The Daily Index — Monday, August 12, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

ALMOST UNFIXABLE “SINKCLOSE” BUG AFFECTS HUNDREDS OF MILLIONS OF AMD CHIPS

Researchers have discovered a security flaw, dubbed Sinkclose, in AMD processors, affecting chips since 2006. The vulnerability allows hackers to run malicious code in the chip's privileged System Management Mode. While requiring initial access, Sinkclose enables deep-seated malware installation that can survive OS reinstallation and be extremely difficult to remove.

arstechnica.com · 3 min

TLDR InfoSec

ECOVACS HOME ROBOTS CAN BE HACKED TO SPY ON THEIR OWNERS, RESEARCHERS SAY

Security researchers discovered severe vulnerabilities in Ecovacs robots that allow hackers to take control via Bluetooth from up to 450 feet away. Once compromised, attackers can remotely access cameras, microphones, and Wi-Fi credentials. Ecovacs hasn't responded to the researchers' reports, leaving these vulnerabilities potentially exploitable.

techcrunch.com · 3 min

TLDR InfoSec

WHAT'S THE WORST PLACE TO LEAVE YOUR SECRETS? – RESEARCH INTO WHAT HAPPENS TO AWS CREDENTIALS THAT ARE LEFT IN PUBLIC PLACES

Researchers deployed canary tokens (aka fake AWS credentials) in public online locations to study threat actor behavior. These digital tripwires triggered alerts when accessed, revealing patterns in credential discovery and attack methods.

cybenari.com · 15 min

TLDR InfoSec

TRAILSHARK: UNDERSTANDING AWS API AND SERVICE INTERACTIONS

TrailShark is a tool that integrates AWS CloudTrail logs with Wireshark for real-time analysis of API calls. It helps identify vulnerabilities in AWS services by monitoring internal API interactions. TrailShark offers features like advanced filtering, inner API call analysis, and custom event creation to enhance security and transparency in AWS environments.

blog.aquasec.com · 2 min

TLDR InfoSec

0.0.0.0 DAY: EXPLOITING LOCALHOST APIS FROM THE BROWSER

Security researchers discovered a new vulnerability whereby websites can bypass protections and send requests to 0.0.0.0 and reach internal APIs that are listening on localhost. This vulnerability was able to bypass Google Chrome's Private Network Access protections because 0.0.0.0 was not on the blocklist that it uses. Following the researchers' findings, all major browsers have committed to blocking requests to 0.0.0.0 and establishing Private Network Access as a standard which will include 0.0.0.0 in its blocklist.

oligo.security · 9 min

TLDR InfoSec

ENDARI (PRODUCT LAUNCH)

Endari provides customers with scalable solutions for protecting assets and customer data without the need for a full-time security team.

links.tldrnewsletter.com

TLDR InfoSec

ORACLE COUGHS UP $115M TO MAKE PRIVACY CASE GO AWAY

Oracle has agreed to pay $115 million to settle a class action lawsuit alleging user data misuse. The settlement, which affects 220 million people, requires Oracle to address privacy violations and implement an audit program for customer compliance.

theregister.com · 3 min

TLDR InfoSec

GHOSTWRITE VULNERABILITY AFFECTS RISC-V CPU, MITIGATING TAKES A ~77% PERFORMANCE HIT

A new CPU vulnerability called GhostWrite affects a common RISC-V processor, allowing attackers to read/write to any part of the computer's memory. Mitigating GhostWrite requires disabling around half of the CPU's functionality, leading to a significant 77% performance hit by turning off the vector extension support. The vulnerability is not related to speculative execution. RISC-V chips are becoming more popular targets for security researchers and attackers.

phoronix.com · 2 min

TLDR InfoSec

A FIVE YEAR RETROSPECTIVE ON DETECTION AS CODE

This author discusses Detection as Code and lessons learned in five years as it has evolved beyond simply writing detection logic in programming languages to focus instead on codifying processes and leveraging CI/CD pipelines for automated checks and version control. Test-Driven Detection (TDD), which emphasizes test creation before writing detection logic, is emerging as a best practice. LLMs show promise in auditing and improving detector descriptions within CI/CD pipelines but aren't suitable for creating detection logic.

magonia.io · 6 min

TLDR InfoSec

HACKERS LEAK 2.7 BILLION DATA RECORDS WITH SOCIAL SECURITY NUMBERS

2.7 billion personal records, including Social Security numbers, were leaked from National Public Data on a hacking forum, exposing sensitive information of people in the US.

bleepingcomputer.com · 3 min

TLDR InfoSec

UK AND FRANCE TO CONSULT ON COMMERCIAL CYBER INTRUSION CAPABILITIES

The UK and France are consulting on commercial cyber intrusion capabilities through the Pall Mall Process.

gov.uk · 1 min

TLDR InfoSec

FACT SHEET: BIDEN-HARRIS ADMINISTRATION RELEASES END OF YEAR REPORT ON OPEN-SOURCE SOFTWARE SECURITY INITIATIVE

The White House released a report on open-source software security initiatives that details activities planned by the OS3I for 2024-2025.

whitehouse.gov · 2 min