The Daily Index — Wednesday, November 13, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

2M RECORDS EXPOSED BY A TECH RECRUITMENT SERVICE

A publicly exposed, unprotected database belonging to Alltech Consulting Services containing 2M records of data belonging to over 200K job seekers was discovered. The records included salary expectations, work experience information, internal notes, names, email addresses, phone numbers, last four digits of SSNs, and passport numbers. The finding was responsibly disclosed to Alltech Consulting Services, which password-protected the database the following day.

websiteplanet.com · 2 min

TLDR InfoSec

AMAZON CONFIRMS EMPLOYEE DATA BREACH, BUT SAYS IT'S LIMITED TO CONTACT INFO

A breach at Amazon's property management vendor exposed work contact details (emails, phone numbers, and locations) of potentially millions of employees. The incident is linked to the 2023 MOVEit vulnerability, which affected multiple organizations.

theverge.com · 2 min

TLDR InfoSec

MILLIONS OF HOT TOPIC CUSTOMERS IMPACTED BY DATA BREACH

A massive data breach at Hot Topic exposed nearly 57 million customers' personal information, including emails, names, addresses, and partial credit card data. A hacker, who allegedly accessed data through an employee's compromised computer and unprotected Snowflake account, has demanded $100,000 from Hot Topic.

securityweek.com · 2 min

TLDR InfoSec

EVASIVE ZIP CONCATENATION: TROJAN TARGETS WINDOWS USERS

Zip Concatenation is where a threat actor concatenates the binary data of two zip files to attempt to hide the malicious content. An attacker creates two zip files - one that contains a benign document and another that contains malware - and then concatenates the two zip files. The attacker then relies upon the victim and any relevant cybersecurity tools only seeing one of the archives and missing the malicious files. This post breaks down a real-world campaign that used zip concatenation to hide a Trojan in a second archive and shows how 7zip would miss the file but Windows Explorer and Winrar would not.

perception-point.io · 6 min

TLDR InfoSec

OPEN SOURCE SECURITY INCIDENTS AREN'T GOING AWAY

Summary unavailable

darkreading.com · 7 min

TLDR InfoSec

GOISSUE – THE TOOL BEHIND RECENT GITHUB PHISHING ATTACKS

A new phishing tool called GoIssue, which sells for $700-$3,000, enables attackers to harvest GitHub users' email addresses and send mass phishing emails. The tool poses significant risks as it targets developers' credentials, potentially enabling supply chain attacks and corporate network breaches.

slashnext.com · 7 min

TLDR InfoSec

ZENITY (PRODUCT LAUNCH)

Zenity has built an agentless application security platform for securing low-code, no-code, and generative AI development solutions.

zenity.io

TLDR InfoSec

SNOWFLAKE HACKERS IDENTIFIED AND CHARGED WITH STEALING 50 BILLION AT&T RECORDS

Two hackers, Connor Moucka and John Binns, have been accused by the US government of stealing approximately 50 billion AT&T customer call and text records. The breach, which occurred in April 2023, affected nearly all of AT&T's customers. The stolen data included call and message metadata.

techcrunch.com · 3 min

TLDR InfoSec

COMPARING STATIC AND RUNTIME REACHABILITY

This article compares static and runtime reachability, two emerging approaches to determining whether vulnerabilities in code dependencies are actually exploitable. Both offer package-level and function-level capabilities. Static reachability analyzes code repositories to identify potential vulnerabilities during development but can't eliminate false positives completely, while runtime reachability uses agents to monitor actual code execution and provide near-certain identification of exploitable vulnerabilities. Static reachability integrates well with development workflows and doesn't require agent deployment. Runtime reachability offers superior accuracy in identifying truly exploitable vulnerabilities but requires agent installation and currently has limited vendor support.

pulse.latio.tech · 7 min

TLDR InfoSec

NORTH KOREAN HACKERS CREATE FLUTTER APPS TO BYPASS MACOS SECURITY

North Korean hackers created malicious Flutter apps for macOS, passing Apple's security checks with legitimate developer IDs. These apps connect to DPRK servers and have the ability to execute scripts from a command and control server. Apple has revoked the signatures of these apps to prevent them from bypassing security measures on macOS systems.

bleepingcomputer.com · 2 min

TLDR InfoSec

LIVING OFF SECURITY TOOLS (WEBAPP)

Living Off Security Tools (LOST) is a project that shows how attackers can use security tools for post-exploitation.

0xanalyst.github.io

TLDR InfoSec

MICROSOFT EXCHANGE ADDS WARNING TO EMAILS ABUSING SPOOFING FLAW

Microsoft Exchange has issued a warning for a high-severity vulnerability that allows attackers to impersonate senders in emails to make malicious messages more convincing.

bleepingcomputer.com · 2 min

TLDR InfoSec

VMWARE MAKES WORKSTATION AND FUSION FREE FOR EVERYONE

VMware has made its Fusion and Workstation desktop hypervisors free for commercial, educational, and personal use.

bleepingcomputer.com · 2 min