The Daily Index — Friday, June 14, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

SECURITY FIRM CYLANCE SAYS IT HAS BEEN HACKED, DATA PUT UP FOR SALE ONLINE

Cybersecurity firm Cylance confirmed a cyberattack where 34 million customer, employee, and partner emails and PII were stolen. The data is being sold on the dark web for $750,000. Cylance stated the breached data is relatively old and unrelated to the Snowflake hack.

techradar.com · 2 min

TLDR InfoSec

PURE STORAGE SAYS ATTACKERS BROKE INTO A SNOWFLAKE ENVIRONMENT

Cloud storage provider Pure Storage disclosed that attackers gained unauthorized access to a Snowflake workspace containing customer telemetry data like company names, usernames, emails, and software versions. However, Pure Storage assured no sensitive data like passwords or customer-stored data was compromised.

computing.co.uk · 3 min

TLDR InfoSec

ARM WARNS OF ACTIVELY EXPLOITED FLAW IN MALI GPU KERNEL DRIVERS

Arm has issued a security bulletin warning users of a vulnerability in the kernel drivers of Bifrost and Valhall GPUs. The vulnerability that is reportedly being actively exploited is a Use-After-Free vulnerability. These GPUs are used in smartphones, tablets, Chromebooks, various embedded devices, automotive infotainment systems, and smart TVs.

bleepingcomputer.com · 3 min

TLDR InfoSec

BYPASSING EDR NTDS.DIT PROTECTION USING BLUE TEAM TOOLS

This blog post details a method for extracting NTDS hashes while bypassing EDR and OS protections. The SYSTEM hive and NTDS.dit are needed to extract these hashes. The author utilized forensics tooling to extract these files without triggering EDR or OS protections.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

HOW TO SECURELY TRANSFER FILES WITH PRESIGNED URLS

This blog post provides prescriptive guidance for generating presigned URLs that involves using tightly scoped IAM roles, unique minces, and VPC endpoints. It details a solution overview for deploying a presigned URL generation API and an access object API. The post concludes with best practices for sharing and monitoring presigned URLs such as using HTTPS for transit, tightly scoping CORS permissions, monitoring CloudWatch logs, and utilizing AWS WAF.

aws.amazon.com · 7 min

TLDR InfoSec

5 STEPS FOR CREATING AN APPSEC PROGRAM

This post lays out 5 steps to building an AppSec program. Start by creating or updating application and infrastructure diagrams to engage security partners and gain visibility into the attack surface. Existing security tools should then be mapped to the diagrams. The limitations of those tools should be explored and then repeatable processes should be built around security. After a program reaches this level of maturity, further projects such as secure libraries, terraform modules, and DAST integrations can be pursued.

pulse.latio.tech · 5 min

TLDR InfoSec

BACKSLASH SECURITY (PRODUCT LAUNCH)

Backslash combines SCA, SAST, SBOM, VEX, and secrets detection with a single platform that uncovers the most critical risks through reachability analysis.

backslash.security

TLDR InfoSec

IOS 18 CRACKS DOWN ON APPS ASKING FOR FULL ADDRESS BOOK ACCESS

Apple unveiled new privacy features in iOS 18 that restrict apps from accessing users' full address books. Apps must first get permission to access contacts before users can pick which specific contacts to share. This two-step process aims to prevent apps from covertly building social networks from address books without consent.

techcrunch.com · 4 min

TLDR InfoSec

GOOGLE'S PRIVACY SANDBOX MORE LIKE A PRIVACY MIRAGE, CAMPAIGNERS CLAIM

Privacy campaigner noyb filed a GDPR complaint alleging Google's Privacy Sandbox API, meant to replace third-party cookies, still allows Google to track users within Chrome without proper consent.

theregister.com · 3 min

TLDR InfoSec

OPERATION CELESTIAL FORCE EMPLOYS MOBILE AND DESKTOP MALWARE TO TARGET INDIAN ENTITIES

A malware called Celestial Force uses mobile and desktop malware like GravityRAT and HeavyLift to target Indian entities. The malware is managed through a tool called GravityAdmin, facilitating malicious activities on infected devices. The operation involves various campaigns that target different platforms with overlapping infrastructure to distribute malicious payloads.

blog.talosintelligence.com · 9 min

TLDR InfoSec

10 YEARS OF THE GITHUB SECURITY BUG BOUNTY PROGRAM

GitHub has paid over $4 million through its 10-year-old bug bounty program.

github.blog · 7 min

TLDR InfoSec

PSA: BARTENDER MAC APP UNDER NEW OWNERSHIP

Mac users have raised concerns after discovering that the popular Bartender app was sold and the certificate changed with no communication by the new owners.

macrumors.com · 1 min

TLDR InfoSec

WATCH OUT! CISA WARNS IT IS BEING IMPERSONATED BY SCAMMERS

Scammers are pretending to be CISA employees to trick people into giving them personal information or money.

tripwire.com · 2 min