TLDR INFORMATION SECURITY 2024-02-14

Join the webinar (free) to see the survey results

FRENCH HEALTHCARE PAYMENTS PROCESSOR BREACHES AFFECT HALF OF POPULATION

Payments outfits Viamedis and Almerys both experienced breaches of their systems in late January leading to the theft of data belonging to more than 33 million customers. Affected data on customers and their families includes dates of birth, marital status, social security numbers, and insurance information.

BANK OF AMERICA WARNS CUSTOMERS OF DATA BREACH AFTER VENDOR HACK

Bank of America is sending notification letters to 57,000 customers to inform them that their personal information was stolen in a data breach at third-party services provider Infosys McCamish System. Losses related to the incident were estimated at $30 million.

3.5M EXPOSED IN COVID-19 E-PASSPORT LEAK

A state in India required travelers to obtain a COVID-19 e-pass mandatory. Researchers recently discovered that this data was stored in an open S3 bucket. The leaked data includes names, passport numbers, gender information, mobile numbers, email addresses, travel details, and vehicle numbers.

🔍 DIVE INTO THE REDLINE STEALER INFECTION CHAIN – PART 1

This post is part of a series that dives into RedLine stealer. RedLine Stealer is a malware available on underground forums for sale as a standalone at $100/$150, depending on the version, or on a subscription basis at $100/month. This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information.

EXPLORING RED TEAM PERSISTENCE VIA AWS LEX CHABOT’S

This blog post explores how attackers can hijack AWS Lex Chabots with a “sleeper phrase” that returns the Lambda function’s role credentials. The post goes through the process of debugging to find the relevant intent file to update and the correct formatting to have Lex return the message properly.

CONDITIONAL LOVE FOR AWS METADATA ENUMERATION

aws:ResourceAccount, as well as various other global conditions, can be used with the StringLike operand to enumerate account IDs, tags, and other metadata across most AWS APIs. The post includes a tool to automate the process.

Get the checklist here >>

SEAL SECURITY (PRODUCT LAUNCH)

Seal is a supply chain security tool that differentiates itself by providing patches to vulnerable packages instead of pushing for updates to the packages.

DOMAIN PROTECT

Domain Protect helps to prevent subdomain takeover. It uses serverless functions in AWS or GCP to continually scan an organization’s DNS records. When vulnerable subdomains are found, Domain Protect sends alerts via Slack or email and optionally creates cloud resources to take over subdomains.

KUBECONFORM

Kubeconform is a Kubernetes manifest validation tool. It can be run locally or integrated into a CI/CD pipeline. Kubeconform borrows heavily from Kubeval, but it has better performance and support for custom resources.

OPENSSF SECURING SOFTWARE REPOSITORIES WORKING GROUP RELEASES PRINCIPLES FOR PACKAGE REPOSITORY SECURITY

CISA and the OpenSSF Securing Software Repositories Working Group have published a new framework for securing package repositories. Principles for Package Repository Security is a framework aimed at establishing a set of foundational rules for package managers and further harden open-source software ecosystems.

THE NINE LIVES OF COMMANDO CAT

Commando Cat is a novel infostealer malware campaign that targets unsecured Docker API endpoints. The attack begins by launching the malicious Docker container and then escaping to the host. The malware then installs several backdoors and a credential stealer. It removes any other crypto miners and black holes in the Docker registry to prevent competition. This post includes IoCs and Yara rules.

DECRYPTED: RHYSIDA RANSOMWARE

Avast has made the Rhysida decryptor publicly available. It has been available to victims of the Rhysida ransomware since August 2023. This document provides instructions on how to use the decryptor, including parameters that affect the encryption and decryption process, and explains the option to back up encrypted files before decryption.

REWARD OFFERS FOR INFORMATION TO BRING HIVE RANSOMWARE VARIANT CO-CONSPIRATORS TO JUSTICE

The U.S. Department of State has announced monetary rewards of up to $10 million for information about individuals holding key positions within the Hive ransomware operation.

MIT STUDENT CLAIMS TO HACK APPLE VISION PRO ON LAUNCH DAY

A PhD student at MIT posted a photo on X alleging to have discovered a kernel exploit in the Apple Vision Pro on launch day.

WI-FI JAMMING TO KNOCK OUT CAMERAS SUSPECTED IN NINE MINNESOTA BURGLARIES

A serial burglar in Edina, Minnesota is suspected of using a Wi-Fi jammer to disable connected security cameras before committing burglaries.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930