TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2023-12-06

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

THREAT ACTORS EXPLOIT ADOBE COLDFUSION CVE-2023-26360 FOR INITIAL ACCESS TO GOVERNMENT SERVERS

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a cybersecurity advisory in response to the exploitation of CVE-2023-26360 by unidentified threat actors at a Federal Civilian Executive Branch (FCEB) agency. At least two public-facing servers were compromised between June and July 2023. The advisory provides network defenders with tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and methods to detect and protect against similar exploitation.

cisa.gov13 min read

DECEMBER ANDROID UPDATES FIX CRITICAL ZERO-CLICK RCE FLAW

Google has released the December 2023 Android security updates, which address 85 vulnerabilities, including a critical zero-click remote code execution (RCE) bug. The RCE bug, tracked as CVE-2023-40088, was found in Android's System component and can be exploited without additional privileges.

bleepingcomputer.com2 min read

P2PINFECT - NEW VARIANT TARGETS MIPS DEVICES

A new variant of the P2Pinfect malware has been discovered specifically targeting embedded devices based on 32-bit MIPS processors. The malware attempts to brute force SSH access to these devices, making it highly likely that routers and IoT devices will be infected.

cadosecurity.com7 min read

03STRATEGIES & TACTICS

MICROSOFT CYBERSECURITY REFERENCE ARCHITECTURES

The Microsoft Cybersecurity Reference Architectures (MCRA) are shared as part of the Security Adoption Framework. This post describes how Microsoft's cybersecurity capabilities integrate with their own and third party platforms. The resource includes information on antipatterns, best practices, and threat trends, among other topics. It also includes detailed technical diagrams for various aspects of cybersecurity.

learn.microsoft.com2 min read

04LAUNCHES & TOOLS

HUMBLE

A humble and fast security-oriented HTTP headers analyzer.

github.comGitHub repository

IMDSPOOF

IMDSpoof is a tool that spoofs the AWS IMDS service running on an EC2 instance. The tool spoofs the security-credentials IMDS endpoint and redirects it to a local webserver. This webserver can utilize Thinkst Canary HoneyTokens to alert on user access.

github.comGitHub repository

COPACETIC

Copacetic can be used to quickly patch a container without going upstream for rebuild based on vulnerabilities. This can be used to shorten incident response times because the time from vulnerability announcement to active exploitation continues to narrow.

github.comGitHub repository

05MISCELLANEOUS

15,000 GO MODULE REPOSITORIES ON GITHUB VULNERABLE TO REPOJACKING ATTACK

Security research firm Vulncheck claims that 15,000 Go module repositories on GitHub are vulnerable to an attack called repojacking, where bad actors take advantage of account username changes and deletions to create repositories with the same name and stage open-source software supply chain attacks. These repositories account for at least 800,000 Go module-versions.

thehackernews.com2 min read

IAM ACCESS ANALYZER ADDS UNUSED ACCESS AND CUSTOM POLICY CHECKS

AWS IAM Access Analyzer has added a new analyzer to continuously monitor roles and users for permissions that are granted and not used. The custom policy checks can be integrated with a CI/CD tool to allow for reporting on whether a change will add any additional IAM permissions.

aws.amazon.com3 min read