The Daily Index — Monday, July 15, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEARLY ALL AT&T SUBSCRIBERS' CALL RECORDS STOLEN IN SNOWFLAKE CLOUD HACK

AT&T reported a data breach affecting nearly all its cellular customers, exposing call and text records. The breach, linked to the Snowflake attack, leaked phone numbers but not names or message content. AT&T is working with law enforcement and notifying affected customers, offering access to compromised data details.

arstechnica.com · 4 min

TLDR InfoSec

EXIM VULNERABILITY AFFECTING 1.5M SERVERS LETS ATTACKERS ATTACH MALICIOUS FILES

A new vulnerability with a CVSS score of 9.1 allows attackers to bypass attachment extension blocking and deliver executables to victims has been discovered. The vulnerability stems from an error in the way Exim parses multiline headers. Researchers have found that more than 1.5M email servers run vulnerable versions of Exim.

arstechnica.com · 2 min

TLDR InfoSec

UNMASKING THE DIGITAL BATTLEFIELD: HOW CYBER WARFARE IS SHAPING THE FUTURE OF GLOBAL CONFLICT AND SECURITY

The digital age has transformed international conflict, with cyber warfare emerging as a new paradigm. Data has become a weapon, reshaping how nations exert power and protect sovereignty in the global arena. This blog post dives into this transformation and what is coming next.

links.tldrnewsletter.com · 14 min

TLDR InfoSec

MOONWALK: A DEEP DIVE INTO THE UPDATED ARSENAL OF APT41 | PART 2

The Moonwalk malware has a modular design allowing for flexibility in functionality. It communicates through Google Drive and uses encryption for security. MoonWalk evades detection by using Windows Fibers and obfuscating its origins.

zscaler.com · 9 min

TLDR InfoSec

PASSWORD BREAKING A TO Z

This comprehensive guide on password cracking and what it takes to build a password cracking workstation contains FAQs and links to previous posts on the topic. The guide notes that using GPUs can significantly speed up password cracking compared to using CPUs alone, but some algorithms may require a combination of GPU and CPU for efficient attacks. Building an efficient password recovery workstation involves considering power consumption, cooling solutions, and the type of attacks needed for different encryption formats.

blog.elcomsoft.com · 12 min

TLDR InfoSec

TRACEBIT (PRODUCT LAUNCH)

Tracebit creates tailored canaries (fake honeypots) across cloud environments to lure threats, increase detection rates, accelerate responses, and reduce costs.

tracebit.com

TLDR InfoSec

ANNOUNCING AES-GEM (AES WITH GALOIS EXTENDED MODE)

AES-GEM is a new encryption method that improves AES-GCM's security weaknesses. It offers AES-128-GEM and AES-256-GEM variants with enhanced key lengths and performance. While not ready for production yet, AES-GEM minimizes vulnerabilities and enhances encryption capabilities.

blog.trailofbits.com · 12 min

TLDR InfoSec

CISA BROKE INTO A US FEDERAL AGENCY, AND NO ONE NOTICED FOR A FULL 5 MONTHS

CISA's 2023 red team exercise on an unnamed federal agency revealed significant security vulnerabilities. The team exploited an unpatched Oracle Solaris vulnerability (CVE-2022-21587) to gain full access. Despite being notified, the agency took over two weeks to patch and failed to conduct a thorough investigation.

theregister.com · 4 min

TLDR InfoSec

THE STARK TRUTH BEHIND THE RESURGENCE OF RUSSIA'S FIN7

Cybercrime group Fin7, responsible for billions in losses, has made a comeback in 2024 after being declared dead by U.S. authorities in 2023. It is using a hosting provider called Stark Industries Solutions to set up thousands of fake websites targeting various brands for phishing attacks. Researchers have uncovered Fin7's extensive cybercrime infrastructure and warn of its rapid expansion and malicious activities, which includes targeting tourists visiting France for the Summer Olympics.

krebsonsecurity.com · 4 min

TLDR InfoSec

DISNEY'S INTERNAL SLACK BREACHED? NULLBULGE LEAKS 1.1 TIB OF DATA

Hacktivist group NullBulge claims to have breached Disney's internal Slack, leaking 1.1 TiB of data, including messages, files, and code. The group aims to protect artists' rights and fair compensation. Disney has faced criticism for not paying royalties to writers and artists, with NullBulge possibly linked to the LockBit ransomware gang.

hackread.com · 3 min

TLDR InfoSec

A GROUP OF R1 JAILBREAKERS FOUND A MASSIVE SECURITY FLAW IN RABBIT'S CODE

Researchers discovered API keys hardcoded in the company's codebase, putting sensitive information at risk of falling into the wrong hands.

theverge.com · 2 min

TLDR InfoSec

FAKE MICROSOFT TEAMS FOR MAC DELIVERS ATOMIC STEALER

A fake Microsoft Teams ad for Mac was used in a malvertising campaign targeting Mac users to deliver the Atomic Stealer malware.

malwarebytes.com · 3 min

TLDR InfoSec

HACKERS USE POC EXPLOITS IN ATTACKS 22 MINUTES AFTER RELEASE

Hackers are quick to use PoC exploits in attacks, sometimes within 22 minutes of release.

bleepingcomputer.com · 2 min