TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-03-01

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

RANSOMWARE GANG CLAIMS IT STOLE 6TB OF CHANGE HEALTHCARE DATA

The BlackCat/ALPHV ransomware gang has claimed responsibility for a cyberattack on Optum, a subsidiary of UnitedHealth Group. The attack caused an ongoing outage affecting the Change Healthcare platform, a large payment exchange platform used by more than 70,000 pharmacies across the United States. The gang claims to have stolen 6TB of data from Change Healthcare's network, including sensitive personal information.

bleepingcomputer.com2 min read

POPULAR VIDEO DOORBELLS CAN BE EASILY HIJACKED, RESEARCHERS FIND

Security flaws have been discovered in several internet-connected doorbell cameras, including ones made by EKEN. The most serious issue allows hackers to take full control of a camera by holding down a button and scanning a QR code. Retailers have been alerted, but only some have removed the vulnerable cameras from sale.

techcrunch.com3 min read

RETAILER PEPCO LOSES ABOUT 15 MLN EUROS IN HUNGARIAN PHISHING ATTACK

Pepco, a European discount retailer, lost €15 million in a phishing attack targeting its Hungarian business. Whether the funds are recoverable is uncertain. The company is financially stable and currently conducting a security review. No customer or employee data was compromised.

reuters.com3 min read

02STRATEGIES & TACTICS

TOP 10 FEATURES TO ENHANCE YOUR OKTA SECURITY POSTURE

This post breaks down 10 security features that can be used to enhance your Okta security posture. Highlighted features include ThreatInsight, behavior profiling, admin and user session management, and password and MFA policies.

rezonate.io12 min read

DETECT STRIPE KEYS IN S3 BUCKETS WITH AMAZON MACIE

A tutorial from AWS on how to utilize the newly added `STRIPE_CREDENTIALS` managed data identifier in Amazon Macie to identify Stripe API keys in S3 Buckets. It walks through setting up the Macie job and includes sample data.

aws.amazon.com5 min read

HOW WE BUILT PINGORA, THE PROXY THAT CONNECTS CLOUDFLARE TO THE INTERNET

Cloudflare made the decision to abandon its usage of Nginx in favor of building its own proxy. This article goes through the issues Cloudflare faced with Nginx and the design decisions that went into Pingora's design. It concludes with an in-depth review of the performance gains that were achieved.

blog.cloudflare.com9 min read

03LAUNCHES & TOOLS

SCANME

Scanme is a Go package for network scanning. It can scan single IP addresses for open ports.

github.comGitHub repository

SECURITY ONION

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes interfaces for alerting, dashboards, hunting, PCAP, and case management.

github.comGitHub repository

INFISICAL

Infisical is an open-source secrets management platform that features a dashboard, client SDKs for fetching secrets, an API, and integrations with several platforms, like Kubernetes and Terraform.

github.comGitHub repository

04MISCELLANEOUS

EUROPEAN DIPLOMATS TARGETED BY SPIKEDWINE WITH WINELOADER

An invitation to a wine-tasting event was discovered to be part of a targeted spearphishing campaign that distributed a new stealthy backdoor called WINELOADER to European diplomats. The invitation included a malicious link to a fake questionnaire - targets were told that the questionnaire must be filled out in order to participate in the event. The link redirected to a compromised site that downloaded a file containing obfuscated JavaScript code to execute the attack.

zscaler.com8 min read

FBI WARNS USERS TO CHECK THEIR ROUTERS FOR COMPROMISE

Ubiquiti EdgeRouters are being used by the Russian-backed APT28 group to collect information and proxy malicious traffic. The FBI revealed that it accessed routers belonging to businesses and homes to remove APT28’s malware and add firewall rules to prevent reinfection. The operation did not patch any vulnerabilities - owners are urged to check their equipment for signs of compromise.

arstechnica.com3 min read