The Daily Index — Monday, December 23, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

ASCENSION: HEALTH DATA OF 5.6 MILLION STOLEN IN RANSOMWARE ATTACK

Ascension, a large U.S. healthcare system, had the personal and health data of 5.6 million patients and employees stolen in a ransomware attack. The breach led to the company offering free identity theft protection services to those affected for 24 months. The ransomware attack impacted electronic health records and forced the healthcare giant to temporarily halt some services.

bleepingcomputer.com · 3 min

TLDR InfoSec

OVER 25K SONICWALL VPN FIREWALLS EXPOSED TO CRITICAL FLAWS

Bishop Fox identified over 400K SonicWall VPN Firewalls with either a management interface or SSL VPN interface that are internet exposed. Of these devices, over 20K are running end-of-life firmware versions. However, a larger total of over 25K firewalls that are exposed are vulnerable to a critical vulnerability, and nearly 100K are exposed to a high vulnerability.

bleepingcomputer.com · 2 min

TLDR InfoSec

RTOS: EVERYTHING IS REAL TIME

Real-Time Operating Systems (RTOS) are specialized systems that handle time-critical tasks with strict deadlines. Unlike general operating systems, RTOS prioritizes predictable execution timing and is essential in applications from car brakes to video games where split-second precision is crucial. This blog post dives into everything RTOS and their uses for cybersecurity.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

FROM GUARDIAN TO GATEWAY: THE HIDDEN RISK OF EDR VULNERABILITIES

The author decided to examine the Wazuh EDR tool via fuzzing and found 2 vulnerabilities that could lead to total network compromise. Wazuh consists of an agent that runs on the device, a server that accepts events from the agent, and an analysis engine that parses the event to trigger actions. The author describes how they discovered a command injection vulnerability in the host_deny active response which they chained with a heap buffer overflow that allowed for RCE to achieve unauthenticated RCE as root to compromise a full network.

neodyme.io · 11 min

TLDR InfoSec

WINNTI HACKERS TARGET OTHER THREAT ACTORS WITH NEW GLUTTON MALWARE

The Winnti hacking group has begun using a new Glutton backdoor to attack targets in the US and China. Glutton is a PHP malware that masquerades as a php-fpm process that facilitates fileless execution and injects malicious code into PHP files. It is an advanced backdoor that establishes persistence and supports 22 commands for C2. Notably, the Winnti group has been hiding Glutton in tools sold on cybercrime forums to attack other cybercrime groups and steal their information.

bleepingcomputer.com · 2 min

TLDR InfoSec

ANNOUNCING OPA 1.0: A NEW STANDARD FOR POLICY AS CODE

OPA 1.0 is a major release that enhances Policy as Code development, focusing on improving the developer experience and consistency of the language. Users are encouraged to upgrade to OPA 1.0 for new features, syntax improvements, and performance enhancements, with detailed instructions provided for a smooth transition. The release signifies a significant milestone for the project, offering a solid foundation for Policy as Code projects and inviting community feedback to shape future releases.

blog.openpolicyagent.org · 3 min

TLDR InfoSec

FLARE (PRODUCT LAUNCH)

Flare watches for signs on the dark web that its customers' logins are being circulated and then automatically resets the impacted passwords before the thieves can gain access. It also watches for stolen session cookies that can trick computers into thinking the hacker is a previously authenticated user.

flare.io

TLDR InfoSec

WHAT DO ATTACKERS KNOW ABOUT YOUR AWS ACCOUNT?

Much of the common wisdom around Cloud Security as well as CNAPP tooling does not consider the discoverability aspect of exploiting resources. This post enumerates some prior work on AWS reconnaissance techniques such as exploiting CDK naming, brute forcing SQS queues, abusing misconfigured ECR policies, and domain takeover via deleted S3 buckets. The author then introduces a new tool that they created called awseye that can enumerate discoverable resources given an AWS account ID.

plerion.com · 8 min

TLDR InfoSec

INTRODUCING AN ENHANCED VERSION OF THE AWS SECRETS MANAGER TRANSFORM

AWS Secrets Manager offers transforms that will add a nested CloudFormation stack for HostedLambdaRotation that allows for pre-built Lambdas for secrets rotations for a subset of supported secrets. AWS has now enhanced this offering to support automatic upgrades of the Lambda functions as well as more CloudFormation resource attributes. The blog post contains upgrade instructions but also notes that the new transforms are not backwards compatible.

aws.amazon.com · 3 min

TLDR InfoSec

THE WINDOWS REGISTRY ADVENTURE #5: THE REGF FILE FORMAT

This detailed blog post from Google Project Zero explores the regf file format used by the Windows Registry since Windows NT 3.1, which uniquely represents registry data simultaneously on disk and in memory. The format consists of several key components including a base block (header), bins that store data in 4KB chunks, and cells that contain the actual registry data like keys, values, and security descriptors. The post also explains how Windows implements self-healing properties when loading potentially corrupted hives, attempting to fix or isolate damaged data while preserving overall hive integrity whenever possible.

googleprojectzero.blogspot.com · 89 min

TLDR InfoSec

UNITED STATES CHARGES DUAL RUSSIAN AND ISRAELI NATIONAL AS DEVELOPER OF LOCKBIT RANSOMWARE GROUP

Rostislav Panev, a developer of the LockBit ransomware group, has been arrested by the United States for his role in cyberattacks causing billions in damages.

justice.gov · 9 min

TLDR InfoSec

MOBILE COMMUNICATIONS BEST PRACTICE GUIDANCE

CISA has released guidance for protecting mobile communications following Chinese state hackers targeting major US telecom carriers.

cisa.gov · 7 min

TLDR InfoSec

2024 CWE TOP 25 MOST DANGEROUS SOFTWARE WEAKNESSES

The top 10 software weaknesses are XSS, OOB write, SQL injection, CSRF, path traversal, OOB read, OS command injection, use after free, missing AuthZ, and unrestricted upload of files with dangerous types.

cwe.mitre.org · 2 min