The Daily Index — Monday, October 7, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

ALERT: OVER 700,000 DRAYTEK ROUTERS EXPOSED TO HACKING VIA 14 NEW VULNERABILITIES

Researchers discovered 14 security vulnerabilities, dubbed DRAY:BREAK, in DrayTek routers used in homes and businesses. These flaws could allow attackers to take control of affected devices, potentially gaining access to enterprise networks. The vulnerabilities range in severity, with two rated critical, including one with the highest possible CVSS score of 10.0.

thehackernews.com · 4 min

TLDR InfoSec

ABOUT A QUARTER MILLION COMCAST SUBSCRIBERS HAD THEIR DATA STOLEN FROM DEBT COLLECTOR

Comcast revealed that data on over 200K customers was stolen in February in a ransomware attack on its former debt collector, FBCS. The company learned in July that customer information was compromised, including names, addresses, SSNs, and account details from around 2021.

theregister.com · 3 min

TLDR InfoSec

TO CATCH A PREDATOR ADMIN: THE POWER OF OSINT

This blog post describes an investigation using OSINT tools that uncovered a disturbing online CSAM marketplace run by 'JoeHaze'. Despite challenges with law enforcement response, efforts were made to gather evidence and report the predator to authorities for further action. The importance of protecting children from online predators was emphasized throughout the investigation.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

SAFE RIDE INTO THE DANGERZONE: REDUCING ATTACK SURFACE WITH GVISOR

Dangerzone is a software that sanitizes potentially risky documents by detonating them in a container, creating a pixel map of the document, then converting that image back to a document. Prior to version 0.7.0, Dangerzone relied on Linux containers that are hardened via removing process and network capabilities, minimal user ID mapping, and syscall filtering via seccomp. To address gaps in its security posture, Dangerzone integrated with gVisor, which is an application kernel that has minimal privileges. To enable multiplatform support, Dangerzone implemented a nested container strategy where the outer container runs as a compatibility layer and the inner layer runs the gVisor and Dangerzone logic.

dangerzone.rocks · 7 min

TLDR InfoSec

PRIORITIZING DETECTION ENGINEERING

Detection Engineering is a concept that emphasizes the importance of managing the workload and complexity of a detection stack. Prioritizing detection projects involves focusing on foundational steps, collaborating on high-quality detections, and managing the work involved in detection engineering. By intentionally addressing operational management challenges and avoiding premature staffing, a successful detection program can be developed with thoughtful planning and strategic implementation.

links.tldrnewsletter.com · 9 min

TLDR InfoSec

APONO (PRODUCT LAUNCH)

Apono provides organizations with an understanding of privileged access within their cloud environments, enforces robust security guardrails, and leverages AI-driven least privilege and anomaly detection capabilities to enhance security measures.

apono.io

TLDR InfoSec

RYANAIR FLIGHT BOOKING PRACTICES CATCH EYE OF EU PRIVACY WATCHDOG

Ireland's Data Protection Commission launched an inquiry into Ryanair's customer verification process, focusing on its use of facial recognition technology and biometric data. The investigation stems from complaints about additional ID checks for third-party bookings.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

MANUFACTURERS RANK AS RANSOMWARE'S BIGGEST TARGET

The manufacturing industry has become the top target for ransomware attacks, accounting for 21% of incidents. A study by Black Kite reveals that 80% of manufacturing companies have critical vulnerabilities, with 67% listed in CISA's Known Exploited Vulnerabilities catalog.

darkreading.com · 3 min

TLDR InfoSec

WHAT DO I THINK ABOUT WIZ CODE?

This post contextualizes Wiz's new AppSec offerings via Wiz Code within Wiz's product line and the CNAPP and ASPM industries. Wiz Code offers SCA, secrets scanning, and IaC scanning, which largely already existed via the WizCLI, but with Code the UX is tied together more succinctly and scanning can be done via a GitHub integration (pipelineless). Wiz Code is a nice add on for Wiz customers and shows promise for the CNAPP space but lags behind full ASPM providers or industry leading AppSec products.

pulse.latio.tech · 5 min

TLDR InfoSec

UK NUCLEAR SITE SELLAFIELD FINED $440,000 FOR CYBERSECURITY SHORTFALLS

Sellafield, a UK nuclear site, was fined $440,000 for cybersecurity failures that exposed sensitive information.

bleepingcomputer.com · 3 min

TLDR InfoSec

GOOGLE REMOVED KASPERSKY'S SECURITY APPS FROM THE PLAY STORE

Google removed Kaspersky's security apps from the Play Store and suspended its developer accounts due to restrictions imposed by the U.S. Department of Commerce.

securityaffairs.com · 2 min

TLDR InfoSec

CHINA-LINKED GROUP SALT TYPHOON HACKED US BROADBAND PROVIDERS AND BREACHED WIRETAP SYSTEMS

A group linked to China, called Salt Typhoon, hacked U.S. broadband providers like Verizon and AT&T, potentially accessing systems for lawful wiretapping.

securityaffairs.com · 3 min