The Daily Index — Friday, September 13, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CMS NOTIFIES 946K INDIVIDUALS OF THIRD-PARTY DATA BREACH

CMS has reported a data breach affecting over 946,000 Medicare beneficiaries. The breach occurred in May 2023. Hackers exploited a vulnerability in MOVEit software used by WPS, a CMS contractor. Although patched promptly, the vulnerability led to widespread data breaches across multiple sectors before being resolved.

techtarget.com · 3 min

TLDR InfoSec

NEW VO1D MALWARE INFECTS 1.3 MILLION ANDROID TV STREAMING BOXES

A new malware called Vo1d has infected over 1.3 million Android TV streaming boxes, giving attackers full control. Researchers found the malware in devices across 200 countries, with the highest numbers in Brazil, Morocco, and Pakistan. To protect against this threat, users should update firmware regularly and avoid installing apps from unofficial sources.

bleepingcomputer.com · 2 min

TLDR InfoSec

ADVANCED CYBERCHEF TECHNIQUES - DEFEATING NANOCORE OBFUSCATION WITH MATH AND FLOW CONTROL

This article walks through the process of deobfuscating a .vbs loader for Nanocore malware. The deobfuscation begins by using a regex to filter out comments in the obfuscated loader. It involves alternatively adding or dividing long decimal numbers with hexadecimal numbers to obtain char codes that are concatenated to form the code. The CyberChef script utilizes reflexes and capture groups to isolate the various components of the obfuscated code followed by Subsections to handle the alternating mathematical operations.

embeeresearch.io · 7 min

TLDR InfoSec

STRATEGIES USED BY ADVERSARIES TO STEAL APPLICATION ACCESS TOKENS

This blog post is a deep dive into mechanisms for stealing application access tokens and detection and mitigation strategies. It begins by exploring how access tokens are used and provides examples of how to use tools like AADInternals and Peirates along with some examples of how APTs steal tokens. The post then suggests methods for detecting access token compromise in Azure and provides a sample query to run to search for compromise. It provides mitigation techniques such as auditing logs and specific recommendations for ways to restrict web-based content on AWS, GCP, and Azure.

permiso.io · 10 min

TLDR InfoSec

SPIX (PRODUCT LAUNCH)

Spix automates advanced attack scenarios, including hallucinations, prompt injections, and off-topic conversations, to help AI security teams identify threats and vulnerabilities before they can be exploited.

splx.ai

TLDR InfoSec

CRYPTO SCAMS RAKE IN $5.6B A YEAR FOR CYBERSCUM LOWLIFES, FBI SAYS

The FBI's annual report reveals that crypto-related cybercrime in the US led to over $5.6 billion in losses last year, with older individuals being targeted the most. Investment scams, promising high returns but stealing money instead, are the main cause of the sharp rise in losses, highlighting the need for reporting such crimes to help combat them. Scammers use trust-building tactics, like fake profits and fake recovery specialists, to deceive victims, emphasizing the need for caution when engaging in cryptocurrency investments.

theregister.com · 3 min

TLDR InfoSec

THE NSA LAUNCHES A NEW PODCAST

The NSA has announced the launch of its new podcast. Called 'No Such Podcast', the first two episodes will feature declassified stories related to the signals intelligence operations involved in the operation to take down Osama bin Laden. The podcast will run through mid-October, with weekly episodes.

theverge.com · 2 min

TLDR InfoSec

AMAZON DYNAMODB ANNOUNCES SUPPORT FOR ATTRIBUTE-BASED ACCESS CONTROLS

Amazon has expanded ABAC support to DynamoDB. This expanded functionality will allow users to configure IAM policies to allow or deny specific conditions when an IAM principal's tags match a DynamoDB table's tags. The feature is in limited preview and access can be requested for accounts in the U.S. East (Virginia and Ohio) and U.S. West (North California) regions.

aws.amazon.com · 1 min

TLDR InfoSec

NEW ANDROID MALWARE 'AJINA.BANKER' STEALS FINANCIAL DATA AND BYPASSES 2FA VIA TELEGRAM

A new Android malware called Ajina.Banker targets bank customers in Central Asia to steal financial data and bypass 2FA through Telegram channels.

thehackernews.com · 3 min

TLDR InfoSec

UK ARRESTS TEEN LINKED TO TRANSPORT FOR LONDON CYBER ATTACK

A 17-year-old teenager was arrested in the UK for a cyberattack on Transport for London.

bleepingcomputer.com · 2 min

TLDR InfoSec

MASTERCARD BUYS RECORDED FUTURE FOR $2.65 BILLION

Mastercard is buying Recorded Future for $2.65 billion to enhance its cybersecurity services.

cyberscoop.com · 1 min