The Daily Index — Friday, June 28, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

OLLAMA PATCHES REMOTE EXECUTION VULNERABILITY

Ollama recently fixed a vulnerability discovered by Wiz that could result in path traversal. The vulnerability exploits the lack of input validation in the /api/pull endpoint of the Ollama servers by using a specially crafted request to overwrite arbitrary files on the host system. Wiz's researchers note that there are still publicly exposed Ollama servers that are vulnerable to this flaw.

siliconangle.com · 2 min

TLDR InfoSec

SOUTH KOREAN TELECOM COMPANY ATTACKS CUSTOMERS WITH MALWARE

A South Korean telecom company infected over 600,000 users with malware for using torrent services. The malware caused missing files, created strange folders, and disabled PCs. Police identified and charged individuals connected to the attack. Investigations are still ongoing.

tomshardware.com · 3 min

TLDR InfoSec

TALES FROM THE CLOUD TRENCHES: RAIDING FOR AWS VAULTS, BUCKETS, AND SECRETS

This blog post examines behavior from an attacker that Datadog saw in several customer environments. The attacker probed for S3 buckets and AWS Secrets Manager secrets, which is common but also, less commonly, probed for Glacier vaults. In all cases, the attacker did not take follow on actions. The attacker also signed their AWS API requests manually as opposed to using a library such as boto3, which handles signing.

securitylabs.datadoghq.com · 6 min

TLDR InfoSec

WHY ARE HMAC KEYS CONSIDERED UNAUDITABLE AND UNMANAGEABLE IN GOOGLE CLOUD?

This blog post describes how Google Cloud HMAC keys have vulnerabilities related to logging, management, and auditing. Users can create unlimited HMAC keys without proper oversight or control. These issues could lead to security risks and challenges for administrators in Google Cloud.

vectra.ai · 6 min

TLDR InfoSec

AUTOMATED LLM BUGFINDERS

This blog post was written as a response to Google Project Zero's naptime LLM tool and proposes an alternative approach to building automated bug finders. Different approaches, such as the Catalyst-AI Reasoning Module, aim to enhance LLMs' effectiveness in detecting bugs by utilizing specific prompts and tools.

cybersecpolitics.blogspot.com · 6 min

TLDR InfoSec

CISA, JCDC, GOVERNMENT, AND INDUSTRY PARTNERS CONDUCT AI TABLETOP EXERCISE

The Joint Cyber Defense Collaborative organized a 4 hour tabletop exercise with government and AI industry experts. The goal of the exercise was to spearhead the development of an AI Security Incident Collaboration Playbook by JCDC. The exercise simulated an incident involving an AI-enabled system. Participants worked through operational collaboration and information sharing protocols for incident response.

cisa.gov · 5 min

TLDR InfoSec

CHAMELGANG & FRIENDS | CYBERESPIONAGE GROUPS ATTACKING CRITICAL INFRASTRUCTURE WITH RANSOMWARE

Cyberespionage groups are using ransomware for financial gain and to disrupt critical infrastructure. ChamelGang, a suspected Chinese APT group, targeted institutions in India and Brazil with ransomware. BestCrypt and BitLocker were also used in ransomware attacks affecting organizations in North America, South America, and Europe.

sentinelone.com · 3 min

TLDR InfoSec

LOCKBIT GROUP WRONGLY CLAIMED THE HACK OF THE FEDERAL RESERVE

The LockBit ransomware group falsely claimed to have hacked the US Federal Reserve. The real victim was Evolve Bank & Trust. Evolve Bank & Trust confirmed a security breach that involved leaked personal information and is conducting an investigation. The incident has been contained, and affected customers will be directly contacted.

securityaffairs.com · 3 min

TLDR InfoSec

CRITICAL GITLAB BUG LETS ATTACKERS RUN PIPELINES AS ANY USER

A critical vulnerability in GitLab allows attackers to run pipelines as any user.

bleepingcomputer.com · 2 min

TLDR InfoSec

POLYFILL CLAIMS IT HAS BEEN 'DEFAMED', RETURNS AFTER DOMAIN SHUT DOWN

The Polyfill service, which was found to be serving malware, claims it has been defamed and has relaunched on a new domain.

bleepingcomputer.com · 3 min

TLDR InfoSec

MICROSOFT SAYS MORE CUSTOMER EMAILS ACCESSED BY RUSSIAN HACKERS

Microsoft disclosed that Russian hackers accessed more customer emails than previously known, including those of senior leadership and government agencies.

links.tldrnewsletter.com · 2 min