The Daily Index — Friday, August 9, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

FRANCE'S GRAND PALAIS DISCLOSES CYBERATTACK DURING OLYMPIC GAMES

The Grand Palais Réunion des musées nationaux in France was hit by a cyberattack on August 3, causing operational disruptions. While reports linked the ransomware attack to disruptions at other museums like the Louvre, the Louvre director denied any impact on their institution.

bleepingcomputer.com · 2 min

TLDR InfoSec

WINDOWS UPDATE FLAWS ALLOW UNDETECTABLE DOWNGRADE ATTACKS

A group of researchers from SafeBreach Labs presented a new attack at Black Hat that can be used to craft custom downgrades of critical OS components. The researchers found that a malicious action list XML file can push a Windows Downdate tool that bypasses all verification steps. Microsoft has been working with the researchers to develop a patch to prevent this attack and has released two CVEs related to it.

securityweek.com · 3 min

TLDR InfoSec

AUTOMATE AWS SECRET ROTATION WITH LAMBDA

This article walks through the process of creating a Lambda function to automate scheduled secrets rotation. The Lambda is written with a placeholder function that can be customized with the steps to generate a new API key or other secret and then the AWS SDK is used to update the secret value. OpenTofu/Terraform code is provided in the post.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

GETTING STARTED WITH IOT & HARDWARE HACKING

Part one of a hands-on series from TCM Security on getting started in hardware hacking. This post expands on some of the reasons to learn hardware hacking, why some basic hacking knowledge is helpful before starting, ways to get started for free, and tools that will prove useful for hardware hacking. The series will work on hacking a custom IoT firmware written for the Raspberry Pi Zero 2w.

tcm-sec.com · 10 min

TLDR InfoSec

VPN POST-EXPLOITATION TECHNIQUES IN THE WILD

This blog explains how VPN post-exploitation techniques can expose user credentials to attackers. Attackers can easily obtain credentials and access critical assets by compromising the VPN. To prevent this, use limited service accounts and dedicated identities for VPN authentication.

akamai.com · 9 min

TLDR InfoSec

SCAMNETIC (PRODUCT LAUNCH)

Scamnetic automatically scans emails and text messages, as well as links, QR codes, images, and physical mail in an effort to identify potential risks.

scamnetic.com

TLDR InfoSec

PHARMA GIANT CENCORA IS ALERTING MILLIONS ABOUT ITS DATA BREACH

Cencora revealed that it suffered a breach this past February but declined to provide more information. 1.43M individuals have been notified, with notifications still being submitted as of July. Cencora has refused to comment on the cause of the data breach or the number of individuals that were impacted by it.

techcrunch.com · 3 min

TLDR InfoSec

RANSOMWARE ATTACK COST LOANDEPOT $27 MILLION

Mortgage lender LoanDepot reported nearly $27 million in costs from a ransomware attack in January. The breach compromised personal and financial data of over 16 million individuals. Expenses included investigation, remediation, customer notifications, legal fees, and commission guarantees.

securityweek.com · 2 min

TLDR InfoSec

EXPLORING ANTI-PHISHING MEASURES IN MICROSOFT 365

Microsoft 365 has anti-phishing measures like the First Contact Safety Tip, but there are weaknesses that allow attackers to bypass them. Attackers can hide safety tips and spoof encryption icons in Outlook by manipulating CSS in HTML emails. Despite being notified, Microsoft has not yet fixed these issues, potentially leaving organizations vulnerable to phishing attacks.

certitude.consulting · 3 min

TLDR InfoSec

AMAZON BEDROCK ACHIEVES FEDRAMP HIGH AUTHORIZATION

Amazon Bedrock has achieved FedRAMP authorization for GovCloud users to access managed LLMs.

aws.amazon.com · 1 min

TLDR InfoSec

JUSTICE DEPARTMENT DISRUPTS NORTH KOREAN REMOTE IT WORKER FRAUD SCHEMES THROUGH CHARGES AND ARREST OF NASHVILLE FACILITATOR

A man from Nashville was arrested for helping North Korean IT workers deceive U.S. companies.

justice.gov · 5 min

TLDR InfoSec

MICROSOFT: EXCHANGE 2016 REACHES EXTENDED END OF SUPPORT IN OCTOBER

Microsoft Exchange 2016 will lose support on October 14, 2025, so admins should consider moving to Exchange 2019 for continued security updates.

bleepingcomputer.com · 3 min