TLDR INFORMATION SECURITY 2024-02-02

security testing for $7,000 per year.

With ThreatSpike Red, you can pentest your applications, identify your vulnerabilities and carry out full-scale red team exercises all year round [5]. All led by an expert team of certified testers.

LEAKY VESSELS: DOCKER AND RUNC CONTAINER BREAKOUT VULNERABILITIES

Snyk found four "Leaky Vessels" vulnerabilities in core container components that allow container escape to access host OSes. This could let attackers steal sensitive data and further attacks. Users should urgently check for security updates from container vendors and upgrade engines/tools once fixes are available.

CACTUS RANSOMWARE GANG CLAIMS THE SCHNEIDER ELECTRIC HACK

Schneider Electric suffered a data breach after a Cactus ransomware attack hit its Sustainability Business division. The hackers claim to have stolen terabytes of data. The attack impacted the Resource Advisor cloud platform, causing outages.

NEW LINUX GLIBC FLAW LETS ATTACKERS GET ROOT ON MAJOR DISTROS

A new glibc vulnerability that could lead to local privilege escalation in Debian, Ubuntu, and Fedora systems has been discovered. The vulnerability is a heap-based buffer overflow in glibc’s __vsyslog__internal() function, which is used by syslog and vsyslog. Researchers also uncovered three other vulnerabilities in this function and another one in glibc’s qsort() function.

MALICIOUS PYPI PACKAGES SLIP WHITESNAKE INFOSTEALER MALWARE ONTO WINDOWS MACHINES

A threat actor known as WS has uploaded 9 malicious Python packages to the PyPI index. The packages contain base64 encoded PE files that drop and execute the WhiteSnake malware onto an infected device. The WhiteSnake malware is an InfoStealer that contains Anti-VM mechanisms. It utilizes Tor to communicate with a C2 server.

30 NEW SEMGREP RULES AND A PRIMER ON GENERIC AND YAML FEATURES

This post from Trail of Bits contains 30 new freely available Semgrep rules that it created for Ansible, Java, Kotlin, shell scripts, and Docker Compose. It also contains a detailed discussion of the pros and cons of Generic mode as a means of searching without syntax awareness, as well as an overview of the advantages of using YAML mode for scanning YAML files.

004 - ANALYZING A C2 AGENT - PART 2: THE AGENT

This article is the second part of a series analyzing a C2 agent. In this part, the author focuses on the static analysis of the binary to understand its workings, determine if it corresponds to a C2 agent, and identify indicators of compromise. They use tools like PEStudio and dnSpy to analyze the binary and determine that it is a C2 agent binary.

PECORET

PeCoReT is a Pentest Collaboration and Reporting Tool designed to be a fully open-source collaboration platform tailored for pentest projects.

AIM (PRODUCT LAUNCH)

Aim Security is a GenAI security platform designed to protect generative AI apps from prompting attacks and prevent malicious/non-compliant outputs with a focus on safeguarding privacy and stopping data leaks.

MOBSF

Mobile Security Framework (MobSF) is an automated mobile application security testing platform for Android, iOS, and Windows Mobile devices. The framework includes static analyzers as well as dynamic analyzers. MobSF also includes REST APIs and CLI tools to integrate into CI/CD pipelines.

HACKERS STEAL $112 MILLION OF XRP RIPPLE CRYPTOCURRENCY

Ripple co-founder Chris Larsen disclosed hackers stole around $112M in XRP crypto from his personal wallets on Tuesday. He caught the unauthorized access quickly, freezing affected accounts and notifying exchanges and law enforcement.

MERCEDES-BENZ SOURCE CODE AT RISK: GITHUB TOKEN MISHAP SPARKS MAJOR SECURITY CONCERNS

A GitHub token leaked by a Mercedes-Benz employee provided access to all the source code stored on the carmaker’s GitHub Enterprise server.

U.S. GOVERNMENT DISRUPTS BOTNET PEOPLE’S REPUBLIC OF CHINA USED TO CONCEAL HACKING OF CRITICAL INFRASTRUCTURE

The U.S. government has disrupted a botnet that was used by state-sponsored hackers from the People's Republic of China (PRC) to conceal hacking activities targeting critical infrastructure organizations in the United States and other countries. The operation removed the malware from the routers and severed their connection to the botnet.

JOHNSON CONTROLS RANSOMWARE CLEANUP COSTS TOP $27M AND COUNTING

Johnson Controls International (JCI) spent $27 million remediating a September 2023 ransomware attack on its systems.

EUROPCAR SAYS SOMEONE LIKELY USED CHATGPT TO PROMOTE A FAKE DATA BREACH

Europcar has announced that a data breach that alleges to have leaked its customer data is fake. Troy Hunt concurs with this and says that the sample data doesn’t make sense.

SIM-SWAPPING RING STOLE $400M IN CRYPTO FROM A US COMPANY

A Chicago man and his co-conspirators have been charged with running the nation’s largest SIM swap scheme yet. They stole over $400M in cryptocurrency by targeting over 50 victims in more than a dozen states.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930