TLDR INFORMATION SECURITY 2023-09-20

RCE VULNERABILITY

VulnCheck has found that around 12,000 Juniper firewall devices exposed on the internet are vulnerable to a recently disclosed remote code execution (RCE) flaw. The vulnerability could be exploited by an unauthenticated and remote hacker to execute arbitrary code on Juniper firewalls without creating a file on the system. It was patched by Juniper Networks last month, but the company warned that it detected exploitation attempts in the wild.

Malwarebytes reports that a malicious Google Ad impersonating the official Webex download portal has managed to garner the top search result spot for the term Webex. The download page includes a fake Webex installer that downloads the BatLoader malware which then downloads the DanaBot credential stealer. A Google spokesperson commented that actions were taken against the account that listed the ads.

HACKERS BREACHED INTERNATIONAL CRIMINAL COURT’S SYSTEMS LAST WEEK

The International Criminal Court (ICC) announced a cyberattack on its systems last week and is currently investigating with the Dutch authorities. The extent of the impact is unknown, and the Court is working to ensure its core work continues. The ICC plans to intensify its cybersecurity defense and expedite the adoption of cloud technology.

A BIG LOOK AT SECURITY IN OPENAPI

This blog post discusses security options in OpenAPI and what companies are doing regarding API security. Large companies like Facebook and Github use OAuth2 for API security. The document recommends using OAuth2 for authentication but acknowledges that it can be complex. API keys are still commonly used for security in smaller APIs. Basic authentication is not recommended due to its insecurity.

CENTRALIZED DASHBOARD FOR AWS CONFIG AND SECURITY HUB

A tutorial from AWS on creating a centralized, multi-account, and multi-region Security dashboard that aggregates AWS Config and Security Hub compliance scores.

CHINESE HACK

A State Department cybersecurity expert implanted a warning mechanism in 2020 to detect future hacks. It went off in June 2022, alerting the US government to a Chinese hack. The State Department's actions likely prevented Beijing from gaining more extensive access to the private communications of key US officials.

GRAPHQL-ARMOR

GraphQL-Armor is a dead-simple yet highly customizable security middleware for various GraphQL server engines.

COBALT STRIKE 4.9: TAKE ME TO YOUR LOADER

Cobalt Strike 4.9 has been released with new features, including an overhaul to its post-exploitation capabilities, the ability to export Beacon without a reflective loader, support for callbacks in built-in functions, and a new in-Beacon data store. Its post-exploitation capabilities now support prepend-style User Defined Reflective Loaders and updates to Beacon User Data as well as Aggressor Script support for sending and receiving data between Cobalt Strike clients.

CROWDSTRIKE TO ACQUIRE APPLICATION INTELLIGENCE STARTUP BIONIC

CrowdStrike, a cybersecurity vendor, has announced plans to acquire Bionic, a Silicon Valley startup that sells tools in the Application Security Posture Management (ASPM) category. The cash-and-stock transaction is valued at around $350 million, allowing CrowdStrike to enhance its enterprise cloud security portfolio.

PENALTIES

This article talks about the various risks and penalties of not complying with various cybersecurity best practices or compliance frameworks. Non-compliance in cybersecurity can lead to several risks, including vulnerability to cyberattacks, data breaches, and damage to a company's reputation. While non-compliance with legal frameworks like HIPAA and GDPR can result in severe penalties, including substantial fines and legal action, not implementing adequate controls required by these frameworks also often leave systems vulnerable to cyberattacks.

25 LESSONS FROM 17 YEARS IN CYBERSECURITY

Mike Privette presents 25 lessons that he’s learned from his 17 years in the cybersecurity industry. The lessons range from observations about the industry, career development, to cybersecurity culture and conferences. He concludes with some takeaways.

A REVIEW OF NIST’S DRAFT CYBERSECURITY FRAMEWORK 2.0

The NIST has released its draft of the updated Cybersecurity Framework. After a decade, the NIST has updated the Cybersecurity Framework to reflect the changing cybersecurity landscape. The scope of the five existing pillars has been expanded and a sixth pillar, govern, has been added. The post claims that it is unlikely to fundamentally improve the nation's cyber posture.

XBOX VS FTC COURT DOCUMENTS LEAKED

A trove of documents from the Xbox vs FTC court case have been leaked. The documents detail confidential business secrets on acquisitions and product roadmaps. The FTC reports that Microsoft is responsible for the leak.

RECENT CYBER ATTACK IS CAUSING CLOROX PRODUCTS SHORTAGE

The recent cyber attack on Clorox is still affecting the supply of its cleaning products. The company has taken some of its systems offline and implemented additional security measures. It has engaged third-party cybersecurity experts to investigate the incident.