The Daily Index — Wednesday, August 14, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

THREAT ACTOR IMPERSONATES GOOGLE VIA FAKE AD FOR AUTHENTICATOR

MalwareBytes detected a malware campaign that used Google ads to pose as a download page for the Google authenticator app. The downloaded file was hosted on GitHub and was actually the DeerStealer infostealer. This post includes screenshots showing how the attacker was able to make the ad look legitimate by registering a verified advertiser profile.

malwarebytes.com · 4 min

TLDR InfoSec

CRITICAL SAP FLAW ALLOWS REMOTE ATTACKERS TO BYPASS AUTHENTICATION

SAP released security patches for 17 vulnerabilities, including a critical flaw allowing remote attackers to bypass authentication and compromise systems. The flaw impacts SAP BusinessObjects Business Intelligence Platform versions 430 and 440. Hackers target such flaws to access valuable corporate networks, so it's crucial to apply updates promptly.

bleepingcomputer.com · 2 min

TLDR InfoSec

COMPROMISING MICROSOFT'S AI HEALTHCARE CHATBOT SERVICE

Azure Health Bot Service, a platform for AI health assistants, had critical vulnerabilities allowing cross-tenant access. Microsoft has applied mitigations across affected services and regions. No customer action is required.

tenable.com · 5 min

TLDR InfoSec

LISTEN TO THE WHISPERS: WEB TIMING ATTACKS THAT ACTUALLY WORK

James Kettle presented at DEFCON on how he exploited timing attacks with delays as low as 200 microseconds. To reduce noise, Kettle utilized HTTP/2 to send multiple requests that arrived at the same time and interleaved a ping packet to force HTTP header coalescing, trying to hit slow code paths. He was able to effectively demonstrate the efficacy of this technique in discovering hidden parameters, server-side injections, and reverse-proxy misconfigurations.

portswigger.net · 10 min

TLDR InfoSec

SECURE CODE REVIEW: FINDING XML VULNERABILITIES IN CODE [1/2]

This text discusses the importance of code security and the vulnerabilities that can arise when working with XML parsers in C++ code. It covers the XXE vulnerability and provides examples of insecure and secure code implementations to prevent such vulnerabilities. The author aims to help beginners improve their security code review skills by understanding and mitigating common XML vulnerabilities.

muqsitbaig.com · 7 min

TLDR InfoSec

LEAKSIGNAL (PRODUCT LAUNCH)

LeakSignal's platform allows customers to block sensitive data before it is logged, observe and redact it during calls to outbound third-party application programming interfaces (APIs), and observe and set limits on internal API data access.

leaksignal.com

TLDR InfoSec

APPLOCKERGEN (WEBAPP)

AppLockerGen is a tool that simplifies the process for generating AppLocker XML policies. The webapp features prebuilt policies as well as GUIs for merging or generating policies.

applockergen.streamlit.app

TLDR InfoSec

FBI SHUTS DOWN DOZENS OF RADAR/DISPOSSESSOR RANSOMWARE SERVERS

The FBI has dismantled servers and domains associated with the Radar/Dispossessor ransomware group, which evolved from piggybacking on LockBit's stolen data to becoming an independent operation. The takedown involved international collaboration with UK and German law enforcement agencies.

darkreading.com · 3 min

TLDR InfoSec

WHO USES LLM PROMPT INJECTION ATTACKS IRL? MOSTLY UNSCRUPULOUS JOB SEEKERS, JOKESTERS, AND TROLLS

Research reveals prompt injection attacks on LLMs are primarily used by job seekers bypassing HR screeners and AI protesters, not criminals. The technique overrides initial instructions given to AI models. While direct injections are common, indirect injections via web pages or documents also occur.

theregister.com · 4 min

TLDR InfoSec

INTRODUCING HTTP REQUEST TRAFFIC INSIGHTS ON CLOUDFLARE RADAR

Cloudflare Radar now includes insights on HTTP request traffic, allowing users to compare bytes with requests for better traffic analysis. New graphs have been added to show HTTP request-based traffic data on the Overview and Traffic sections of Cloudflare Radar. These new metrics offer a clearer view of user behavior and traffic patterns.

blog.cloudflare.com · 6 min

TLDR InfoSec

UPDATES TO RUNTIME PROTECTION IN MACOS SEQUOIA

Apple will be disabling the ability to override Gatekeeper with Control-click when opening software that isn't properly signed or notarized.

developer.apple.com · 1 min

TLDR InfoSec

WHAT WE KNOW ABOUT SUSPECTED IRANIAN CYBER INTRUSION IN THE US PRESIDENTIAL RACE

A suspected Iranian cyber intrusion targeted the Trump and Biden campaigns, with stolen documents leaked to media outlets.

securityweek.com · 4 min

TLDR InfoSec

NIST RELEASES FIRST 3 FINALIZED POST-QUANTUM ENCRYPTION STANDARDS

NIST has released new encryption standards to protect against quantum computer attacks.

nist.gov · 5 min