The Daily Index — Friday, May 3, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

QANTAS FIXES DATA BREACH AFTER PASSENGERS' PERSONAL DETAILS SHARED

Qantas fixed a bug with its app which allowed some passengers to view the flight details and names of other passengers. The company assures users that the bug was not due to a cybersecurity incident but rather a “technology issue.” No additional personal information or financial information was shared.

abc.net.au · 2 min

TLDR InfoSec

HACKERS TRY TO EXPLOIT CRITICAL VULNERABILITY IN WORDPRESS PLUGIN

A 9.9 severity vulnerability in the WordPress Automatic plugin was disclosed in March. The vulnerability is a SQL injection that could allow unauthenticated attackers to create admin accounts and take over a WordPress site. WPScan has logged more than 5 million attempts to exploit the vulnerability since disclosure.

arstechnica.com · 3 min

TLDR InfoSec

PANDA RESTAURANT GROUP DISCLOSED A DATA BREACH

Panda Restaurant Group experienced a data breach in March, leading to the theft of associates' personal information. The breach affected corporate systems but not in-store operations or guest experience. The company is offering affected individuals credit monitoring services and advises vigilance against identity theft.

securityaffairs.com · 2 min

TLDR InfoSec

BLACKBERRY MDM HAS SOME AUTHENTICATION FLAWS

An exploration of the BlackBerry MDM solution. It walks through the process of reverse engineering the BlackBerry MDM client and uncovers several flaws in the authentication scheme. The vulnerabilities were reported to and dismissed by BlackBerry.

emptynebuli.github.io · 7 min

TLDR InfoSec

EXAMINING THE DECEPTION INFRASTRUCTURE IN PLACE BEHIND CODE.MICROSOFT.COM

This blog post details how the now-retired domain code.microsoft.com was turned into a honeypot by Microsoft to collect threat intelligence on malicious activities targeting its infrastructure. By repurposing the dangling subdomain, Microsoft was able to attract and monitor attackers, gaining valuable insights to enhance its security measures. The honeypot successfully detected and mitigated a potential malware hosting incident in 2021.

techcommunity.microsoft.com · 7 min

TLDR InfoSec

WHY SNEAK WHEN YOU CAN WALK THROUGH THE FRONT DOOR – A LOVE LETTER TO PASSWORD SPRAYING AGAINST M365 IN RED TEAM ENGAGEMENTS

This blog post discusses using password spraying to gain access to Microsoft 365 accounts during red team engagements. It highlights the importance of avoiding lockouts and utilizing tools like Fireprox for successful password spraying. The approach involves testing methodologies, being mindful of client communications, and exploiting MFA gaps for initial access.

labs.jumpsec.com · 15 min

TLDR InfoSec

RUN0 (MASTODON THREAD)

The systemd team has created a replacement for sudo called run0 for version 256. run0 does not require SUID to run.

mastodon.social

TLDR InfoSec

PASSKEYS: A SHATTERED DREAM

A post from the maintainer of the webauthn-rs library on why they believe that passkeys will ultimately fail. The author lays out their original hopes for webauthn and why we failed to get there. Reasons for the failure of passkeys include corporations acting in their own self-interest, anti-open source behaviors, and messy implementations ruining the user experience around passkeys.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

ARCANEDOOR - NEW ESPIONAGE-FOCUSED CAMPAIGN FOUND TARGETING PERIMETER NETWORK DEVICES

The ArcaneDoor espionage tool is an example of state-sponsored actors targeting perimeter network devices from multiple vendors. It exploits two vulnerabilities, CVE-2024-20353 and CVE-2024-20359, and is not limited to Cisco devices. These authors recommend bolstering perimeter security and adopting robust security practices to prevent these types of attacks.

blog.talosintelligence.com · 12 min

TLDR InfoSec

HOW MFA IS FALLING SHORT

This blog post talks about how MFA, or multifactor authentication, is facing challenges with phishing attacks and session hijacking. Attacks on MFA factors like passwords and OTPs can compromise user security. Organizations need to prioritize stronger authentication methods to protect against evolving threats.

kolide.com · 14 min

TLDR InfoSec

CISA URGES SOFTWARE DEVS TO WEED OUT PATH TRAVERSAL VULNERABILITIES

CISA and the FBI advise software companies to fix path traversal vulnerabilities before releasing products to prevent attackers from exploiting file manipulation for malicious purposes.

bleepingcomputer.com · 2 min

TLDR InfoSec

GOOGLE BOOSTS BUG BOUNTY PAYOUTS TENFOLD IN MOBILE APP SECURITY PUSH

Researchers can now earn up to $450,000 for reporting critical vulnerabilities in top-tier applications.

packetstormsecurity.com · 2 min

TLDR InfoSec

IT TURNS OUT THAT RABBIT R1 IS JUST AN ANDROID APP

The AI-powered Rabbit R1 gadget is actually just an Android app that can run on a regular phone.

links.tldrnewsletter.com · 2 min