The Daily Index — Friday, November 15, 2024

GENERAL

TLDR InfoSec

>> Get a Free Demo

Summary unavailable

vonahi.io

TLDR InfoSec

MICROSOFT POWER PAGES LEAK MILLIONS OF PRIVATE RECORDS

Microsoft Power Pages websites are exposing sensitive data due to poorly configured access controls. The low-code platform, used by over 100 million users across various industries, offers security features that many developers aren't implementing properly. There are widespread data exposure risks on these sites.

darkreading.com · 3 min

TLDR InfoSec

210,000 IMPACTED BY SAINT XAVIER UNIVERSITY DATA BREACH

Saint Xavier University reported a data breach affecting 212,267 people between June and July 2023. Alphv/BlackCat ransomware claimed responsibility for the breach. It has been confirmed that personal data including SSNs was compromised.

securityweek.com · 2 min

TLDR InfoSec

MODELEAK: PRIVILEGE ESCALATION TO LLM MODEL EXFILTRATION IN VERTEX AI

Palo Alto Networks discovered two vulnerabilities in Google's Vertex AI platform: privilege escalation through custom jobs and model exfiltration via malicious models that could expose sensitive AI models and data. This post dives into the vulnerabilities and how they were identified.

unit42.paloaltonetworks.com · 17 min

TLDR InfoSec

WHAT I'VE LEARNED: MY TOP AWS WAF TIPS FOR STRONGER PROTECTION

A collection of tips for utilizing AWS WAF most effectively. Some of the tips are common best practices such as ensuring that all external endpoints are mapped, testing rules in counting mode before fully deploying, and making sure that logging and alerting are enabled. Some other tips involve utilizing features that are not enabled by default such as bot control and rate limiting.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

NPM PROVENANCE: THE MISSING SECURITY LAYER IN POPULAR JAVASCRIPT LIBRARIES

NPM provenance could have prevented the recent security incident involving the lottie-player library. Many top NPM packages lack proper provenance attestation, leaving them vulnerable to supply chain attacks. Implementing provenance can strengthen package security by verifying where and how a package was built.

exaforce.com · 4 min

TLDR InfoSec

USING CLOUDFLARE ON YOUR WEBSITE COULD BE BLOCKING RSS USERS

OpenRSS has flagged an issue where Cloudflare bot management is breaking RSS readers by forcing them to attempt a human challenge that they cannot fulfill. OpenRSS has suggested that domain admins could attempt to allowlist RSS readers by User Agent on reader IP but called upon Cloudflare for a more comprehensive solution. OpenRSS' latest update on the issue states that it is working with Cloudflare to become a “verified bot” but is still trying to press Cloudflare for a more comprehensive and universal solution.

openrss.org · 5 min

TLDR InfoSec

PYPI NOW SUPPORTS DIGITAL ATTESTATIONS

In an effort to enhance supply chain security, PyPi has added the ability for package maintainers to publish digital attestations with their packages. Attestations provide an additional layer of security over digital signatures as they are tied to an identity, must be verifiable, and include a link to the upstream source. Attestations can be viewed via the new Identity API or using the web UI.

blog.pypi.org · 3 min

TLDR InfoSec

FIVE EYES INFOSEC AGENCIES LIST 2024'S MOST EXPLOITED SOFTWARE FLAWS

The Five Eyes intelligence alliance has revealed its top 15 exploited vulnerabilities - Citrix vulnerabilities lead the list, followed by Cisco IOS XE and Fortinet FortiOS issues.

theregister.com · 4 min

TLDR InfoSec

EXPERTS UNCOVER 70,000 HIJACKED DOMAINS IN WIDESPREAD 'SITTING DUCKS' ATTACK SCHEME

Cybercriminals hijacked nearly 70,000 legitimate domains in the last three months for phishing and fraud schemes using a technique called Sitting Ducks.

thehackernews.com · 4 min

TLDR InfoSec

HACKERONE URGES U.S. TO ADVOCATE FOR RESEARCH PROTECTIONS IN UN CYBERCRIME TREATY

HackerOne is advocating for the U.S. government to ensure the UN cybercrime treaty includes explicit protections for ethical hackers and security researchers, warning that without such safeguards, legitimate security research could be criminalized globally.

cyberscoop.com · 2 min

TLDR InfoSec

BITDEFENDER RELEASED A DECRYPTOR FOR THE SHRINKLOCKER RANSOMWARE

Bitdefender has released a decryptor for the ShrinkLocker ransomware, which targets BitLocker configurations to encrypt system drives.

securityaffairs.com · 3 min