The Daily Index — Friday, August 16, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

AT HOME IN YOUR FIRMWARE: ANALYSIS OF CVE-2024-36877

A vulnerability in MSI SMM driver allowed attackers to run unauthorized code by exploiting a buffer overflow. The exploit involved setting a variable to corrupt SMRAM, leading to potential system compromise. Mitigation required setting DataSize to 8 for status message writing to physical memory.

jjensn.com · 23 min

TLDR InfoSec

PALO ALTO NETWORKS PATCHES UNAUTHENTICATED COMMAND EXECUTION FLAW IN CORTEX XSOAR

Palo Alto Networks patched a critical command execution flaw in its Cortex XSOAR product, allowing attackers to run commands without authentication. The company also addressed vulnerabilities in other products like Prisma Access Browser and PAN-OS, releasing patches to fix the issues. While no known attacks have occurred, Palo Alto Networks is proactive about addressing cybersecurity threats in its products.

securityweek.com · 2 min

TLDR InfoSec

CLOUDFRONT WAF RECOMMENDATIONS (REDDIT THREAD)

A Reddit user experienced a $9,000 bill due to a CloudFront WAF bypass. A comment presented a list of suggestions to improve WAF usage such as blocking the AWSManagedRulesAmazonIPReputationList list, setting rate limits at various levels with COUNT actions to determine baselines to block, restricting access to the S3 bucket, and blocking geos that customers don't reside in. The comment also suggested using AWS Shield Advanced, which gives access to the Shield Response Team and has a WAF allowance included in its $3,000/month cost.

links.tldrnewsletter.com

TLDR InfoSec

SPLITTING THE EMAIL ATOM: EXPLOITING PARSERS TO BYPASS ACCESS CONTROLS

This article details an exploration of how email parsers handle the more arcane parts of the RFC. It begins with background about ways that the RFC treats some special characters like escapes and comments. The article then details how the author utilized encoded words to bypass access controls to obtain access to protected environments using encoded words before taking it a step further to achieve RCE using puny codes. Relevant tooling for automating encoded word discovery with Turbo Intruder and fuzzing with punycode as well as a CTF are included.

portswigger.net · 14 min

TLDR InfoSec

INSIDE THE "3 BILLION PEOPLE" NATIONAL PUBLIC DATA BREACH

The 3 Billion people nationwide data breach has led to leaked records including names, addresses, and Social Security numbers. Data aggregator NPD is facing a class action lawsuit over the breach.

troyhunt.com · 10 min

TLDR InfoSec

THE FIRST POST-QUANTUM CRYPTOGRAPHY STANDARDS ARE HERE

NIST has announced the first set of standards for post-quantum cryptography: ML-KEM, ML-DSA, and SLH-DSA. ML-KEM uses a lattice system to create a secure communication channel whereas the other algorithms are for creation and verification of digital signatures. IBM's Dario Gil urges companies to start adopting these standards now as threat actors may be stockpiling encrypted data to crack with a quantum computer, which Gil theorizes should be available within the next 10 years.

techcrunch.com · 5 min

TLDR InfoSec

DETECTION AS CODE: A MATURITY FRAMEWORK

This post breaks Detection as Code (DaC) into four components: language, testing, integration, and monitoring. When a team starts adopting DaC, they may use markup languages before moving on to query languages and finally general purpose programming languages. As teams adopt testing for their DaC, they will likely begin with unit testing before adopting other forms of testing like integration testing and end-to-end testing. Teams will also add more monitoring and integrations as they mature. A maturity matrix is included at the end of the post.

catscrdl.io · 7 min

TLDR InfoSec

WE WROTE THE CODE, AND THE CODE WON

NIST announced new post-quantum cryptography standards, including SLH-DSA. Trail of Bits created a Rust implementation of SLH-DSA for secure cryptographic use. Its open-source project, which focuses on security and usability improvements, aids the transition to post-quantum cryptography.

blog.trailofbits.com · 3 min

TLDR InfoSec

MICROSOFT REMOVES FAT32 PARTITION SIZE LIMIT IN WINDOWS 11

Microsoft has removed the 32GB limit for FAT32 partitions in Windows 11, now allowing sizes up to 2TB.

bleepingcomputer.com · 2 min

TLDR InfoSec

GITHUB VULNERABILITY 'ARTIPACKED' EXPOSES REPOSITORIES TO POTENTIAL TAKEOVER

A new vulnerability in GitHub called ArtiPACKED could let attackers take over repositories by leaking tokens and compromising cloud services.

thehackernews.com · 2 min

TLDR InfoSec

RANSOMWARE KINGPIN WHO CALLED HIMSELF “J P MORGAN” EXTRADITED TO UNITED STATES

A cybercriminal known as "J P Morgan" has been extradited to the United States after a decade-long investigation.

tripwire.com · 2 min