The Daily Index — Monday, June 3, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

LIVE NATION TOOK 11 DAYS TO CONFIRM THE MASSIVE TICKETMASTER DATA BREACH

Live Nation Entertainment acknowledged a data breach in a regulatory filing after an individual claimed to be selling data on 560 million Ticketmaster customers on hacking forums for $500,000. The breach involved unauthorized access to a third-party cloud database containing customer data like names, addresses, and credit card details.

theverge.com · 3 min

TLDR InfoSec

HUGGING FACE SAYS IT DETECTED ‘UNAUTHORIZED ACCESS' TO ITS AI MODEL HOSTING PLATFORM

Hugging Face disclosed late Friday that its security team detected unauthorized access to Spaces, its platform for sharing and hosting AI models, earlier in the week. The intrusion involved potential access to private "secrets" used as keys to protected resources. As a precaution, Hugging Face revoked numerous tokens and recommended users refresh keys and switch to more secure access tokens.

techcrunch.com · 3 min

TLDR InfoSec

SERVER-SIDE REQUEST FORGERY (SSRF) LAB

This post explains what server-side request forgery (SSRF) is and describes some common examples while walking through a PortSwigger Lab. It also demonstrates how to identify and exploit SSRF vulnerabilities.

medium.com · 5 min

TLDR InfoSec

CREDENTIALS LEAKING WITH SUBDOMAIN TAKEOVER

Truffle Security's team provides a deep dive into how localStorage can be abused in a subdomain takeover. They discovered a subdomain takeover vulnerability on Readme.io that could allow an attacker to compromise any credentials entered in the original or compromised page. The Readme team originally did not intend to fix the issue so Truffle Security created custom domains for 600 vulnerable companies and contacted them directly.

trufflesecurity.com · 6 min

TLDR InfoSec

NON-PRODUCTION ENDPOINTS AS AN ATTACK SURFACE IN AWS

The Datadog Security team discovered a new method for AWS privilege enumeration that can bypass CloudTrail logging. The method involves querying ce:GetCostAndUsage and route53resolver:ListFirewallConfigs for access to various other resources. The AWS team has fixed the specific bypasses and worked with the Datadog team to identify additional potential attack vectors.

securitylabs.datadoghq.com · 8 min

TLDR InfoSec

C/SIDE (PRODUCT LAUNCH)

C/side provides tools for monitoring, optimizing, and securing third-party scripts in browsers to keep users safe from vulnerabilities and zero-day attacks.

cside.dev

TLDR InfoSec

JAPANESE CRYPTO EXCHANGE DMM BITCOIN SUFFERS $305M HACK

Japanese cryptocurrency exchange DMM Bitcoin disclosed a major hack resulting in the loss of 48 billion yen ($305 million) worth of bitcoin, with 4,502.9 BTC stolen. The hacker split the funds across 10 wallets. DMM halted spot buys and warned of delayed yen withdrawals. It vowed to compensate the lost bitcoin with group company support to guarantee the full amount.

coindesk.com · 2 min

TLDR InfoSec

NETFLIX PAID OUT OVER $1 MILLION VIA BUG BOUNTY PROGRAM

Netflix announced that it has paid out over $1 million in bug bounties since launching its program in 2016. Over 5,600 researchers have contributed nearly 8,000 vulnerability reports, with 845 rewarded, including over 25% critical or high severity.

securityweek.com · 2 min

TLDR InfoSec

INTRODUCING ARTIFACT ATTESTATION

The OpenSSF and GitHub have launched Artifact Attestations to allow for generating SigStore artifact attestations but adding a GitHub action to configure the signature without the need to manage a PKI infrastructure. The signatures utilize the OpenSSF's PKI infrastructure and can be verified using the GitHub CLI. Integrations with Kubernetes and other providers are planned.

openssf.org · 5 min

TLDR InfoSec

BEWARE: FAKE BROWSER UPDATES DELIVER BITRAT AND LUMMA STEALER MALWARE

Fake browser updates are being used to spread malware like BitRAT and Lumma Stealer.

thehackernews.com · 3 min

TLDR InfoSec

THE NSA ADVISES YOU TO TURN YOUR PHONE OFF AND BACK ON ONCE A WEEK - HERE'S WHY

The NSA recommends turning your phone off and back on weekly to protect against security threats like malware and spyware.

zdnet.com · 3 min

TLDR InfoSec

POLICE DISMANTLE PIRATED TV STREAMING NETWORK THAT MADE $5.7 MILLION

Spanish police dismantled a network that made $5.7 million from illegal TV streaming by arresting 8 individuals and taking the servers offline.

bleepingcomputer.com · 2 min