TLDR INFORMATION SECURITY 2023-09-08

EXPERTS FEAR CROOKS ARE CRACKING STOLEN LASTPASS KEYS

A steady trickle of cryptocurrency heists targeting security-conscious tech professionals has led some to believe that LastPass Vaults that were involved in the November 2022 breach were cracked. Taylor Monahan, lead product manager of MetaMask, documented the heists on X and notes that the victims of the cryptocurrency schemes are unique in that they have not suffered from any of the attacks (such as email compromise) that tend to predate these attacks. More details and interviews are presented in the article.

THE WILD

Two zero-day vulnerabilities fixed by Apple in emergency security updates were exploited to deploy Pegasus commercial spyware onto fully patched iPhones through iMessage. The attackers were able to infect iPhones without victim interaction by sending PassKit attachments containing malicious images. Apple and Citizen Lab are encouraging device updates and the activation of Lockdown Mode for those at risk of targeted attacks.

Ticketing services agency See Tickets has notified more than 300,000 individuals that their payment card data was stolen in a new web skimmer attack. The ticketing services agency also notes that it has no evidence to suggest that the stolen personal information was fraudulently used. However, such data is typically shared between cybercriminals and used to perform various types of fraud.

Security researcher Nea Paw has created a fully autonomous AI disinformation system called CounterCloud using existing AI tools. The CounterCloud AI system can scrape, generate, and distribute AI-generated disinformation tweets and articles. This research project has not been made publicly available and all tweets and articles have been kept private. Experienced journalists who received access to the generated content reported that it seemed very realistic.

GETTING STARTED WITH ETHICAL HACKING SERIES

Ethical hacking refers to the process of identifying and exploiting vulnerabilities in computer systems, networks, and applications with the intention of improving their security. This series dives into how anyone can get into ethical hacking.

ACCOUNTS

In a post-mortem report, Microsoft revealed how hackers stole a cryptographic consumer key and used it to forge tokens for Outlook.com and Outlook Web Access. The key was stolen from a software dump that was created when a Microsoft computer crashed. Microsoft has now fixed the bugs that allowed the breach to happen, but users should still be vigilant and take steps to protect their accounts.

ETERNALHUSH FRAMEWORK

The EternalHush Framework is an open-source advanced C2 framework designed for Windows machines. The framework includes an extensible Python API and plugin ecosystem. It also includes a GUI to simplify controlling and collecting data from infected machines

TARTUFO

tartufo searches through git repositories for secrets, digging deep into commit history and branches. Effective at finding accidentally committed secrets, tartufo also can be used by git pre-commit scripts to screen changes for secrets before they are committed to the repository.

THREATINGESTOR

ThreatIngestor can be configured to watch X, RSS feeds, sitemap (XML) feeds, and other sources, extract meaningful information, such as malicious IPs/domains and YARA signatures, and send that information to another system for analysis.

IT’S OFFICIAL: CARS ARE THE WORST CATEGORY WE HAVE EVER REVIEWED

The *Privacy Not Included team at Mozilla has released its review of privacy features of major car brands and concluded that every single one of the 25 car brands failed to meet their privacy standards. All of the brands collect too much data, 92% give little to no control over data collection to users, and 84% admit to selling that data. Tesla and Nissan scored the worst on the privacy tests and Renault and Dacia scored the best.

ROOT

Android 14 tightens control of trusted certificates, blocking modification even on rooted devices, continuing the shift from openness towards locked-down vendor control. This creates challenges for developers, testers, and reverse engineers by requiring direct certificate authority control.

STATE OF THE VIRTUAL CISO 2023 REPORT

The State of the Virtual CISO Survey Report provides insights on vCISO adoption trends and challenges among 200 MSP/MSSP security leaders. It reveals drivers and blockers for the growing vCISO model, helping MSPs/MSSPs evaluate and overcome hurdles to offering security leadership services.

DEFENSIVE SECURITY IS A GLACIER

A thought piece that compares defensive security to a glacier in the sense that it is a colossal, slow-moving machine. The article gives some examples of major milestones in security and argues that they were all done by large corporations/governments and could not have happened sooner no matter what individuals did. It concludes that in defensive security, individuals must focus on smaller changes and wins than on large scale change.

'FEASIBLE'

The UK dropped mandatory messaging scanning from its Online Safety Bill after tech industry backlash, but clauses remain, passing the issue to future governments when "technically feasible." A bare minimum concession, the core controversy continues unresolved.

HOW CHINA GETS FREE INTEL ON TECH COMPANIES’ VULNERABILITIES

China's 2021 law mandates that tech companies operating in the country disclose hackable flaws in their products to the government. Some foreign firms with operations in China appear to be complying, potentially giving Chinese state-sponsored hackers an advantage in exploiting these vulnerabilities, raising cybersecurity concerns.