The Daily Index — Friday, October 25, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

INTERNET ARCHIVE HACKED AGAIN DURING SERVICE RESTORATION

After recovering from a data breach and DDoS attack, the Internet Archive has reported another attack. This attack involved a compromised Zendesk token with users being notified by an attacker-sent email. Compromised information includes potentially sensitive data that was sent in support cases.

securityweek.com · 2 min

TLDR InfoSec

MICROSOFT SHAREPOINT VULN IS UNDER ACTIVE EXPLOIT

Summary unavailable

darkreading.com · 2 min

TLDR InfoSec

HUNTING FOR REMOTE MANAGEMENT TOOLS: DETECTING RMMS

This blog post discusses hunting for Remote Management and Monitoring (RMM) tools in organizations, highlighting challenges in identifying different tools. By searching for keywords in various fields like filenames and process command lines, the likelihood of detecting RMMs increases. The query language used to search through SIEM logs helps optimize the process by attributing events to specific RMM tools based on identified keywords.

blog.nviso.eu · 9 min

TLDR InfoSec

USING NIX TO FUZZ TEST A PDF PARSER (PART ONE)

This post discusses how Nix simplified fuzz testing by automating setup and execution with a single command. The process involved compiling the PDF reader from source, generating test inputs, and identifying bugs. Nix allows beginners to fuzz test efficiently and discover vulnerabilities in software.

mtlynch.io · 14 min

TLDR InfoSec

SPOOFING INTERNAL PACKETS FOR MULTIHOMED LINUX DEVICES

A vulnerability in multihomed Linux devices can be exploited to spoof and inject packets into internal communication streams. This issue can be leveraged by attackers with adjacent network access to manipulate data flows on devices like NAT routers and virtual machines. Mitigations such as anti-spoofing firewall rules and socket binding can help protect against these attacks.

anvilsecure.com · 4 min

TLDR InfoSec

MALLOX RANSOMWARE DECRYPTOR

Free decryption tool for Mallox ransomware that targets files encrypted in 2023 or early 2024, and which have the extensions .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx, and .xollam.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

NOT ALL TYPES OF MFA ARE CREATED EQUAL

The UK's NCSC has released updated MFA guidance to address new threats. Foremost in its guidance, the NCSC recommends using phishing-resistant factors. Additionally, the NCSC recommends only prompting for MFA when necessary and provides an example of utilizing MDM-managed laptops and mobile devices as a factor instead of requiring a prompt.

ncsc.gov.uk · 5 min

TLDR InfoSec

HAVE YOU BEEN KEEPING UP WITH YOUR LOW CONFIDENCE DETECTIONS?

Traditionally, detection engineering focuses on prioritizing high confidence, high severity alerts to not overwhelm SOC analysts. Teams should also utilize low-confidence alerts. These alerts can be useful to provide more context to the full cyber kill chain that attackers utilized and can also detect activity that may be relevant but did not trigger a high confidence, high severity alert.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

LINKEDIN FINED $335 MILLION IN EU FOR TRACKING ADS PRIVACY BREACHES

LinkedIn has been fined €310M ($335M) by Ireland's Data Protection Commission for GDPR violations regarding its tracking ads business. The regulator found LinkedIn lacked a valid legal basis for processing user data and failed to properly inform users about how their information was used.

techcrunch.com · 3 min

TLDR InfoSec

PERMISO STATE OF IDENTITY SECURITY REPORT 2024

This report dives into identity security, highlighting how nearly half of organizations (45%) remain "concerned" or "extremely concerned" about being able to detect and protect against identity security attacks.

20407698.fs1.hubspotusercontent-na1.net · 20 min

TLDR InfoSec

PENN STATE PAYS DOJ $1.25M TO SETTLE CYBERSECURITY COMPLIANCE CASE

Penn State University will pay $1.25M to settle Justice Department claims that it failed to implement required NIST cybersecurity standards for federal contracts with NASA and the Pentagon.

theregister.com · 3 min

TLDR InfoSec

APPLE CREATES PRIVATE CLOUD COMPUTE VM TO LET RESEARCHERS FIND BUGS

Apple has created a Virtual Research Environment for researchers to test the security of its Private Cloud Compute system.

bleepingcomputer.com · 3 min