TLDR INFORMATION SECURITY 2024-01-12

BITCOIN X HACK AN ‘EMBARRASSMENT’ FOR CYBER SECURITY-CONSCIOUS SEC

The SEC's official X account was hacked and made to tweet a false claim that the bitcoin ETF was approved. This highlights cyber risks the agency has long warned companies about. SEC chair Gary Gensler prioritizes cybersecurity, mandating disclosures and punishing misleading claims. The hack was caused by an individual hijacking the SEC's phone number via a third party. X said the SEC account lacked two-factor authentication.

FIDELITY NATIONAL FINANCIAL SAYS HACKERS STOLE DATA ON 1.3 MILLION CUSTOMERS

Real estate giant Fidelity National Financial (FNF) has confirmed hackers stole 1.3 million customer records in a November cyberattack. FNF said unauthorized third parties accessed systems, deployed malware, and exfiltrated data. The company notified affected customers, applicable state attorneys general, and regulators. The stolen data appears to be sensitive as FNF is providing credit monitoring to impacted customers.

FRAMEWORK DISCLOSES DATA BREACH AFTER ACCOUNTANT GETS PHISHED

Framework Computer disclosed a data breach caused by an employee of its accounting service provider being phished. The accountant shared a spreadsheet containing full names, email addresses, and outstanding balances of employees with unpaid balances to an attacker impersonating the CEO of Framework. Affected customers have been notified.

PANIC!! AT THE YAML

This post contains a deep dive into a remote code execution vulnerability in the SnakeYAML library. The post begins with describing how !! fields work in YAML and how the deserialization vulnerability allows for instantiating Java classes. It then goes through the process of developing an exploit against the vulnerability to eventually achieve remote code execution.

A GAMER TURNED MALWARE DEVELOPER: DIVING INTO SILVERRAT AND ITS SYRIAN ROOTS

An in-depth analysis of the SilverRAT malware. The article includes an analysis of how SilverRAT operates, the code builder platform and options that are sold with it, and the admin panel that is used for C2 operations. It concludes with OSINT to delve into the developers’ backgrounds and IOCs for the malware.

WHEN EXTRACTION MEETS ANALYSIS: CELLEBRITE PHYSICAL ANALYZER

In this blog post, ElcomSoft discusses using its Elcomsoft iOS Forensic Toolkit along with other analysis tools like Cellebrite Physical Analyzer. The post provides instructions for opening and analyzing data extracted using Elcomsoft iOS Forensic Toolkit in Cellebrite Physical Analyzer. Elcomsoft is also examining compatibility with other top-tier tools and is open to partnerships and collaborations.

BBOT

BBOT (Bighuge BLS OSINT Tool) is a modular, recursive OSINT framework that can execute the entire OSINT workflow in a single command.

BETTERSCAN

Betterscan contains many tools for Code, Cloud, secrets, dependencies, software composition analysis, Supply Chain Risks, and precise Graph-based SAST analysis for Code and AI/OpenAI GPT.

DAMN VULNERABLE LLM AGENT

Damn Vulnerable LLM Agent is a deliberately vulnerable ReAct LLM Agent built with Langchain. Users can utilize it to learn and experiment with prompt injection attacks.

YOU HAD ME AT HI — MIRAI-BASED NOABOT MAKES AN APPEARANCE

Akamai uncovered a new crypto mining campaign active in 2023 spreading via SSH using a custom Mirai botnet called NoaBot. NoaBot has wormable self-spreading capabilities and an SSH key backdoor. It drops a modified XMRig miner with an obfuscated config and custom mining pool. Evidence links it to 2023's P2PInfect worm, but immature names complicate attribution.

SANDWORM PROBABLY WASN’T BEHIND DANISH CRITICAL INFRASTRUCTURE CYBERATTACK, REPORT SAYS

According to cybersecurity firm Forescout, last year's cyberattack against Danish critical infrastructure, which was believed to be conducted by Sandworm, was likely not the work of the Russian hacking group. Forescout's research indicates that the two waves of attacks were unrelated and that Sandworm probably did not have anything to do with it.

HERE’S SOME BITCOIN: OH, AND YOU’VE BEEN SERVED!

A Californian man who lost $100,000 in a SIM-swapping attack has obtained permission from a federal judge to serve and sue the unknown owner of a crypto wallet via delivery of bitcoin to the wallet. This is the first-ever ruling of its kind and may provide new avenues for victims of crypto theft to retrieve funds.

MICROSOFT TESTING WINDOWS 11 USB 80GBPS SUPPORT, COPILOT ON LOGIN

Microsoft is testing the USB4 Version 2.0 specification, which supports transfer speeds of up to 80 Gbps over USB Type-C cables, in Windows 11.

SECURITY FIRM MANDIANT SAYS IT DIDN’T HAVE 2FA ENABLED ON ITS HACKED TWITTER ACCOUNT

Security firm Mandiant revealed that it did not have two-factor authentication (2FA) enabled on its hacked X account, leaving the account vulnerable to brute-force password attacks.

CROOKS POSE AS RESEARCHERS TO RETARGET RANSOMWARE VICTIMS

Threat actors posing as cybersecurity researchers are contacting victims of the Royal and Akira ransomware gangs, offering to delete files the groups have stolen for a fee.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930