The Daily Index — Monday, November 25, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

CHINESE HACKERS TARGET LINUX WITH NEW WOLFSBANE MALWARE

ESET researchers have discovered two new Linux magister families that are connected to Chinese APTs. WolfsBane is dropped via a dropper named Cron, which disguises the launcher as a KDE desktop component which then disables SELinux and eventually loads a rootkit that hooks several syscalls to evade detection. FireWood is another rootkit that maintains persistence by creating an autostart file.

bleepingcomputer.com · 2 min

TLDR InfoSec

HACKERS BREACH ANDREW TATE'S ONLINE UNIVERSITY

Hackers have breached Andrew Tate's online university and leaked data on 800K users. The hackers revealed their breach by flooding chat rooms with emojis that they uploaded while Tate was streaming. Emails of roughly 325K users and the contents of the over 500 public and private chat servers were leaked.

dailydot.com · 3 min

TLDR InfoSec

LEVERAGING API GATEWAY LAMBDA AUTHORIZER FOR SECURING YOUR APIS WITH OKTA FGA

Okta Fine-Grained Authorization (FGA) offers a dynamic permissions scheme called Relationship Based Access Control (ReBAC). ReBAC allows developers to define complex relationships between entities that can be evaluated by the policy engine to make access decisions. This blog post discusses how FGA can be integrated with AWS API Gateway as a Lambda Authorizer.

aws.amazon.com · 4 min

TLDR InfoSec

BEYOND THE GOOD OL' LAUNCHAGENTS - PERSIST THROUGH THE NVRAM

This post is part of a series that explores unique ways to achieve persistence on macOS via methods that don't use the traditional LauchDaemons or LaunchAgents. The author discovered an unused IO registry key called apple-trusted-trampoline in the IODeviceTree:/options entry (corresponding to the NVRAM) which is executed during the boot task if the rc.trampoline flag is set. They note that this is not a practical attack as it requires SIP to be disabled among other limitations.

theevilbit.github.io · 5 min

TLDR InfoSec

THE COLD, HARD TRUTH ABOUT YOUR CLOUD DR STRATEGY

This post takes a critical look at conventional wisdom around Disaster Recovery (DR) and how it fails in practice. Much of Cloud DR planning focuses on spreading loads across multiple data centers or even clouds. Failures are much more likely to be caused by user errors that lead to partial failures. DR strategies must be flexible enough to handle partial failures, have clear instructions (including who can initiate a DR incident), and need to be well documented.

lastweekinaws.com · 5 min

TLDR InfoSec

RIIG (PRODUCT LAUNCH)

RIIG can deliver threat actor detection and cyber resilience training to employees. It meets the needs of organizations across multiple sectors, including government entities, delivering seamless integration and enhanced security.

riigtech.com

TLDR InfoSec

OPERATION SHIPWRECKED: US SEIZES POPEYETOOLS MARKETPLACE, CHARGES 3

The DOJ has shut down PopeyeTools, a cybercrime marketplace that has been operating since 2016. The site sold stolen credit card data and hacking tools to 227,000 users, generating $1.7M. Authorities seized $283,000 in cryptocurrency during the operation.

hackread.com · 3 min

TLDR InfoSec

PUT YOUR USERNAMES AND PASSWORDS IN YOUR WILL, ADVISES JAPAN'S GOVERNMENT

Japan's Consumer Affairs Center has urged citizens to plan their "digital end of life," recommending that citizens share device access, maintain password lists, and designate digital heirs to manage subscriptions.

theregister.com · 3 min

TLDR InfoSec

THE NEAREST NEIGHBOR ATTACK: HOW A RUSSIAN APT WEAPONIZED NEARBY WI-FI NETWORKS FOR COVERT ACCESS

The Nearest Neighbor Attack is a new attack method where threat actors compromised one organization to access nearby Wi-Fi networks of other organizations. The attackers moved through multiple organizations without deploying malware by leveraging stolen credentials, highlighting the importance of strong network security measures. Volexity worked with affected organizations to uncover the attacker's tactics and implement mitigations to prevent further intrusions.

volexity.com · 16 min

TLDR InfoSec

ITALIAN FOOD DELIVERY APP FOODINHO EATS ANOTHER PRIVACY FINE

Foodinho was fined €5M by Italy's privacy regulator for illegally processing 35,000 riders' data, including unauthorized geolocation sharing and biometric data use.

techcrunch.com · 1 min

TLDR InfoSec

GITHUB INVESTING IN SECURITY AND SUSTAINABILITY OF OPEN-SOURCE PROJECTS

GitHub is investing 1.25 million dollars in a program to help developers improve the security and sustainability of their open-source projects.

techzine.eu · 3 min

TLDR InfoSec

WINDOWS 11 24H2 UPDATE BLOCKED ON PCS WITH ASSASSIN'S CREED, STAR WARS OUTLAWS

Microsoft is blocking the Windows 11 24H2 update on computers with Ubisoft games like Assassin's Creed and Star Wars Outlaws due to crashes and audio issues caused by changes in the operating system.

bleepingcomputer.com · 2 min