The Daily Index — Thursday, January 2, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

BEYONDTRUST SAYS HACKERS BREACHED REMOTE SUPPORT SAAS INSTANCES

BeyondTrust identified a security incident in which an attacker obtained a Remote Support SaaS API key which it used to access some Remote Support SaaS instances and reset passwords for local application users. As part of its investigation, BeyondTrust discovered two CVEs that could allow for RCE but did not mark either as being actively exploited. BeyondTrust has patched all cloud instances against these CVEs and is working with customers to ensure that self-hosted instances are patched.

bleepingcomputer.com · 3 min

TLDR InfoSec

FOUR-FAITH INDUSTRIAL ROUTER CVE-2024-12856 EXPLOITED IN THE WILD

A new post-authentication vulnerability in Four-Faith industrial routers, CVE-2024-12856, is being exploited in the wild. Using default credentials for remote command injection, the attack targets specific router models over HTTP, allowing attackers to execute commands on vulnerable devices. VulnCheck has notified Four-Faith and customers about the issue and recommends contacting Four-Faith for information on patches and affected models.

vulncheck.com · 2 min

TLDR InfoSec

EXPLOITING PUBLIC AWS RESOURCES - CLI ATTACK PLAYBOOK

A glossary of exploitation techniques for exploiting AWS resources that can be misconfigured to be publicly accessible. Each attack features relevant CLI commands to carry it out as well as sometimes featuring a sample resource policy that could allow for it. The first section focuses on resources that can be found from a black box perspective and includes: exploiting S3 buckets for public list, read, and write, exploiting S3 buckets for authenticated list and write, exploiting S3 static site hosting or misconfigured CloudFront distributions for unauthenticated bucket list, exploiting EC2 to discover AMIs, exploiting EBS and RDS to discover public snapshots, exploiting misconfigured OIDC roles, and exploiting public SSM documents. The second section focuses on resources that can't be discovered from a black box perspective and includes: exploiting public SQS queues and SNS topics, exploiting private API gateways, exploiting Lambda functions, and exploiting public and private ECR repositories.

hackingthe.cloud · 7 min

TLDR InfoSec

WICKED PANDA APT ADVERSARY SIMULATION

This README explains a simulation of an attack by the Wicked Panda group targeting government networks. The attack involves stages like DodgeBox DLL loader and MoonWalk backdoor for data exfiltration via Google Drive API. The attackers use techniques like DLL sideloading and hashing to evade detection and establish communication channels.

github.com · 5 min

TLDR InfoSec

SIMPLE PROMPTS TO GET THE SYSTEM PROMPTS

This blog post covers various methods, like expanding the prompt or encoding it in base64, that can be used to extract system prompts from AI models, potentially bypassing developer-imposed limits. Understanding these tricks can show the vulnerabilities in AI models and how they can be manipulated to disclose hidden prompts.

eval.blog · 3 min

TLDR InfoSec

HOW WE ARE SELF HOSTING CODE SCANNING AT REDDIT

Summary unavailable

links.tldrnewsletter.com · 13 min

TLDR InfoSec

AWS POST-QUANTUM CRYPTOGRAPHY MIGRATION PLAN

AWS is preparing for post-quantum cryptography (PQC) by implementing NIST-approved algorithms to protect against future quantum computer threats to public key cryptography. Its migration plan consists of four workstreams: creating an inventory of current crypto usage (prioritizing data-in-transit), updating asymmetric key derivation between AWS endpoints and customers, addressing long-term digital signature keys, and handling short-term session signature keys. AWS recommends organizations prepare by making an inventory of their cryptography usage and upgrading to TLS 1.3.

aws.amazon.com · 10 min

TLDR InfoSec

SO… YOU THOUGHT YOUR VPN WAS KEEPING YOU SAFE AND SECURE?

VPNs have become ubiquitous as a way for protecting access to sensitive resources in organizations and preserving privacy for individuals. This has made VPNs a valuable target for attackers with VPN vulnerabilities on the rise since 2022. This article examines attacks in VPNs from Check Point, Fortinet, Palo Alto Networks, and Ivanti. For each vulnerability, the author demonstrates how to exploit the vulnerability and its impact.

hackers-arise.com · 4 min

TLDR InfoSec

MISP-STANDARD.ORG - INTRODUCING THE MISP THREAT ACTOR NAMING STANDARD

The MISP-standard.org has introduced a new Threat Actor Naming Standard for cybersecurity information sharing. This standard aims to provide a structured approach for naming threat actors to improve collaboration and interoperability in the cybersecurity community. It offers global consistency, interoperability with existing platforms like MISP, and benefits such as enhanced collaboration and streamlined analysis.

misp-standard.org · 2 min

TLDR InfoSec

RUSSIA BANS CYBERSECURITY COMPANY RECORDED FUTURE

Recorded Future's CEO has celebrated being the first cybersecurity firm to be banned by Russia.

cyberscoop.com · 1 min

TLDR InfoSec

OVER 3.1 MILLION FAKE "STARS" ON GITHUB PROJECTS USED TO BOOST RANKINGS

A study found over 3.1 million fake stars across repositories and notes that users should be cautious and verify repository quality beyond star ratings.

bleepingcomputer.com · 3 min

TLDR InfoSec

WHAT HAPPENED IN THE U.S. DEPARTMENT OF THE TREASURY BREACH? A DETAILED SUMMARY

GitGuradian provides a detailed timeline of events leading up to the US Department of Treasury Breach due to a compromised API key used for technical support by BeyondTrust, allowing remote access to workstations and documents.

blog.gitguardian.com · 2 min