The Daily Index — Friday, July 5, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

LATEST INTEL CPUS IMPACTED BY NEW INDIRECTOR SIDE-CHANNEL ATTACK

Researchers have discovered a new Branch Target Injection vulnerability in Intel CPUs that could be used to steal sensitive information. The attack has three components: the iBranch Locator uses eviction-based techniques to identify the indices and tags of victim branches and determine the Indirect Branch Predictor entries for them, targeted injections are then performed against the prediction structures to perform speculative code execution, and then an ASLR bypass makes the prediction and manipulation of control flow of protected processes easier. The researchers reported their findings to Intel and recommended more aggressive use of the Indirect Branch Protection Barrier and bolstering the Branch Prediction Unit design.

bleepingcomputer.com · 2 min

TLDR InfoSec

TWILIO CONFIRMS DATA BREACH AFTER HACKERS LEAK 33M AUTHY USER PHONE NUMBERS

The ShinyHunters hackers announced that they will leak 33M random phone numbers associated with Authy. Twilio has confirmed the breach. It reported that the vulnerability was due to an unauthenticated endpoint and that no systems were compromised. Twilio has secured the endpoint and is encouraging users to be vigilant for phishing and smishing attacks.

securityweek.com · 1 min

TLDR InfoSec

AMAZON DOCUMENTDB ANNOUNCES IAM DATABASE AUTHENTICATION

Amazon DocumentDB has added support for authentication using IAM users and role ARNs. Users and applications that connect to DocumentDB clusters can now use an IAM identity to authenticate, allowing for a passwordless experience. Clusters can also choose to allow both IAM and password authentication if desired.

aws.amazon.com · 2 min

TLDR InfoSec

VULNERABILITIES IN COCOAPODS OPEN THE DOOR TO SUPPLY CHAIN ATTACKS AGAINST THOUSANDS OF IOS AND MACOS APPLICATIONS

Researchers from Evasec have found vulnerabilities in CocoaPods that could let attackers insert malicious code into popular iOS and macOS apps by claiming ownership of unclaimed pods. Developers using CocoaPods should check their open source dependencies for security risks, as these vulnerabilities could lead to supply chain attacks affecting thousands of Apple device apps. CocoaPods has addressed the vulnerabilities, but organizations should follow security steps to protect their code from potential exploits.

evasec.io · 12 min

TLDR InfoSec

THE RUNTIME SECRETS' SECURITY GAP

This blog post discusses a new solution that introduces encrypted secret delivery directly into application memory to prevent exposure. Secrets can be securely stored, delivered, and accessed without compromising security using tools like tang, clevis, and latchy.

blog.gitguardian.com · 6 min

TLDR InfoSec

DECLARE YOUR AINDEPENDENCE: BLOCK AI BOTS, SCRAPERS, AND CRAWLERS WITH A SINGLE CLICK

Cloudflare has launched the ability for all accounts (including free accounts) to block all AI bots, crawlers, and scrapers with a single toggle under the Security -> Bots section. Cloudflare uses its global bot detection ML model to categorize traffic as potentially bot related. Under the new heuristic, traffic classified with a bot score under 30 will be blocked automatically.

blog.cloudflare.com · 7 min

TLDR InfoSec

INTRODUCING DOCS IN PROTON DRIVE

Proton is introducing end-to-end encrypted document editing and sharing to Proton Drive. The company states that all files, media, metadata, and keystrokes are completely encrypted and cannot be accessed by Proton or government surveillance (as it operates under Swiss privacy laws). Proton has begun rolling the feature out and it will be available to all users within the next few days.

proton.me · 3 min

TLDR InfoSec

NEW GOLANG-BASED ZERGECA BOTNET CAPABLE OF POWERFUL DDOS ATTACKS

A new botnet named Zergeca can launch powerful DDoS attacks and has advanced capabilities like proxying and reverse shell. It is written in Golang and uses DNS-over-HTTPS for communication with its command-and-control servers. The botnet has been actively targeting countries like Canada, Germany, and the U.S. with various attack methods.

thehackernews.com · 2 min

TLDR InfoSec

MALLOX RANSOMWARE: LINUX VARIANT DECRYPTOR FOUND

Mallox ransomware, which has been active since 2021, has evolved to target Linux systems using custom Python scripts for payload delivery and data exfiltration. The new variant employs AES-256 CBC encryption, appends .lmallox to encrypted files, and utilizes a Flask-based web panel for creating customized ransomware builds. Researchers have discovered decryptors for several build IDs and provided methods for detecting and hunting Mallox infrastructure using security tools like Uptycs XDR and search engines such as FOFA and Censys.

uptycs.com · 10 min

TLDR InfoSec

EUROPOL ANNOUNCES CRACKDOWN ON COBALT STRIKE SERVERS USED BY CYBERCRIMINALS

Europol took down almost 600 Cobalt Strike servers used by cybercriminals in a global crackdown.

securityweek.com · 2 min

TLDR InfoSec

OVHCLOUD BLAMES RECORD-BREAKING DDOS ATTACK ON MIKROTIK BOTNET

OVHcloud has been able to track a massive DDoS attack in May, which reached 2.5 Tbps, to Mikrotik botnet.

bleepingcomputer.com · 3 min

TLDR InfoSec

STUDY: NEARLY 60% OF GOOGLE SEARCHES END WITH ZERO CLICKS

A recent study found that almost 60% of Google searches don't result in users clicking on search results.

links.tldrnewsletter.com · 2 min