The Daily Index — Wednesday, July 17, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRYPTO EXECS ON DEFI DOMAIN HACKS: DON'T INTERACT WITH CRYPTO FOR NOW

A large swath of crypto domains are suffering from domain hijacking attacks. These domains were left vulnerable after the forced migration from Google Domains to Squarespace led to MFA being disabled. CoinGecko founder, Bobby Ong, is advising people to avoid interacting with crypto for a few days and wait for the situation to be resolved.

cointelegraph.com · 2 min

TLDR InfoSec

EMAIL ADDRESSES OF 15 MILLION TRELLO USERS LEAKED ON HACKING FORUM

A threat actor leaked 15 million Trello users' email addresses collected via an unsecured API. The leaked data can be used for phishing attacks and doxxing by linking email addresses to individuals. Atlassian confirmed the breach and made changes to secure the Trello REST API.

bleepingcomputer.com · 3 min

TLDR InfoSec

HERE'S HOW CAREFULLY CONCEALED BACKDOOR IN FAKE AWS FILES ESCAPED MAINSTREAM NOTICE

This post dives into how two fake AWS packages on the NPM JavaScript repository contained hidden code that backdoored developers' computers. The packages, which were downloaded hundreds of times, mimicked a legitimate library but included additional files with concealed malicious code.

arstechnica.com · 9 min

TLDR InfoSec

CLOUD ATTACK EMULATION: DEMOCRATIZING SECURITY OPERATIONS IN THE CLOUD

Security operations in the cloud are particularly complex as they require operators to have knowledge of security operations as well as cloud security. Cloud attack emulation can be the bridge needed as it allows teams to stress test their infrastructure against attacks. It can be utilized for cloud penetration testing, red/purple teaming, incident response readiness, and security assurance.

mitigant.io · 6 min

TLDR InfoSec

AWS NETWORK FIREWALL EGRESS FILTERING CAN BE EASILY BYPASSED

AWS Network Firewall is a fully managed service that works as an IDS/IPS to control egress between workloads running in a VPC and the Internet. AWS recommends the use of a domain list to allow specific domains that can be contacted. This post demonstrates that this security measure can be trivially bypassed by spoofing the host name to avoid the block as it doesn't utilize DNS lookups or IP blocking.

canglad.com · 5 min

TLDR InfoSec

GOOGLE'S KURIAN APPROACHED WIZ, $23B DEAL COULD TAKE A WEEK TO LAND, SOURCE SAYS

Alphabet is in advanced talks to acquire cybersecurity startup Wiz for $23 billion, doubling its last private valuation. If successful, it would value Wiz at 46 times its current ARR.

techcrunch.com · 3 min

TLDR InfoSec

IT'S NEVER BEEN EASIER FOR THE COPS TO BREAK INTO YOUR PHONE

The FBI quickly accessed the phone of Trump rally shooter Thomas Matthew Crooks, demonstrating advanced phone-hacking capabilities with the widespread use of tools like Cellebrite by law enforcement.

theverge.com · 3 min

TLDR InfoSec

KASPERSKY CULLS STAFF, CLOSES DOORS IN US AMID BIDEN'S BAN

Kaspersky is closing its US operations and cutting jobs following President Biden's ban on the Russian company. The closure affects fewer than 50 employees, with layoffs starting this week.

theregister.com · 2 min

TLDR InfoSec

HOW TO CONVINCE YOUR EMPLOYER TO COVER TRAINING

When requesting training, the first step is to check if your company has any benefits related to training. You should approach your mentor with either the specific courses that you're looking to take or ask for help in finding courses. This post includes a template that can be used to submit a formal budget request after obtaining manager approval.

linkedin.com · 4 min

TLDR InfoSec

GOOGLE'S DARK WEB MONITORING SERVICE WILL SOON BE FREE FOR ALL USERS

Previously, this feature was only available to Google One subscribers.

theverge.com · 2 min

TLDR InfoSec

MICROSOFT LINKS SCATTERED SPIDER HACKERS TO QILIN RANSOMWARE ATTACKS

Microsoft warns that the Scattered Spider cybercrime group is now using Qilin ransomware in attacks alongside other ransomware payloads.

bleepingcomputer.com · 2 min

TLDR InfoSec

BANKS IN SINGAPORE TO PHASE OUT ONE-TIME PASSWORDS IN 3 MONTHS

Singapore banks are phasing out one-time passwords (OTPs) in the next three months to protect customers from phishing and scams.

bleepingcomputer.com · 2 min