TLDR INFORMATION SECURITY 2024-01-19

GET THE CONTAINER SECURITY CHEAT SHEET

RANSOMWARE GROUP TARGETS FOXCONN SUBSIDIARY FOXSEMICON

Foxsemicon, a subsidiary of Foxconn, was recently targeted by the ransomware group LockBit. The hackers defaced Foxsemicon's website, claimed to steal 5TB of data, and are threatening to leak sensitive customer/employee info unless their ransom demand is paid.

LEFTOVERLOCALS: LISTENING TO LLM RESPONSES THROUGH LEAKED GPU LOCAL MEMORY

Trail of Bits is disclosing a vulnerability that it discovered that allows for memory leakage from an optimized GPU region in GPUs from Apple, Qualcomm, AMD, and Imagination. The researchers showed that they could leak 5.5MB per GPU invocation, which translates to 181MB on a 7B llama.cpp model. They demonstrated that this is enough information to reconstruct the LLM response with high accuracy.

ANDROXGHOST MALWARE BOTNET STEALS AWS, MICROSOFT CREDENTIALS

CISA and FBI warn that threat actors using Androxghost malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads. The botnet scans for servers vulnerable to specific RCE vulnerabilities and then scans the servers for .env files with cloud credentials. The credentials can then be used to spin up infrastructure to expand the botnet or to send out spam masquerading as the compromised companies.

LATERAL MOVEMENT – VISUAL STUDIO DTE

Visual Studio's Development Tools Environment (DTE) COM library can enable lateral movement by interacting with the OS to execute commands remotely. The class ID of the Visual Studio install needs to be retrieved from the registry first, but it is an interesting path that can be taken.

REAL TIME THREAT DETECTION FOR KUBERNETES WITH ATOMIC RED TESTS & FALCO

A post on using Atomic Red Tests to test Falco detection in Kubernetes. The post first walks through deploying Atomic Red Tests and Falco in a Kubernetes cluster. It then walks through running tests, monitoring for detections, and adding custom Falco rules for missed events.

A LIGHTWEIGHT METHOD TO DETECT POTENTIAL IOS MALWARE

This blog post discusses a lightweight way to detect potential iOS malware by analyzing the Shutdown.log file stored in sysdiag archives. Anomalies and indicators of malware can be detected by extracting and parsing the log file. In the example presented in the post, through analysis of several Pegasus malware infections, it was discovered that the Shutdown.log file contained traces of infection.

LAST

Use OpenAI to scan your code for security issues from the CLI. It requires adding your own OpenAI API token. LAST includes options to scan full code, change code, and run in the pipeline.

APPVERIFIER

AppVerifier takes the app's package name and signing certificate hash(es) and compares them to the ones you provided or the ones in the internal database to verify that your apps are genuine.

AWSSCRAPE

A tool to scrape SSL certificates from all AWS IP ranges and search for specific keywords.

CONTAINERISED CLICKS: MALICIOUS USE OF 9HITS ON VULNERABLE DOCKER HOSTS

Vulnerable Docker services are being targeted to deploy XMRig cryptocurrency miner and 9Hits Viewer software, marking the first case of 9Hits being used maliciously. The threat actors aim to diversify their money-making strategies by compromising Docker hosts via Shodan scans and running headless Chrome instances to generate web traffic credits.

PIXIEFAIL: NINE VULNERABILITIES IN TIANOCORE'S EDK II IPV6 NETWORK STACK

This blog post discusses nine vulnerabilities that have been discovered in the IPv6 network protocol stack of EDK II, TianoCore's open source reference implementation of UEFI. The vulnerabilities affect various vendors that use EDK II's NetworkPkg module, including Arm, Insyde Software, American Megatrends Inc., Phoenix Technologies Inc., and Microsoft Corporation.

RUSSIAN THREAT GROUP COLDRIVER EXPANDS ITS TARGETING OF WESTERN OFFICIALS TO INCLUDE THE USE OF MALWARE

Google's Threat Analysis Group discusses the COLDRIVER Threat group from Russia and its increasing attacks on western officials using malware. The group primarily focuses on credential phishing against high-profile individuals in NGOs, former intelligence and military officers, and NATO governments. It employs impersonation accounts to establish rapport with targets and increase the success of its phishing campaigns.

HAVE I BEEN PWNED ADDS 71 MILLION EMAILS FROM NAZ.API STOLEN ACCOUNT LIST

The Naz.API credential stuffing list contains 70 million unique email addresses and old passwords - it was found on a hacking forum.

A YEAR OF DISRUPTION & RESILIENCE: THE CYBERSECURITY MARKET IN 2023

This retrospective on the Cybersecurity Market in 2023 notes that although overall funding was down, the largest acquisition in cybersecurity history also took place last year.

[20] [20] TWEETFEED IS BACK! [20] [20]

After a couple of months of being down, Tweetfeed is back with Indicators of Compromise (IOCs) shared by the infosec community at X.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930