The Daily Index — Monday, September 2, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

RANSOMHUB HITS 210 VICTIMS IN JUST 6 MONTHS

US agencies have issued a warning about RansomHub, a rapidly growing ransomware group formed in February with at least 210 victims across various sectors, including critical infrastructure. RansomHub exploits vulnerabilities with common hacking tools.

theregister.com · 3 min

TLDR InfoSec

CRITICAL FLAWS IN PROGRESS SOFTWARE WHATSUP GOLD EXPOSE SYSTEMS TO FULL COMPROMISE

Critical vulnerabilities in Progress Software's WhatsUp Gold, an enterprise network monitoring solution, could allow full system compromise. Over 1,200 internet-accessible instances may be affected by CVE-2024-4885, a critical flaw allowing remote code execution. A proof-of-concept is available.

securityweek.com · 3 min

TLDR InfoSec

EXPOSING SECURITY OBSERVABILITY GAPS IN AWS NATIVE SECURITY TOOLING

SecurityRunners' Jonathan Walker provides an analysis of the coverage of IAM Access Analyzer for detecting public or cross-account access to resources. Walker puts coverage at about 65% and lists a few notable gaps. AWS Glue and SES are fundamental services that Walker believes should have coverage. Secrets Manager currently only alerts if a KMS key and secret are public but Walker believes that it should alert on just a public secret in case a method of accessing it becomes apparent. Walker also notes that Elemental MediaStore certainly should have coverage but is fairly obscure so may be a backlog item. He also highly encourages deploying IAM Access Analyzer as it is simple to manage and cost-effective.

securityrunners.io · 9 min

TLDR InfoSec

UNPROTECTED CONTAINER REGISTRIES

Unprotected container registries are easily detectable on the web through tools like Shodan or scanning for common endpoints. This post demonstrates the ease with which an attacker can locate an unprotected container registry and upload or replace an existing image. The author located over 10k unprotected registries across the full IP space and was able to push a benign, PoC image to over 4,500 of them. They only uploaded a dummy image under an easily detectable name due to ethical considerations, but a motivated attacker could upload a malicious image just as easily.

dreher.in · 8 min

TLDR InfoSec

SET-TOP BOX RE: 6-PART SERIES (1 OF 6)

This blog series examines the security of six set-top boxes to determine if they're compromised or part of botnets. The research involves hardware triage, filesystem extraction, and malware analysis. It also explores how easily these devices could be exploited.

cc-sw.com · 4 min

TLDR InfoSec

UNIQKEY (PRODUCT LAUNCH)

Uniqkey's password and access management solution allows employees to use mobile applications when logging into enterprise systems while keeping passwords encrypted.

uniqkey.eu

TLDR InfoSec

ADVANCING THREAT INTELLIGENCE: JA4 FINGERPRINTS AND INTER-REQUEST SIGNALS

JA3 Fingerprints were first introduced in 2017 as a method to fingerprint browsers by taking a hash of the TLS ClientHello message, but they have lost efficacy due to differences in how tools handle various extensions and modern browsers scrambling TLS extensions. To combat this, FoxIO introduced JA4, which introduces other protocol elements into the fingerprint and is resilient to randomization of TLS extensions by first sorting them before hashing. To make JA4 fingerprints more useful to customers, Cloudflare aggregates data across its network on JA4 fingerprints into signals that can be used in Workers and rules. This post includes a breakdown of the different fields in a JA4 fingerprint, the statistics available via JA4 signals for a fingerprint, and a script demonstrating how to utilize signals in a Worker.

blog.cloudflare.com · 11 min

TLDR InfoSec

DON'T FORCE YOURSELF TO BECOME A BUG BOUNTY HUNTER

Sam Curry, a hacker and bug bounty hunter, reflects on a common mentality of setting up extensive goals and plans for getting into bug bounty hunting. Curry compares this with his experience and failure doing the same with his studies in high school. Ultimately, Curry suggests that the fundamental issue in many hackers that set out these goals and fail is that they aren't actually interested in bug bounty hunting and should instead not force themselves to do it.

samcurry.net · 5 min

TLDR InfoSec

CITY OF COLUMBUS SUES MAN AFTER HE DISCLOSES SEVERITY OF RANSOMWARE ATTACK

An Ohio judge has issued a restraining order against a security researcher who contradicted Columbus officials' claims about a recent ransomware attack. The researcher presented evidence that sensitive data stolen in the attack was intact and accessible, contrary to the mayor's statement. The city sued the researcher, claiming his actions made dark web data publicly available.

arstechnica.com · 4 min

TLDR InfoSec

AN AIR TRANSPORT SECURITY SYSTEM FLAW ALLOWED TO BYPASS AIRPORT SECURITY SCREENINGS

A security flaw in air transport systems allowed unauthorized people to bypass airport security screenings.

securityaffairs.com · 3 min

TLDR InfoSec

GARTNER FORECASTS GLOBAL INFORMATION SECURITY SPENDING TO GROW 15% IN 2025

Gartner predicts that by 2027, 17% of total cyberattacks/data leaks will involve generative AI.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

NORTH KOREAN HACKERS DEPLOY FUDMODULE ROOTKIT VIA CHROME ZERO-DAY EXPLOIT

North Korean hackers known as Citrine Sleet used a zero-day exploit in Google Chrome to deliver the FudModule rootkit.

thehackernews.com · 3 min