The Daily Index — Friday, June 21, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

MASSACHUSETTS 911 OUTAGE CAUSED BY ERRANT FIREWALL

Massachusetts experienced a two-hour statewide 911 outage caused by an errant firewall installed by vendor Comtech to prevent cyberattacks. The firewall blocked calls from reaching dispatch centers. No emergencies were reportedly impacted, as dispatch centers could identify and return unsuccessful calls.

securityweek.com · 2 min

TLDR InfoSec

HACKERS DERAIL AMTRAK GUEST REWARDS ACCOUNTS IN BREACH

Amtrak has disclosed a data breach that affects users of the Guest Rewards program. It determined that there was no breach of its systems and that accounts were accessed via credentials leaked in previous breaches. Stolen information included names, contact information, rewards account numbers, partial credit card data, dates of birth, and transaction/trip information.

darkreading.com · 2 min

TLDR InfoSec

FAKE GOOGLE CHROME ERRORS TRICK YOU INTO RUNNING MALICIOUS POWERSHELL SCRIPTS

Proofpoint analysts have identified three attack chains that seek to social engineer users into running malicious Powershell scripts. The first two attack chains load a script hosted on Binance's chain which shows the user a fake Google Chrome error and prompts them to “install a root certificate” by copying a Powershell script into an admin Powershell console. The third attack chain sends an email resembling Microsoft Word documents and prompts users to install a Word Online extension which then prompts the user to “fix” the document by running a Powershell script or downloading and executing a file.

bleepingcomputer.com · 3 min

TLDR InfoSec

HIJACKING GITHUB RUNNERS TO COMPROMISE THE ORGANIZATION

This article discusses a novel attack technique that utilizes developer access to a lower privilege GitHub repository to escalate privileges to a total compromise of all GitHub Actions pipelines in the organization. The attack makes use of a command injection vulnerability caused by utilizing the branch name directly in a command run on a self-hosted runner. This access is then used to register a new runner with the ubuntu-latest tag that will be used for any actions trying to use the GitHub hosted ubuntu-latest runner.

synacktiv.com · 6 min

TLDR InfoSec

WTF IS CDR?

This post explores what Cloud Detection and Response tools are and provides some insight into the vendor landscape. CDR tools tie together logs from the Kubernetes control plane, containers, and cloud events into a single timeline for analysts along with response and remediation actions. The post concludes with an overview of the landscape, highlighting Upwind and Sweet as vendors capable of typing cloud and Kubernetes events together.

pulse.latio.tech · 7 min

TLDR InfoSec

POMERIUM (PRODUCT LAUNCH)

Pomerium offers a unified access control solution that prioritizes access over restriction, dynamically verifying user identities and context to improve security.

pomerium.com

TLDR InfoSec

NEW GOVERNMENT BAN ON KASPERSKY WOULD PREVENT COMPANY FROM UPDATING MALWARE SIGNATURES IN U.S.

The US government has expanded its ban on Kaspersky software due to national security concerns, preventing the company from providing updates to customers in the U.S. This ban will impact the ability of Kaspersky software to detect threats on American systems over time. Existing Kaspersky customers in the U.S. have until September 29 to find alternative antivirus software.

zetter-zeroday.com · 6 min

TLDR InfoSec

YEAR-ROUND STRATEGIES FOR CAREER GROWTH

This blog post goes into detail about performance reviews, career ladders, and career growth strategies. Career growth is something that employees should be thinking about year-round. ICs can use hype lists to jot down what they worked on, the impact it made, and any notes they had. They should utilize this list in performance reviews in addition to making sure that their work is visible throughout the company.

leif.substack.com · 9 min

TLDR InfoSec

6 QUESTIONS TO ASK WHEN INTERVIEWING FOR AN APPSEC ROLE

This post provides a list of questions to ask when interviewing for an AppSec role. The questions aim to understand the culture of the team, interactions with other teams, and what your work would look like. An explanation of why each question should be asked is provided.

blog.pentesterlab.com · 3 min

TLDR InfoSec

UPDATE YOUR WINDOWS PC TO AVOID A SERIOUS WI-FI VULNERABILITY

Microsoft patched a critical vulnerability in Windows 10 and 11 that could allow hackers to remotely access devices on public Wi-Fi networks without user interaction.

theverge.com · 1 min

TLDR InfoSec

AMD INVESTIGATING CLAIMS THAT COMPANY'S DATA WAS STOLEN IN HACK

An organization called "Intelbroker" conducted a breach of AMD's data.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

LINUX VERSION OF RANSOMHUB RANSOMWARE TARGETS VMWARE ESXI VMS

The RansomHub ransomware operation is using a Linux encryptor designed specifically to encrypt VMware ESXi environments in corporate attacks.

bleepingcomputer.com · 2 min