The Daily Index — Monday, August 26, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

MICROSOFT PATCHES CRITICAL COPILOT STUDIO VULNERABILITY EXPOSING SENSITIVE DATA

A critical security flaw (CVE-2024-38206) in Microsoft's Copilot Studio could allow authenticated attackers to bypass SSRF protection and access sensitive information. The vulnerability exploits Copilot's external web request feature to access Microsoft's internal infrastructure.

thehackernews.com · 2 min

TLDR InfoSec

HALLIBURTON SHUTS DOWN SYSTEMS AFTER CYBERATTACK

Energy giant Halliburton has reported a cyberattack, prompting it to shut down some internal systems. The company is investigating the impact. The U.S. Department of Energy has reported no current disruption to energy services.

techcrunch.com · 2 min

TLDR InfoSec

SLACK AI CAN BE TRICKED INTO LEAKING DATA FROM PRIVATE CHANNELS VIA PROMPT INJECTION

A method to abuse Slack AI to leak messages from private channels was recently discovered. The prompt injection attack enables attackers to post prompt injection messages in public channels and retrieve API keys from channels that the attackers do not have access to. Slack has stated that this is not a vulnerability and that the feature is working as intended.

theregister.com · 3 min

TLDR InfoSec

WHAT IS AN SBAT AND WHY DOES EVERYONE SUDDENLY CARE

Secure Boot Advanced Targeting (SBAT) was developed to address the limitations of revoking individual hashes for bootloader binaries in the Secure Boot ecosystem. Microsoft pushed a Windows update that made systems not trust versions of grub with a security generation below a certain level due to security vulnerabilities, causing boot issues for some users. The incident highlights the importance of updating bootloader code and security generations to prevent potential attacks on operating systems.

mjg59.dreamwidth.org · 5 min

TLDR InfoSec

LINUX DETECTION ENGINEERING - A PRIMER ON PERSISTENCE MECHANISMS

This blog post discusses Linux persistence mechanisms used by threat actors and how to detect and hunt for these techniques. It covers methods like scheduled tasks, systemd services, shell profile modifications, and reverse shells, providing practical demonstrations using a tool called PANIX. The post aims to educate defenders and researchers on foundational aspects of Linux persistence for effective detection and security strategies.

elastic.co · 30 min

TLDR InfoSec

HEELER (PRODUCT LAUNCH)

Heeler provides real-time code, behavior, and business context so that organizations can automate the process of assessing security risks and prioritize operations and objectives.

heeler.com

TLDR InfoSec

AFTER CYBERSECURITY LAB WOULDN'T USE AV SOFTWARE, US ACCUSES GEORGIA TECH OF FRAUD

Dr. Manos Antonakakis, a Georgia Tech cybersecurity researcher, received millions in DoD funding. The US government is now suing Georgia Tech, claiming Antonakakis and the university failed to follow required security protocols, including installing antivirus software, despite knowing the requirements.

arstechnica.com · 4 min

TLDR InfoSec

SECURITY TRAINING & AWARENESS - 10 ESSENTIAL TECHNIQUES

This post reflects on what aspects have helped security awareness training work and what hasn't. It emphasizes ambient security controls which offer concrete solutions and escalation paths over long lists of policies and traditional, computer-based training. It also points out key moments to reinforce learning, such as when users run into a guard rail and when they switch positions.

philvenables.com · 16 min

TLDR InfoSec

16 THOUGHTS ON “LOCAL NETWORKS GO GLOBAL WHEN DOMAIN NAMES COLLIDE”

Due to the proliferation of new Top Level Domains (TLDs), many internal networks now collide with external networks, potentially exposing their networks to credential theft and other attacks. Security researcher Philippe Caturegli has been mapping this "namespace collision" vulnerability by scanning for self-signed certificates referencing domains in business-oriented TLDs. Caturegli found over 9,000 exposed domains, with some government entities and critical infrastructure affected.

krebsonsecurity.com · 7 min

TLDR InfoSec

GOOGLE PLAY BUG BOUNTY PROGRAM SHUTTING DOWN

Google is shutting down its Google Play Security Reward Program (GPSRP) as a result of the overall increase in the Android OS security posture and feature hardening efforts.

securityweek.com · 2 min

TLDR InfoSec

AUDIT FINDS NOTABLE SECURITY GAPS IN FBI'S STORAGE MEDIA MANAGEMENT

An audit conducted by the Department of Justice found security weaknesses in the FBI's handling of electronic storage media with sensitive information.

bleepingcomputer.com · 2 min

TLDR InfoSec

FRANCE POLICE ARRESTED TELEGRAM CEO PAVEL DUROV

French police arrested Telegram CEO Pavel Durov due to a lack of content moderation, which facilitated criminal activity.

securityaffairs.com · 2 min