TLDR INFORMATION SECURITY 2023-11-01

GET YOUR FREE CHEAT SHEET HERE.

LOCKBIT CLAIMS IT HAS HACKED BOEING AND STOLEN SENSITIVE DATA

Lockbit ransomware group has listed Boeing on its victims list. Stolen Boeing data could have big repercussions as the company works for military clients who want their information to be confidential. Boeing is currently assessing this claim.

ATLASSIAN PATCHES CRITICAL CONFLUENCE BUG

Atlassian disclosed a 9.1 severity CVE in Confluence Data Center and Server. It described the vulnerability as an improper authorization vulnerability that could lead to significant data loss if exploited by an unauthenticated attacker. Users of Confluence Data and Server are advised to update as quickly as possible. Confluence Cloud users are unaffected.

CCLEANER ANNOUNCED A DATA BREACH DUE TO MOVEIT

CCleaner’s parent company announced that it experienced a data breach related to MOVEit. Attackers compromised customer names, contact information, and purchase details. The Cl0p ransomware gang has not yet added details to its website about this attack.

BUILDING A PHISHING SIMULATION CAMPAIGN WITH GOPHISH FRAMEWORK — PART I

This multi-part blog is a walkthrough on how to set up a phishing simulation campaign for education purposes. The first post covers configuring DNS, VPS, and TLS, installing Postfix, and SMTP service integration.

SLACK ATTACK: A PHISHER’S GUIDE TO INITIAL ACCESS

An article from Push Security exploring different Phishing techniques that can be used for initial access in Slack. The article covers common attacks, methods to cleanup after attacks, and the potential impacts.

THREAT HUNTING: DETECTING BROWSER CREDENTIAL STEALING

This post showcases how to detect browser credential extraction, weed out false positives, and improve resilience against this threat by enabling process creation and file access auditing. Tools such as Lazagne and HackerBrowserData are open source and provide customizability to advanced attackers, whereas tools such as Nirsoft’s WebBrowserPassView are closed source and cannot be modified easily.

DARKTRACE/CLOUD (PRODUCT LAUNCH)

Darktrace has released a new solution based on AI. The new solution provides visibility of cloud architectures, real-time cloud-native threat detection and response, and prioritized recommendations and actions to help security teams manage misconfigurations and strengthen compliance.

HAR FILE SANITIZER (WEBAPP)

Cloudflare released a tool to sanitize HAR files in response to the (latest) Okta breach of customer HAR files. Users can upload a HAR file and client-side logic will sanitize any sensitive credentials.

IMESSAGE CONTACT KEY VERIFICATION

iMessage Contact Key Verification uses Key Transparency to verify the identity of the person that a user is corresponding with and notifies users if the conversation may be eavesdropped on. Users can also choose to verify a Contact Verification Code in person or via FaceTime. This feature is aimed at journalists, government officials, or others who have high privacy requirements.

CLOUDKEYS IN THE AIR: TRACKING MALICIOUS OPERATIONS OF EXPOSED IAM KEYS

This post details an active cryptojacking campaign abusing exposed AWS credentials on GitHub. The actor creates EC2 miners within minutes of secrets being posted leveraging cloud automation for scale. It goes into detail on how the actor implemented honeypots to monitor and reveals 474 miner instances between August and October.

THE WIKI-SLACK ATTACK

Researchers are calling attention to the Wiki-Slack attack, a new technique that uses modified Wikipedia pages and relies on a formatting error when the page is rendered in Slack. To mount the attack, a threat actor would first need to select a Wikipedia article that might be of interest to an intended target, modify it to add a legitimate footnote at the end of the first paragraph, and then share the article in Slack, leading them to an attacker-controlled website where browser-based malware lays in wait.

FINDING YOU: THE NETWORK EFFECT OF TELECOMMUNICATIONS VULNERABILITIES FOR LOCATION DISCLOSURE

The document from CitizenLab discusses the vulnerabilities of mobile networks and how they can be exploited by surveillance actors to track users' locations. These vulnerabilities are most often tied to the signaling messages sent between telecommunications networks which expose phones to different modes of location disclosure.

PWN2OWN TORONTO 2023 - DAY FOUR RESULTS

The Zero Day Initiative’s Pwn2Own Toronto 2023 hacking competition concluded with two new zero-day exploits, bringing the total demonstrated vulnerabilities to 58. Over the course of four days, participants successfully exploited routers, printers, smart speakers, NAS products, surveillance systems, and mobile phones, earning more than $1 million in rewards.

TROJANIZED PYCHARM SOFTWARE VERSION DELIVERED VIA GOOGLE SEARCH ADS

A malvertising campaign has been discovered that promotes fake versions of PyCharm through Google search results. A compromised website specializing in wedding planning has been infected with malware to serve bogus links to the software. Victims who click on the ad are led to a hacked web page with a link to download the application, which installs over a dozen different pieces of malware instead.

SEC SUES SOLARWINDS FOR MISLEADING INVESTORS BEFORE 2020 HACK

The SEC has charged SolarWinds with defrauding investors by concealing cybersecurity defense issues. The SEC alleges that the CISO of SolarWinds was aware of major security issues in the product but concealed that information. SolarWinds maintains that the action is unfounded.