The Daily Index — Wednesday, December 4, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

VULNERABILITIES EXPOSE MYSCADA MYPRO SYSTEMS TO REMOTE HACKING

Cybersecurity researcher Michael Heinzl discovered 4 critical and 1 high vulnerability in mySCADA's myPRO system. The vulnerabilities in the ICS software include OS command injection, improper and missing authentication, and path traversal. CISA which coordinated the disclosure has not observed any evidence of exploitation.

securityweek.com · 2 min

TLDR InfoSec

TELCOS STRUGGLE TO BOOT CHINESE HACKERS FROM NETWORKS

FBI and CISA have noted that the China-linked hacking group Salt Typhoon still has access to U.S. telecommunications networks, causing concerns for officials. Steps are being taken to strengthen network security against these hackers. Efforts are ongoing to remove the hackers completely, with some progress being made by companies working with the government.

axios.com · 2 min

TLDR InfoSec

HOW TAILSCALE'S INFRA TEAM STAYS SMALL

Tailscale's infrastructure team is composed of only three engineers. The company is able to simplify networking infrastructure by utilizing Tailnets to connect resources across VPCs and different cloud providers while handling access at the Tailscale ACL level. Tailscale ACLs combined with setec, an in-house secrets manager to simplify secrets management as well.

tailscale.com · 7 min

TLDR InfoSec

STOP USING PREDICTABLE BUCKET NAMES: A FAILED ATTEMPT AT HACKING SATELLITES

Jonathan Walker of Security Runners crawled through AWS documentation to create a list of all possible service buckets and determine if any were available for bucket namesquatting. During his research, Walker discovered buckets created for a large number of regions that didn't yet exist such as us-east-3. While ultimately unsuccessful at discovering an available bucket for namesquatting, Walker's discovery that AWS reserves buckets in a large list of uncreated regions to protect against attacks like this is interesting.

securityrunners.io · 7 min

TLDR InfoSec

ENHANCED VISIBILITY AND HARDENING GUIDANCE FOR COMMUNICATIONS INFRASTRUCTURE

This recently released guide by CISA provides best practices for strengthening the visibility and security of communication networks against cyber threats, including those affiliated with the PRC. It covers monitoring, hardening systems, and collaboration between network defenders and engineers to ensure network protection. Specific guidance is given for Cisco systems to prevent exploitation by cyber threat actors.

cisa.gov · 11 min

TLDR InfoSec

APT35 FORGES RECRUITMENT SITES, LAUNCHES ATTACKS ON AEROSPACE AND SEMICONDUCTOR INDUSTRIES IN MULTIPLE COUNTRIES

APT35, a threat group linked to Iran, is targeting aerospace and semiconductor industries in various countries using forged recruitment sites to lure victims into downloading malicious programs. The attackers utilize legitimate internet resources like OneDrive and Google Cloud to carry out their activities, making threat detection and protection tools essential for defense against these attacks. ThreatBook has identified key indicators of compromise (IOCs) related to this attack event to enhance threat intelligence detection and protection efforts.

threatbook.io · 4 min

TLDR InfoSec

FROM DEALS TO DDOS: EXPLORING CYBER WEEK 2024 INTERNET TRENDS

Cloudflare reports that Cyber Monday saw the highest global Internet traffic, with Black Friday following closely behind, and DDoS attacks were prominent during Cyber Week, particularly targeting shopping sites.

blog.cloudflare.com · 8 min

TLDR InfoSec

FTC BANS DATA BROKERS FROM SELLING AMERICANS' SENSITIVE LOCATION DATA

The FTC banned data brokers from selling Americans' sensitive location data linked to places like churches and healthcare facilities.

bleepingcomputer.com · 2 min

TLDR InfoSec

CLOUDFLARE'S DEVELOPER DOMAINS INCREASINGLY ABUSED BY THREAT ACTORS

Cybercriminals are increasingly misusing Cloudflare's 'pages.dev' and 'workers.dev' domains for phishing and malicious activities, taking advantage of Cloudflare's trusted reputation.

bleepingcomputer.com · 3 min