The Daily Index — Friday, July 19, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CRITICAL CISCO BUG LETS HACKERS ADD ROOT USERS ON SEG DEVICES

Cisco has fixed a critical vulnerability that allows hackers to add root users and crash SEG devices using malicious email attachments. The flaw involves an absolute path traversal weakness in SEG content scanning, enabling attackers to replace files on the system. Cisco advises updating vulnerable appliances to prevent exploitation and contacting its Technical Assistance Center for assistance.

bleepingcomputer.com · 2 min

TLDR InfoSec

CROWDSTRIKE UPDATE CAUSES MAJOR IT OUTAGE, TAKING OUT BANKS, AIRLINES, AND BUSINESSES ACROSS THE WORLD

Businesses all over the world, from hospitals to banks and other companies, are reporting IT outages. Microsoft started noting issues on its Service Health page in the early hours of today. Shortly thereafter, outages became widespread. CrowdStrike says that a faulty update is causing crashes in Windows systems - Mac and Linux devices are unaffected. The issue stems from invalidly formatted .sys files causing the top level driver to crash. Recovery will be very difficult.

techcrunch.com · 5 min

TLDR InfoSec

LINUX KERNEL: VULNERABILITY IN THE EBPF VERIFIER REGISTER LIMIT TRACKING

A bug in the Linux Kernel's eBPF verifier can lead to a system compromise by allowing attackers to manipulate register values. The vulnerability was fixed in July after being reported in June. It requires specific permissions and is not widespread among applications or containers.

github.com · 4 min

TLDR InfoSec

ARE MY AWS RESOURCES ENCRYPTED OR UNENCRYPTED BY DEFAULT?

Fog Security investigated 51 different AWS resources and found that only 76% of them were encrypted by default, with 22 of those being encrypted with AWS Owned Keys by default. Even when encrypted by default, services that used AWS Owned Keys were shared between AWS accounts and don't typically offer more access controls. AWS Managed Keys are controlled by AWS and typically implicitly grant access to IAM principals in the same account, so they may offer less protection than expected. Fog Security recommends enabling encryption by default where possible and also opting for the use of AWS Customer Managed Keys where possible.

fogsecurity.io · 5 min

TLDR InfoSec

HOW TO ANALYZE MALICIOUS MSI INSTALLER FILES

This blog post discusses in detail how to analyze malicious MSI files used for software installation on Windows. MSI installers can hide malicious code within legitimate packages to avoid detection by security tools. Threat actors often use custom actions in MSI files to execute harmful code during installation.

intezer.com · 18 min

TLDR InfoSec

LEVERAGING AUTOMATED FIRMWARE ANALYSIS WITH THE OPEN-SOURCE FIRMWARE ANALYZER EMBA

This blog post discusses how automated firmware analysis tools like EMBA enhance security by scanning for vulnerabilities in device firmware. EMBA's open-source approach allows for deep analysis, detection of unknown threats, and customized testing. Leveraging EMBA can significantly improve product security, protect critical devices, and streamline the firmware analysis process.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

AWS SECRETS MANAGER ANNOUNCES OPEN SOURCE RELEASE OF SECRETS MANAGER AGENT

AWS has released a language agnostic local HTTP service that can be installed in compute environments to read and cache secrets from Secrets Manager. TTL, cache size, maximum connections, and HTTP port can be configured in the agent. The agent also includes SSRF protections by default.

aws.amazon.com · 2 min

TLDR InfoSec

HACKER JAILED FOR CREATING MALWARE THAT TARGETED BRAINTREE SITE

A university student created malware to disrupt government websites and made £45,000 from selling it. He targeted a Jobcentre in Braintree, Essex, and was sentenced to 21 months in jail for computer misuse. The malware caused websites to go offline by overwhelming them with internet traffic.

bbc.com · 2 min

TLDR InfoSec

NULLBULGE | THREAT ACTOR MASQUERADES AS HACKTIVIST GROUP REBELLING AGAINST AI

NullBulge is a cybercriminal group that targets AI and gaming entities. This post talks about how NullBulge distributes malware through GitHub and Hugging Face, posing a threat to software supply chains. NullBulge has shifted towards hacktivist motives for financial gain.

sentinelone.com · 9 min

TLDR InfoSec

CISA PUBLISHES RESILIENCE-PLANNING PLAYBOOK FOR CRITICAL INFRASTRUCTURE

CISA has released a new playbook to help improve security and resilience in critical infrastructure.

statescoop.com · 2 min

TLDR InfoSec

WAZIRX CRYPTOCURRENCY EXCHANGE LOSES $230 MILLION IN MAJOR SECURITY BREACH

WazirX, an Indian cryptocurrency exchange, suffered a security breach resulting in the theft of $230 million in crypto assets.

thehackernews.com · 2 min