The Daily Index — Monday, June 17, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

PANERA WARNS OF EMPLOYEE DATA BREACH AFTER MARCH RANSOMWARE ATTACK

Panera Bread has notified employees of a data breach after attackers stole its data. It notified employees that information that they provided pursuant to their employment was breached, including social security numbers. Panera offered affected employees a year of CyEx Identity Theft Total.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW ARM 'TIKTAG' ATTACK IMPACTS GOOGLE CHROME, LINUX SYSTEMS

A new research called TIKTAG demonstrates attacks on ARM's Memory Tagging Extension (MTE) to leak data, impacting Google Chrome and Linux Systems. The attack exploits speculative execution to bypass security measures, potentially enabling memory corruption vulnerabilities. Researchers have proposed hardware modifications and code changes to mitigate TIKTAG attacks.

bleepingcomputer.com · 3 min

TLDR InfoSec

SIMPLIFY RISK AND COMPLIANCE ASSESSMENTS WITH THE NEW COMMON CONTROL LIBRARY IN AWS AUDIT MANAGER

AWS Audit Manager has added a new common control library that provides common controls with predefined and remapped AWS data sources. The common control library is based on external audits and supports multiple frameworks. A working example is included in the post.

aws.amazon.com · 3 min

TLDR InfoSec

DIRTY LITTLE SECRETS OF VULNERABILITY MANAGEMENT

This article explores some common misconceptions about vulnerability management and sheds light on why these make vulnerability management for open source software incredibly complex. It begins by discussing the difference between MITRE's position as secretariat of the CVE program vs the NVD's catalog before addressing why many CVEs that may have exploits available don't make it to CISA's KEV list. The article explains how EPSS scores work and how open source maintainers often skip reporting CVEs and instead only report to the GitHub Advisory Database, complicating matters.

cramhacks.com · 5 min

TLDR InfoSec

ASSUMED BREACH: THE EVOLUTION OF OFFENSIVE SECURITY TESTING

TrustedSec elaborates on its new approach to red teaming and pentesting, which focuses on scenario-based breaches, as opposed to traditional internal pen tests, which focus mostly on physical intrusion-based scenarios whereby attackers plant a rogue device in the network. TrustedSec tests seven scenarios: SSO compromise, network pivot, endpoint compromise, perimeter compromise, DevOps, workstation compromise, and physical intrusion. The post includes a detailed description of the scenarios and testing methods.

trustedsec.com · 8 min

TLDR InfoSec

PYTE (PRODUCT LAUNCH)

Pyte's proprietary Secure Multiparty Computation (SMPC) technology makes it easy to run AI or ML computations on encrypted data without the need to move or decrypt the data.

pyte.ai

TLDR InfoSec

ALLEGED BOSS OF ‘SCATTERED SPIDER' HACKING GROUP ARRESTED

A 22-year-old UK man arrested in Spain is allegedly the ringleader of the Scattered Spider cybercrime group behind hacks of Twilio, LastPass, DoorDash, Mailchimp, and others. He is accused of stealing data to access millions in funds. The man allegedly controlled $27 million in Bitcoin.

krebsonsecurity.com · 7 min

TLDR InfoSec

META PAUSES PLANS TO TRAIN AI USING EUROPEAN USERS' DATA, BOWING TO REGULATORY PRESSURE

Meta has paused plans to train its AI systems using data from EU and UK users following pushback from regulators. The Irish Data Protection Commission and the UK's ICO requested that Meta halt the initiative until concerns over compliance with GDPR privacy rules could be satisfied.

techcrunch.com · 3 min

TLDR InfoSec

A NEW NORTH KOREAN GROUP EMERGES, DISRUPTING THE OPEN SOURCE ECOSYSTEM

A new North Korean threat actor named Moonstone Sleet has emerged. The group is targeting the open-source ecosystem with malicious npm packages. Its tactics mirror those of other North Korean groups, posing a constant threat to developers. Collaboration and vigilance are key to safeguarding the open-source community against these risks.

checkmarx.com · 4 min

TLDR InfoSec

FORMER HEAD OF NSA JOINS OPENAI BOARD

OpenAI has appointed former NSA director Paul M. Nakasone, who led the NSA until February 2023, to its board of directors.

theverge.com · 2 min

TLDR InfoSec

PROTECT AI'S JUNE 2024 VULNERABILITY REPORT

This report highlights 32 security defects reported as part of its bug bounty program.

protectai.com · 5 min

TLDR InfoSec

MICROSOFT: NEW OUTLOOK SECURITY CHANGES COMING TO PERSONAL ACCOUNTS

Microsoft is making security changes to Outlook personal email accounts, phasing out basic authentication by September 16.

bleepingcomputer.com · 3 min