TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-03-06

6 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

RIGHT NOW

Cloud attacks are fast, and operating in the cloud securely requires a new mindset. Sysdig has introduced the 5/5/5 Benchmark for Cloud Detection and Response [6] as a new standard for incident response: 5 seconds to detect, 5 minutes triage, and 5 minutes to respond. To meet this benchmark, security teams need to focus on what’s happening right now — deployed applications — not only pre-delivery scanning. Runtime Insights [5] are key to identifying in-use [5] packages, configs, permissions, and network connections that pose an active risk.

sysdig.comSponsor

02ATTACKS & VULNERABILITIES

REPORT UNCOVERS MASSIVE SALE OF COMPROMISED CHATGPT CREDENTIALS

New research shows that over 225,000 logs containing compromised OpenAI ChatGPT credentials were sold on underground markets between January and October 2023. The data came from devices infected with information stealer malware like LummaC2 and RedLine. Over 130,000 unique hosts with ChatGPT access were infiltrated during June-October alone, a 36% rise from earlier 2023.

hackread.com4 min read

AMERICAN EXPRESS CREDIT CARDS EXPOSED IN THIRD-PARTY DATA BREACH

Some of American Express' customers' credit card data was exposed after a merchant processor was hacked. American Express itself was not breached. The breach at the third-party service provider led to unauthorized access to customers' account numbers, names, and card expiration dates. It is unclear how many customers were impacted.

bleepingcomputer.com3 min read

JETBRAINS RELEASES URGENT ADVISORY ON VULNERABILITIES AFFECTING TEAMCITY

JetBrains has advised users to urgently patch two vulnerabilities in TeamCity servers. The less severe vulnerability allows unauthenticated users to obtain a limited amount of information disclosure and modification while the more severe vulnerability allows for a total server compromise. Cloud instances have been patched and show no evidence of exploitation.

therecord.media3 min read

03STRATEGIES & TACTICS

UNLEASHING ZERO-CLICK WORMS THAT TARGET GENAI-POWERED APPLICATIONS

Researchers created a computer worm called Morris II that targets AI-powered applications by using adversarial self-replicating prompts. They demonstrated it against AI email assistants for spamming and data exfiltration across different models and input types. The worm replicates itself through prompts that make AI models engage in malicious activities and propagation.

sites.google.com20 min read

THE ELI5 GUIDE TO PROMPT INJECTION

An in-depth guide on different types of Prompt Injection attacks. The guide also includes real-world examples of some attacks, best practices for preventing prompt injection, and tools that can aid in defending against prompt injection.

lakera.ai18 min read

HOW TO MAKE NMAP RECOGNIZE NEW SERVICES

A guided tutorial on adding a new service detection to nmap. It walks through the process of cloning nmap, understanding the OPC UA specification, writing a script to capture the relevant probe, and adding the probe to nmap. It also includes details for testing and contributing the change to the official nmap project.

shufflingbytes.com5 min read

04LAUNCHES & TOOLS

FIREWALL FOR AI FROM CLOUDFLARE (PRODUCT LAUNCH)

Cloudflare is launching Firewall for AI, a protection layer to identify abuses against large language models before they reach the models. It will include features like rate limiting, sensitive data detection, and prompt validation to detect exploits and data extraction attempts, leveraging Cloudflare's network to protect users and LLMs.

blog.cloudflare.com

LME

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution.

github.comGitHub repository

FREE CERTIFICATE EXPIRY MONITORING VIA RSS

A free service that allows users to subscribe to TlS certificate expiry notifications via RSS. No sign-up is required and notifications are generated at 30 days, 7 days, and 1 day until expiration.

raphting.dev1 min read

05MISCELLANEOUS

RAPID7 THROWS JETBRAINS UNDER THE BUS FOR 'UNCOORDINATED VULNERABILITY DISCLOSURE'

Security firm Rapid7 criticized JetBrains for silently patching two vulnerabilities in TeamCity before public disclosure, violating coordinated vulnerability disclosure norms. Despite Rapid7's policy against silent patching, JetBrains released patches without an advisory or notifying researchers. Rapid7 then published details of the vulnerabilities after JetBrains ignored inquiries.

theregister.com5 min read

FAKE RANSOMWARE GANG ADMITS IT MADE UP EPIC GAMES HACK

A fake ransomware group called Mogilevich admitted to lying about hacking Fortnite maker Epic Games in an attempt to trick hackers into buying tools from them. The group claimed to have accessed Epic's data but later revealed they fabricated the incident to quickly gain visibility and scam victims through their trafficking scheme.

ign.com2 min read