The Daily Index — Friday, August 2, 2024 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

Untitled entry

Summary unavailable

assurancelab.cpa

TLDR InfoSec

* Streamline your compliance with AI-powered audits

Summary unavailable

assurancelab.cpa

TLDR InfoSec

CISA: CRITICAL SERVICENOW VULNERABILITIES BEING TARGETED BY HACKERS

CISA and several security companies are warning that two ServiceNow vulnerabilities that were reported by AssetNote on July 11 are being actively exploited. The vulnerabilities allow attackers to access databases and exfiltrate data as well as read arbitrary files. Researchers warn of between 13k to 42k vulnerable ServiceNow instances ranging across the private and public sectors.

therecord.media · 3 min

TLDR InfoSec

'ERROR' IN MICROSOFT'S DDOS DEFENSES AMPLIFIED 8-HOUR AZURE OUTAGE

Microsoft admitted its defensive implementation worsened the Azure outage on July 30, which was initially triggered by a DDoS attack. DDOS attacks aim to overwhelm systems with malicious traffic. They are becoming increasingly common, so Microsoft should have been able to prevent the outage.

theregister.com · 3 min

TLDR InfoSec

REVEALING THE INNER STRUCTURE OF AWS SESSION TOKENS

Tal Be'ery, co-founder of ZenGo, performed a first ever analysis of AWS Session Tokens to uncover the components that make up a session token. The goal of this research was to discover if the tokens contained sensitive information and if tokens could be edited for forgery as well as other attack vectors. The research found that session tokens are base64 encoded protobufs that store most of the interesting information in a userEncryptedData field. The researchers found that they could forge tokens however AWS rejected forged tokens. The post includes more details about the reversing process and protobuf fields.

links.tldrnewsletter.com · 17 min

TLDR InfoSec

SECURING YOUR SECRETS IN AWS

An exploration of how to incrementally improve credentials access in AWS. The post begins with outlining a “vanilla” credentials workflow before detailing how environment variables do not solve the threats inherent with having plaintext credentials. It then outlines how to store secrets in Secrets Manager and have the application dynamically retrieve them to eliminate plaintext secrets from production. The next improvement comes from using KMS to encrypt secrets before using them in CI/CD pipelines to reduce the presence of plaintext credentials. The post then details steps that service providers can use to improve credential management for customers including bringing your own key.

dev.to · 20 min

TLDR InfoSec

CREATE YOUR OWN CUSTOM IMPLANT

This blog post discusses creating a custom implant for evasive purposes by avoiding detection through customized payloads. It explains the process of building the implant in C and includes details on server setup, interactive features, client functionality, and testing against security tools. The conclusion highlights the advantages of custom implants but also emphasizes the need for caution due to potential limitations and security considerations.

ribbiting-sec.info · 5 min

TLDR InfoSec

CLUTCH SECURITY (PRODUCT LAUNCH)

Clutch Security is a platform that gives security teams visibility into all of an organization's non-human identities. The platform allows security teams to understand which NHIs exist within the organization and identify associated risks.

clutch.security

TLDR InfoSec

RECORD-BREAKING $75 MILLION RANSOM PAID TO DARK ANGELS GANG

Ransomware attacks are rising, with an 18% year-on-year increase reported by Zscaler ThreatLabz. A record $75 million ransom was allegedly paid this year. The U.S. faces nearly half of all attacks, with a 93% increase. The U.K. was the second most targeted country.

forbes.com · 3 min

TLDR InfoSec

POOR SECURITY LET HACKERS ACCESS 40 MILLION VOTERS' DETAILS

The UK Electoral Commission was reprimanded by the ICO for a security lapse that left millions of voters' data vulnerable to hackers. The breach, which lasted over a year from August 2021, was enabled by unchanged passwords and outdated software.

bbc.co.uk · 3 min

TLDR InfoSec

OVER 1 MILLION DOMAINS AT RISK OF 'SITTING DUCKS' DOMAIN HIJACKING TECHNIQUE

A joint analysis by Infoblox and Eclypsium reveals that Russian cybercriminals are exploiting DNS weaknesses in "Sitting Ducks" attacks to hijack domains without accessing owner accounts. This method, easier and less detectable than other hijacking techniques, has affected over 35,000 domains since 2018.

thehackernews.com · 3 min

TLDR InfoSec

COST OF A DATA BREACH REPORT 2024

The average cost of a data breach jumped 10% to $4.88 million in 2023.

ibm.com · 30 min

TLDR InfoSec

TWILIO KILLS OFF AUTHY FOR DESKTOP, FORCIBLY LOGS OUT ALL USERS

Twilio has shut down its Authy for Desktop app, logging users out and discontinuing the service.

bleepingcomputer.com · 2 min

TLDR InfoSec

HACKERS DISTRIBUTING MALICIOUS PYTHON PACKAGES VIA POPULAR DEVELOPER Q&A PLATFORM

Hackers used Stack Exchange to trick developers into downloading malicious Python packages that could steal cryptocurrency.

thehackernews.com · 3 min