The Daily Index — Friday, December 20, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

TEXAS TECH UNIVERSITY DATA BREACH IMPACTS 1.4 MILLION PEOPLE

Texas Tech University experienced a data breach affecting 1.4 million people due to a ransomware attack targeting its Health Sciences Center. Personal information like names, addresses, Social Security numbers, and medical details were compromised. The university is providing affected individuals with free credit monitoring services and has reported the incident to the US Department of Health and Human Services.

securityweek.com · 2 min

TLDR InfoSec

NEW FAKE LEDGER DATA BREACH EMAILS TRY TO STEAL CRYPTO WALLETS

Ledger is a hardware cryptocurrency wallet that allows users to store, manage, and sell cryptocurrencies that use a multi-word recovery phrase for securing the wallets. A new phishing campaign is targeting Ledger owners with an email stating that a recovery phrase breach occurred and urging them to verify if their recovery phrase is secure. The link takes users to a fake Ledger page that prompts them to enter their recovery phrases and then transmits the phrase back to the attackers.

bleepingcomputer.com · 2 min

TLDR InfoSec

SECURING CI/CD: DON'T USE LONG-LIVED API TOKENS, USE OPENID CONNECT INSTEAD

OpenID Connect is a mechanism for applications to authenticate without requiring long-lived credentials like API keys. This post provides tutorials for connecting GitHub and AWS to authenticate from GitHub Actions via OpenID Connect as well as sample workflows to build and push Docker containers to ECR and plan/apply Terraform changes. The post concludes by describing how OpenID Connect can be used with Amplify.

amplify.security · 11 min

TLDR InfoSec

LDAP ENUMERATION: UNVEILING THE DOUBLE-EDGED SWORD OF ACTIVE DIRECTORY

This article from Palo Alto Networks' Unit 42 team explains how LDAP, while essential for Active Directory management, is frequently exploited by threat actors like Stately Taurus and BlackCat ransomware groups who use tools such as AdFind and SharpHound for malicious reconnaissance. While detecting malicious LDAP activity is challenging due to high volumes of legitimate traffic, organizations can implement effective detection strategies by monitoring suspicious attributes, analyzing user context, and establishing behavioral baselines. The article concludes by highlighting how Palo Alto Networks' products like Cortex XDR, XSIAM, and Xpanse can help security teams detect and prevent LDAP-based attacks.

unit42.paloaltonetworks.com · 10 min

TLDR InfoSec

EXPLOITING REFLECTED INPUT VIA THE RANGE HEADER

Reflected input in web attacks can sometimes be made exploitable by using the Range header to extract specific sections from a server response. By combining this technique with desync or header injection, attackers can turn previously unexploitable vectors into fully exploitable ones. The ability to manipulate the Range header can lead to successful attacks by extracting targeted content from server responses.

attackshipsonfi.re · 3 min

TLDR InfoSec

KEEPIT (PRODUCT LAUNCH)

Keepit's platform is designed to make it easy for enterprises to back up and protect valuable data. Its benefits and capabilities include five-minute setup, instant restore, job monitoring, API support, customized retention, access control, audit logging and compliance, and data monitoring.

keepit.com

TLDR InfoSec

TP-LINK FACES POSSIBLE US BAN AS HIJACKED ROUTERS FUEL CHINESE ATTACKS

US officials are investigating TP-Link routers as a potential national security risk, considering a possible ban. The Chinese-founded company, which recently relocated to the US, has significant market presence including military bases. Microsoft reported that Chinese hackers were using TP-Link routers in attacks, though there is no evidence to suggest the company was complicit.

arstechnica.com · 5 min

TLDR InfoSec

EU TO INVESTIGATE TIKTOK'S RESPONSE TO ELECTION SECURITY RISKS IN ROMANIA

The EU has opened a second DSA investigation into TikTok, focusing on election risks after concerns about interference in Romania's presidential election. The probe examines TikTok's recommender systems and political content policies. The company faces potential fines of up to 6% of global turnover for violations.

techcrunch.com · 4 min

TLDR InfoSec

CISA ORDERS FEDERAL AGENCIES TO SECURE MICROSOFT CLOUD SYSTEMS AFTER RECENT INTRUSIONS

In 2022, CISA published the Secure Cloud Business Applications (SCuBA) secure cloud baselines for Microsoft 365 with other cloud applications to come later. Citing a wave of recent attacks that were caused by improper configuration of cloud systems, CISA has issued a binding directive that federal agencies must abide by the SCuBA baselines. Federal civilian agencies will have until June 20, 2025, to implement the full binding directive with milestone deadlines along the way.

therecord.media · 2 min

TLDR InfoSec

EU PRIVACY REGULATOR FINES META 251 MILLION EUROS FOR 2018 BREACH

Meta was fined €251 million by Ireland's Data Protection Commission for a 2018 Facebook security breach affecting 29 million users' personal data that exposed information like names, contact details, and religious views.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

PLAY RANSOMWARE GROUP CLAIMS KRISPY KREME DOUGHNUTS AS LATEST VICTIM

The Play ransomware group has targeted Krispy Kreme, threatening to leak sensitive data just before Christmas.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

GOOGLE CALENDAR PHISHING SCAM TARGETS USERS WITH MALICIOUS INVITES

Hackers are using Google Calendar to send fake invites and trick users into clicking malicious links.

hackread.com · 3 min