TLDR INFORMATION SECURITY 2023-09-27

DECADE OF NEWBORN CHILD DATA STOLEN

BORN Ontario, Ontario’s government-sponsored birth registry, reported a data breach affecting 3.4 million people who sought fertility, pregnancy, newborn, or child healthcare from 2010-2023. BORN reported that the hack was due to the MOVEit cyberattacks.

ATTACK

GPUs from all major suppliers are susceptible to a new attack, as demonstrated in a recent research paper, that allows malicious websites to read visual data from other websites, violating the Internet's critical same-origin security policy. While currently deemed more of a curiosity than an immediate threat, the vulnerability highlighted by the attack underscores the risks inherent in hardware optimizations and the need to re-evaluate trust in hardware as a foundational security measure.

MULTI-YEAR CAMPAIGN

Chinese state-sponsored hackers identified as TAG-74 have been conducting a multi-year cyber espionage campaign targeting academic, political, and government organizations in South Korea. The hackers utilize social engineering attacks, including Microsoft Compiled HTML Help (CHM) file lures, to deploy the ReVBShell backdoor and Bisonal remote access trojan.

SOURCE CODE MANAGEMENT PLATFORM BEST PRACTICES

A list of best practices and configurations for GitHub and GitLab. The list includes tools to aid in source code management best practices as well as a series of controls that are recommended to be implemented.

This article talks about one of the latest phishing delivery methods - a sophisticated infostealer that targets the hospitality industry through online booking services. It involves a malicious actor making a booking request and sending a series of urgent emails with links to an executable infostealer. The article provides recommendations for staying safe online, including avoiding clicking on unsolicited links and verifying the authenticity of messages through official channels.

DEFENDING AGAINST DDOS ATTACKS: WHAT YOU NEED TO KNOW

This article talks about four main variants of DDoS attacks, including flooding, amplification, resource depletion, and diversion or ransom attacks. Mitigation strategies include recognizing the signs of DDoS attacks, having an incident response plan, contacting an ISP provider, having threat intel handy, and using other mitigation defenses and tools.

HOW TO ROTATE

How To Rotate is a website that provides tutorials on how to rotate a variety of API keys. The project is sponsored by Truffle Security and currently includes 19 tutorials.

JA4+ NETWORK FINGERPRINTING

JA4+ is a network fingerprinting tool that provides a suite of modular network fingerprints for multiple protocols, allowing for improved threat-hunting and security analysis. The fingerprints include TLS client and server response, HTTP client, light distance/location, X509 TLS certificate, and SSH traffic.

BINDIFF

BinDiff is an open-source comparison tool for binary files to quickly find differences and similarities in disassembled code. It is used to identify and isolate fixes for vulnerabilities in vendor-supplied patches and to analyze multiple versions of the same binary. BinDiff is now open source.

AI DEV ASSISTANTS SOMETIMES EMIT OTHER PEOPLE’S API KEYS

A group of researchers found that GitHub Copilot and Amazon CodeWhisperer can be coaxed into revealing other people’s API keys. The keys that can be leaked were included in training data as they were accidentally committed in public repositories. The researchers have also released a tool to search for publicly exposed credentials.

OPENAI LAUNCHES A RED TEAMING NETWORK

OpenAI announced a Red Teaming Network made up of a contracted group of employees to bolster its AI model risk assessment and mitigation strategies. The goal of this effort is to flag biases in models and prompts that can be used to bypass safety filters.

ISRAEL

A Spanish judge has closed an investigation into the alleged hacking of ministers' phones with Pegasus spyware due to a complete lack of cooperation from Israel. The judge had sent a formal request for information about the software made by Israeli firm NSO Group, but Israel did not respond.

DEFI HACKS USUALLY COME DOWN TO POOR SECURITY

Crypto has a poor reputation for poor cybersecurity, and according to crypto cybersecurity company Halborn’s COO David Schwed, the culprit is simply poor security practices.

MICROSOFT IS ROLLING OUT SUPPORT FOR PASSKEYS IN WINDOWS 11

Microsoft has introduced passkeys to Windows 11, allowing users to log in to websites and applications without a username or password, instead relying on device PIN or biometric information.