounts, and stolen source code despite efforts to improve defenses. The company's security culture is inadequate and requires an overhaul.

theverge.com · 8 min

TLDR InfoSec

UK'S INVESTIGATORY POWERS BILL TO BECOME LAW DESPITE TECH WORLD OPPOSITION

The UK's controversial Investigatory Powers (Amendment) Bill 2024, dubbed the "snooper's charter", has received royal assent and will expand the digital surveillance capabilities of intelligence agencies, police, and others under the existing Investigatory Powers Act 2016. The amendments allow authorities to gather more data from citizens, including telecoms activity, to tackle "modern threats", including national security and child abuse. Critics have raised privacy concerns over the widened powers.

theregister.com · 5 min

TLDR InfoSec

HOW WE BUILT THE NEW FIND MY DEVICE NETWORK WITH USER SECURITY AND PRIVACY IN MIND

This blog post from Google Security describes how the Find My feature was built with privacy and end-to-end encryption while utilizing crowdsourcing. Safety-first protections, such as aggregation by default and at-home protection, help prevent unwanted tracking and ensure user safety. Users also have full control over their device participation in the network, providing options to contribute to aggregated location reporting or opt-out completely.

security.googleblog.com · 5 min

TLDR InfoSec

HOW TO DELETE THE DATA GOOGLE HAS ON YOU

Simple guide on how to get your data off Google.

theverge.com · 6 min

TLDR InfoSec

LESSONS FROM BUILDING AN AUTOMATED SDK PIPELINE

Summary unavailable

blog.cloudflare.com · 11 min

TLDR InfoSec

PCI DSS 4.0; CERTIFICATE TRANSPARENCY MONITORING IS MANDATORY!

PCI DSS 4.0 now requires Certificate Transparency Monitoring to ensure all trusted certificates are accounted for.

scotthelme.co.uk · 6 min