The Daily Index — Wednesday, October 23, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

50,000 FILES EXPOSED IN NIDEC RANSOMWARE ATTACK

Nidec suffered a ransomware attack in August where hackers stole 50,694 files after obtaining domain credentials. It refused ransom demands, so attackers have leaked its documents on the dark web.

infosecurity-magazine.com · 2 min

TLDR InfoSec

CISCO DISABLES DEVHUB ACCESS AFTER SECURITY BREACH

Cisco has disabled public access to DevHub as it investigates a breach from earlier this month. The attackers have sold customer data, which includes source code, credentials, and certificates from major companies.

darkreading.com · 3 min

TLDR InfoSec

AUTOMATING CLIENT SIDE PATH TRAVERSAL DISCOVERY

Client Side Path Traversal (CSPT) is a vulnerability that occurs when a client can provide path traversal characters (../) in a request to modify a different request. This can be chained with Open Redirect vulnerabilities to control the response returned to the client. This post describes the process of creating a Chrome extension to automate the discovery of CSPT vulnerabilities using dynamic analysis.

vitorfalcao.com · 8 min

TLDR InfoSec

APPLYING LLMS AND GENAI TO CYBERSECURITY

This post shares various resources and tactics for applying LLMs and Generative AI to CyberSecurity. It highlights how LLMs are being used for security tasks, sparking interest in the field. Various studies and projects are exploring LLM capabilities in code analysis and bug hunting. The potential of augmenting language models with tools and agentic approaches can be instrumental for various cybersecurity jobs.

threadreaderapp.com · 6 min

TLDR InfoSec

FINDING VULNERABILITY VARIANTS AT SCALE

BlackWing security found vulnerabilities in a JPEG processing program called jpeg-recompress by analyzing its source code. The company identified two vulnerabilities in the program related to buffer overflow and integer overflow. It discovered over 40 projects with similar vulnerabilities by using automated and manual searches.

blackwinghq.com · 11 min

TLDR InfoSec

HYDDEN (PRODUCT LAUNCH)

Hydden creates a single data layer across IAM, identity governance and administration (IGA), privileged access management (PAM), and identity threat detection and response (ITDR) solutions.

hydden.com

TLDR InfoSec

CHALLENGES WITH IP SPOOFING IN CLOUD ENVIRONMENTS

IP spoofing is an attack technique where attackers report an incorrect IP address in the X-Forwarded-For header to bypass rate limiting or IP based restrictions. Nearly a third of organizations that use Datadog's product receive X-Forwarded-For headers but 25% of those also receive suspicious X-Forwarded-For headers. To defend against this attack, use trusted vendor headers, add a custom header at the edge, or instruct frameworks to parse the header to the depth appropriate for your environment.

securitylabs.datadoghq.com · 7 min

TLDR InfoSec

MANDIANT: 70% OF EXPLOITED FLAWS DISCLOSED IN 2023 WERE ZERO DAYS

Analysts from Google's Mandiant warn that threat actors are getting more sophisticated. Specifically, 70% of the vulnerabilities that were reported as being actively exploited in 2023 were zero days. Mandiant also reported that the time to exploit a newly disclosed vulnerability has dropped to 5 days from 32 days in 2021-2022.

bleepingcomputer.com · 3 min

TLDR InfoSec

SIGN-IN TO AWS CONSOLE MOBILE APPLICATION WITH AN AWS ACCESS PORTAL OR THIRD-PARTY IDP URL

AWS has added the ability to sign in via SSO to the AWS Console mobile app. Once a user provides their sign-in URL in the application, it will redirect to the sign-in URL and provide a similar experience as the web login flow. This post includes a walkthrough of the new sign-in flow.

aws.amazon.com · 5 min

TLDR InfoSec

INTRODUCING GOOGLE CLOUD'S NEW VULNERABILITY REWARD PROGRAM

Google Cloud has launched a Vulnerability Reward Program that offers up to $101,010 for security researchers who discover vulnerabilities.

cloud.google.com · 2 min

TLDR InfoSec

STATE OF CLOUD SECURITY 2024

Overall, security practices have improved, but risky credentials and misconfigurations across infrastructure remain as the major vulnerabilities for AWS, Azure, and Google Cloud.

datadoghq.com · 20 min

TLDR InfoSec

EXPOSED AND ENCRYPTED: INSIDE A MALLOX RANSOMWARE ATTACK

This post discusses a scenario where Mallox ransomware was deployed on a server due to a misconfiguration allowing unauthorized access.

trustwave.com · 7 min