The Daily Index — Monday, July 29, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRYPTO EXCHANGE GEMINI DISCLOSES THIRD-PARTY DATA BREACH

Gemini cryptocurrency exchange disclosed a data breach involving banking information of some customers. The breach was caused by a cyberattack on a third-party service provider. Gemini is advising impacted individuals to stay vigilant and take measures to protect their bank accounts from potential fraud.

bleepingcomputer.com · 2 min

TLDR InfoSec

CRITICAL BUG IN DOCKER ENGINE ALLOWED ATTACKERS TO BYPASS AUTHORIZATION PLUGINS

A critical bug in Docker Engine lets attackers bypass authorization plugins in certain versions by sending API requests with no content, leading to potential unauthorized actions like privilege escalation. The vulnerability, tracked as CVE-2024-41110, affects specific versions of Docker Engine up to v27.1.0 and Docker Desktop up to version 4.32.0. It can be mitigated by updating to the latest patched versions, avoiding AuthZ plugins, and restricting access to the Docker API.

securityaffairs.com · 2 min

TLDR InfoSec

MAPPING THE ATTACK SURFACE FROM THE INSIDE

The Mercari Security team discusses its process for creating a tool to map an attack surface. The first iteration of the tool sought to scan IaC for domains and scan them using the Burp Enterprise API. This strategy failed, as their IaC did not contain all domains. The next iteration involved directly querying asset inventories from AWS and GCP and then spinning up a GCR task to utilize a Chromium browser to take screenshots and then visualize the hostnames and IP addresses found.

engineering.mercari.com · 7 min

TLDR InfoSec

THREAT HUNTING - SUSPICIOUS NAMED PIPES

This blog post discusses how Named Pipes can be used by attackers for Command and Control and how defenders like EDRs can detect these usages. Attackers can exploit named pipes to move laterally within a network. Monitoring named pipe creation and communication patterns can help detect malicious activities.

links.tldrnewsletter.com · 17 min

TLDR InfoSec

NVIDIA EMBRACES LLMS & COMMONSENSE CYBERSECURITY STRATEGY

Nvidia's team will be sharing insights from red-teaming the company's AI systems. While AI applications pose significant enterprise risks due to their privileged status, existing security practices can be adapted to address these new threats.

darkreading.com · 5 min

TLDR InfoSec

Ready to work smarter? Try FOSSA free today

Summary unavailable

app.fossa.com

TLDR InfoSec

INTRODUCING SIGMA FILTERS

Sigma Filters are a new tool that helps Security Operations Centers manage threat detection more effectively. They allow for the creation of specific filters separate from detection rules, improving rule management and reducing false positives. By using Sigma Filters, SOC analysts can better tailor detection rules to their unique environments and avoid detection evasion by attackers.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

ZEROTIER (PRODUCT LAUNCH)

Zerotier creates secure connections between devices such as routers or IoT devices and has them talking away as if they're on a local network to secure them.

zerotier.com

TLDR InfoSec

BUILDING A SECURITY PLATFORM ENGINEERING TEAM

Kane Narraway, a security manager at Canva, writes about the benefits of a Security Platform Engineering team that can develop new solutions to scale security as well as build secure-by-default systems with other teams. Narraway reflects on the reality that in many organizations, security engineers form this function as another part of their role which can lead to complications when employees leave or maintain the system. Narraway suggests that this function should come after a security team is fully staffed and should ideally be composed of at least two software engineers and a manager.

kanenarraway.com · 9 min

TLDR InfoSec

DAGGERFLY: ESPIONAGE GROUP MAKES MAJOR UPDATE TO TOOLSET

The Macma backdoor is linked to the Daggerfly toolkit. Symantec has shared code and infrastructure with other known Daggerfly malware. A new Windows backdoor named Suzafk, capable of using TCP or OneDrive for command and control purposes, has been added to the Daggerfly toolkit. Daggerfly is a sophisticated espionage group with a wide range of tools targeting various operating systems and the ability to quickly update its toolset to evade detection.

symantec-enterprise-blogs.security.com · 4 min

TLDR InfoSec

CHECK POINT RESEARCH REPORTS HIGHEST INCREASE OF GLOBAL CYBER ATTACKS SEEN IN LAST TWO YEARS – A 30% INCREASE IN Q2 2024 GLOBAL CYBER ATTACKS

There was a 30% YoY increase in global cyberattacks in Q2 2024, averaging 1,636 attacks per organization weekly. Education/Research, Government/Military, and Healthcare were the most targeted sectors with Latin America, Africa, and Europe seeing the largest increase in attacks.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

X BEGINS TRAINING GROK AI WITH YOUR POSTS, HERE'S HOW TO DISABLE

X quietly started using public posts to train its Grok AI chat platform without notifying users - this post discusses how this can be disabled.

bleepingcomputer.com · 2 min

TLDR InfoSec

CHROME WILL NOW PROMPT SOME USERS TO SEND PASSWORDS FOR SUSPICIOUS FILES

Google is extending Enhanced mode feature for Safe Browsing in Chrome to allow users to upload password-protected executable files for deep scanning for malware detection.

arstechnica.com · 4 min

TLDR InfoSec

US DOJ INDICTS NORTH KOREAN HACKER FOR RANSOMWARE ATTACKS ON HOSPITALS

The US Department of Justice indicted a North Korean hacker for ransomware attacks on healthcare facilities, linking the funds to illicit activities in North Korea.

thehackernews.com · 7 min