The Daily Index — Friday, November 29, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NHS MAJOR 'CYBER INCIDENT' FORCES HOSPITALS TO USE PEN AND PAPER

A North West England NHS trust experienced a cybersecurity incident, forcing sites to revert to pen-and-paper operations. Systems were isolated and some appointments were affected. The trust is working with national cybersecurity services to restore normal operations.

theregister.com · 3 min

TLDR InfoSec

RESEARCHERS DISCOVER FIRST UEFI BOOTKIT MALWARE FOR LINUX

Researchers at ESET discovered the first-ever UEFI bootkit (titled Bootkitty) targeting Linux devices when it was uploaded to VirusTotal. Bootkitty hooks UEFI security authentication protocols. It then hooks various GRUB functions to turn off kernel signature verification and intercepts the Linux kernel's decompression process to allow for loading malicious kernel modules. Bootkitty replaces the first environment variable to always load the malicious library at process startup. The bootkit relies on self-signed certificates, specific byte-pattern matching, and hardcoded offsets, so it will only work on specific GRUB and kernel versions. It is still likely in development.

bleepingcomputer.com · 5 min

TLDR InfoSec

GITFLOPS: THE DANGERS OF TERRAFORM AUTOMATION PLATFORMS

Terraform automation platforms like Atlantis and Terraform Cloud are very popular for creating pull-request based CI/CD workflows. The typical workflow involves opening a pull-request that will trigger a read-only terraform plan which will then be reviewed and can be applied by a more privileged user with a comment. A malicious user can either inject code via the entry point of a malicious provider or through a malicious data source to bypass the read-only protections of terraform plan. This vulnerability has been confirmed on five Terraform automation platforms.

snyk.io · 12 min

TLDR InfoSec

VISIO TRUST (PRODUCT LAUNCH)

Visio Trust collects, analyzes, and monitors artifacts from vendors to deliver real-time, comprehensive assessments and provide security teams with the security intelligence needed to make informed decisions during procurement.

visotrust.com

TLDR InfoSec

AUTHORITIES CATCH ‘SMS BLASTER' GANG THAT DROVE AROUND BANGKOK SENDING THOUSANDS OF PHISHING MESSAGES

Thai authorities have arrested two organized fraud gangs, one of which used "SMS blasting" technology to send nearly 1 million malicious texts in Bangkok to trick recipients with fake prize messages and potential cyber threats.

techcrunch.com · 1 min

TLDR InfoSec

NEW YORK FINES GEICO AND TRAVELERS $11 MILLION OVER DATA BREACHES

Geico and Travelers were fined $11 million by New York for data breaches affecting over 120,000 individuals. The attacks compromised insurance quoting tools to steal driver's license numbers. Some of the data was used to file fraudulent unemployment claims during COVID-19.

securityweek.com · 2 min

TLDR InfoSec

UNISWAP UNVEILS $15.4M CORE CONTRACTS BUG BOUNTY AHEAD OF V4 LAUNCH

Uniswap has launched a new bug bounty with payouts ranging from $2K to $15.4M, which could potentially mark the highest bounty payout in history.

cointelegraph.com · 3 min

TLDR InfoSec

AWS SECURITY GUARDRAILS AND TERRAFORM

One common implementation of the paved roads philosophy is through Terraform modules that employ secure defaults for common tasks (such as creating S3 buckets).

naman16.github.io · 6 min