TLDR INFORMATION SECURITY 2023-11-13

See the Hyperproof advantage in action

ZERO-DAY ALERT: LACE TEMPEST EXPLOITS SYSAID IT SUPPORT SOFTWARE VULNERABILITY

Lace Tempest, a threat actor known for distributing the Cl0p ransomware, has been exploiting a zero-day flaw in SysAid IT support software. Tracked as CVE-2023-47246, this is a path traversal vulnerability that allows for code execution in on-premise installations. SysAid has released a patch for the flaw in version 23.3.36 of the software.

MARINA BAY SANDS DISCLOSES DATA BREACH IMPACTING 665K CUSTOMERS

Singapore’s Marina Bay Sands luxury resort revealed that 665,000 of its customers were impacted by a recent data breach on Tuesday. Personal information such as name, email address, and phone numbers were affected but no credit card data was compromised.

1.3 MILLION MAINE RESIDENTS IMPACTED BY MOVEIT HACK

The State of Maine is the latest entity to disclose a significant impact from the cyberattack targeting a zero-day in Progress Software’s MOVEit file transfer tool earlier this year. The Maine Department of Health and Human Services and the Maine Department of Education were the most affected organizations.

DEMYSTIFYING COBALT STRIKE’S “MAKE_TOKEN” COMMAND

This article explains the inner workings of Cobalt Strike's "make_token" command, which allows users to impersonate other users through their credentials with the goal of enumerating or moving laterally to remote systems.

BYPASSING ANDROID 13 RESTRICTIONS WITH SECURIDROPPER

This post examines SecuriDropper, the first widely distributed Android dropper bypassing Android 13's Restricted Settings defense. Droppers separate attack execution from payload install, which is offered for Malware as a Service (MaaS). SecuriDropper shows that actors are quickly adapting to platform protections, highlighting the ongoing cat-and-mouse game around Android malware distribution.

UNDER THE LENS: THE LNK FILE INVESTIGATION

Shortcut files (.lnk files) might look innocent, but they can cause devastating damage. This post dives into how shortcut files can be exploited for ransomware and more, compromising your computer and the data within it.

SECRETIVE

Secretive is a macOS app for storing and managing SSH keys in the Secure Enclave. It allows for requiring TouchId or Apple Watch authentication as a 2FA for accessing SSH keys and can send notifications whenever a key is accessed.

CAVELO (PRODUCT LAUNCH)

Cavelo provides organizations with the necessary means to scan their environments for data that might be at risk in the event of a breach, including personally identifiable information (PII) and financial information.

AWS-ML-OPT-OUT

aws-ml-opt-out is a terraform module to opt out of any AWS AI/ML data collection. Unless explicitly opted out, any data fed through AWS’ AI/ML offerings can be used by AWS. This terraform module adds a Service Control Policy (SCP) to opt out of all data collection at the organization level.

IMPATIENT LOCKBIT SAYS IT'S LEAKED 50GB OF STOLEN BOEING FILES AFTER RANSOM FAILS TO LAND

Ransomware group LockBit leaked ~50GB of data allegedly stolen from Boeing after Boeing refused to pay. The full release of this data includes system backups and compressed archives. Citrix logs suggest a potential CitrixBleed breach vector. Boeing won't verify data or comment on incident specifics, underscoring disclosure challenges after attacks.

THIS TOOL AIMS TO KEEP TERRORISM CONTENT OFF THE INTERNET

Altitude is a free tool created by Jigsaw and Tech Against Terrorism to give smaller platforms the ability to detect and remove terrorism content on their network. Many groups have moved to smaller platforms as larger platforms have dedicated tools to remove content from groups like ISIS. Altitude seeks to aid these platforms in identifying and contextualizing terrorism content.

SPAMMERS ABUSE GOOGLE FORMS QUIZZES TO DELIVER SCAMS

Spammers are using Google Forms quizzes to deliver email scams. They are creating a new quiz in Google Forms, using the victim’s email address to respond to the quiz, and then abusing the “Release Scores” feature to deliver their spam.

OVERVIEW AND COMPARISON OF A FEW POPULAR CYBERSECURITY FRAMEWORKS: NIST, SOC 2, AND ISO 27001

This post compares the three major standards — NIST, SOC 2, and ISO 27001 — and breaks them down in an easy-to-consume manner.

KEY TAKEAWAYS FROM THE WIZ 2023 KUBERNETES SECURITY REPORT

Wiz observed that Kubernetes clusters are being discovered and targeted quickly and noted that container security and other native security features of Kubernetes are frequently underutilized, leading to lateral movement and privilege escalation being increasingly easy after initial access.

CYBER ATTACK FORCES WORLD’S BIGGEST BANK TO TRADE VIA USB STICK

The Industrial & Commercial Bank of China’s US branch was hit by a ransomware attack that forced systems to be disconnected from the network. Trades had to be carried out by sending USB sticks via messengers through Manhattan.