The Daily Index — Monday, July 22, 2024 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

🔍 Start evaluating FOSSA on your terms

Summary unavailable

app.fossa.com

TLDR InfoSec

MNGI DIGESTIVE HEALTH DATA BREACH IMPACTS 765,000 INDIVIDUALS

MNGI Digestive Health is notifying over 765,000 individuals about a data breach from August 2023. The breach, discovered nearly a year later, potentially exposed sensitive personal and health information, including names, Social Security numbers, medical data, and financial details. MNGI is currently working to inform affected individuals through written notifications.

securityweek.com · 3 min

TLDR InfoSec

PHANTOM SECRETS: UNDETECTED SECRETS EXPOSE MAJOR CORPORATIONS

The AquaSec team scanned over 50k repositories belonging to the top 100 organizations on GitHub for secrets using conventional (git clone) and unconventional methods. Using git clone --mirror fetches a more complete git history that includes PRs and other dangling refs. It led to finding additional secrets on 18% of scanned repositories. The Aqua team also tested a novel approach to scanning cached views from SCMs and found that some additional secrets could be found, though the process is difficult and has a lower chance of success.

aquasec.com · 10 min

TLDR InfoSec

SNEAKY WRITE HOOK: GIT CLONE TO ROOT ON K8S NODES

The gitRepo volume driver is a deprecated k8s storage driver that allows for reading files into a pod from a remote git repository. This post examines a vulnerability in the gitRepo driver whereby a maliciously crafted git repository could sneak git hooks into a node and execute commands as root. The authors submitted a PR to fix this issue which will be released in version 1.31.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

VIEW STATE, THE UNPATCHABLE IIS FOREVER DAY BEING ACTIVELY EXPLOITED

This blog post discusses why the ViewState vulnerability is not used for exploits despite being around for a long time and explains how it can be done on a fully patched Microsoft Exchange 2019 host. It explains how to exploit view state vulnerabilities and the process of resetting compromised machine keys in IIS. It also highlights the risks associated with resetting machine keys and provides steps to regenerate them based on whether they were automatically generated or static.

zeroed.tech · 25 min

TLDR InfoSec

COMMAND ZERO (PRODUCT LAUNCH)

Command Zero's platform for investigation combines autonomous and user-led methods in a federated data model and leverages automation and advanced Language Learning Models to augment human investigations.

cmdzero.io

TLDR InfoSec

WEST AFRICAN CRIME SYNDICATE TAKEN DOWN BY INTERPOL OPERATION

Operation Jackal III, a global law enforcement effort targeting West African crime groups, resulted in 300 arrests and $3 million in asset seizures. There are 400 additional suspects across 21 countries.

darkreading.com · 2 min

TLDR InfoSec

THE CLOUD SHARED IRRESPONSIBILITY MODEL

The Shared Responsibility Model is used by cloud providers to describe a split in security responsibilities where cloud providers are responsible for the underlying services and users are responsible for securing their workloads built on those services. Customer breaches could result in negative reputational damage to cloud providers. This forces cloud providers to improve their defaults to be more secure.

securosis.com · 4 min

TLDR InfoSec

NAVIGATING THE RDP SECURITY CONSEQUENCES OF TLS VS. NLA FROM A THREAT EXPOSURE PERSPECTIVE

This article compares RDP security using TLS-only versus NLA. NLA-secured servers faced significantly more login attempts but also provided more insights into attacker tactics. Geographical origins of attacks differed between NLA and TLS, with certain countries showing preferences for one protocol over the other. While NLA is considered more secure, it may attract more sophisticated attacks. Researchers found NLA honeypots to be more valuable for understanding cybersecurity threats and the human element behind them.

gosecure.ai · 6 min

TLDR InfoSec

CROWDSTRIKE'S FAULTY UPDATE CRASHED 8.5 MILLION WINDOWS DEVICES, SAYS MICROSOFT

Microsoft says that “less than one percent of all Windows machines” were affected, but it was enough to create problems for retailers, banks, airlines, and many other industries.

theverge.com · 3 min

TLDR InfoSec

SECURE SOFTWARE DEVELOPMENT EDUCATION 2024 SURVEY

Report on the state of education for secure software development that highlights gaps in education, time constraints in training, and AI security as a critical future area for education.

linuxfoundation.org · 20 min

TLDR InfoSec

JUDGE DISMISSES MAJOR SEC CHARGES AGAINST SOLARWINDS AND CISO

A judge dismissed major SEC charges against SolarWinds and its CISO Timothy Brown regarding cybersecurity practices after a supply chain attack.

securityweek.com · 2 min