TLDR INFORMATION SECURITY 2024-03-08

VMWARE SANDBOX ESCAPE BUGS ARE SO CRITICAL, PATCHES HAVE BEEN RELEASED FOR END-OF-LIFE PRODUCTS

VMware is urging customers to patch critical vulnerabilities that allow hackers to escape VMware's sandbox and hypervisor protections across all versions of ESXi, Workstation, Fusion, and Cloud Foundation products. The four flaws, with two rated at a 9.3/10 severity, undermine the products' core purpose of running sensitive operations inside a virtual machine segmented from the host machine.

APPLE FIXES TWO NEW IOS ZERO-DAYS EXPLOITED IN ATTACKS ON IPHONES

Apple has released fixes for two new iOS and iPadOS vulnerabilities. The first vulnerability is in the iOS Kernel and the second is in RTKit. Both vulnerabilities allow attackers with arbitrary kernel read and write permissions to bypass kernel memory permissions.

WOGRAT MALWARE ABUSES ONLINE NOTEPAD SERVICES TO STORE MALWARE

A new malware strain that targets both Windows and Linux is being distributed as a base64 encoded payload from the aNotepad service. The WogRAT malware on Windows is loaded as a DLL and communicates with C2 servers via POST requests to receive commands for uploading and downloading files, waiting, running arbitrary commands, and terminating. The Linux version behaves similarly except that it uses a TinySHell backdoor to communicate with the C2 server over a reverse shell.

FROM CYBERCRIME TO CYBERSECURITY: THE REDEMPTION AND REVOLUTION OF THE FOUNDER OF HIVE FORENSICS

This interview delves into the extraordinary journey of Sam Paniagua, founder of fraud prevention firm Hive Forensics. An unconventional path, Paniagua's story is one of transformation, redemption, and unwavering determination in using cybersecurity innovation to safeguard dreams, livelihoods, and digital society's foundations.

HOW TO HUNT FOR UEFI MALWARE USING VELOCIRAPTOR

UEFI attacks, which require advanced techniques, are becoming more prevalent. This article begins with an overview of the UEFI system and common attacks on UEFI malware. It then works through Rapid7’s Velociraptor tool’s capabilities for performing forensic investigations on UEFI malware-infected systems.

MEET SILVER SAML: GOLDEN SAML IN THE CLOUD

Golden SAML is a post-exploitation attack technique that involves extracting signing certificates from Active Directory Federation Services to forge signing certificates. In the wake of the Solar Winds attack, organizations were urged to move to a cloud-based SAML like Entra ID to prevent Golden SAML attacks. This post presents a new attack method that leverages externally generated SAML certificates to forge authentication responses from an Entra ID SAML server.

Try Veracode DAST free for 14 days

BREADLOG

Breadlog maintains stable, unique references to log messages in your source code. This helps you identify application events from log messages using numerical IDs that stay the same even when a log message's content changes. No brittle or complex text parsing required.

SYZKALLER

syzkaller is an unsupervised coverage-guided kernel fuzzer.

BADGERBOARD

Badgerboard is an open source example implementation of a hardware/software solution that can lift traffic from a Schneider Electric X80 backplane into "normal" network traffic to be inspected and acted upon by various network visibility security solutions, such as Snort. This repository includes a link to a blog post with more details on what the hardware and software setup looks like.

HOW CISA FIGHTS CYBER THREATS DURING ELECTION PRIMARY SEASON

CISA has set up an Election Operations Center to coordinate threat responses for the 2024 primaries and elections, providing cybersecurity training, guidelines, and a Protect2024 website with resources for state officials. No credible threats have been detected yet. CISA is focused on potential DDoS, ransomware, and emerging AI risks to secure the electoral process.

JAPAN ORDERS LOCAL GIANTS LINE AND NAVER TO DISENTANGLE THEIR TECH STACKS

Japan ordered messaging app LINE and its parent company NAVER to separate their tech stacks after a data breach exposed over 510,000 users' data. The government cited deep entanglements between the companies' systems and authentication services that enabled unauthorized access. They must now implement their own authentication tools and minimize interconnections.

NSA RELEASES MATURITY GUIDANCE FOR THE ZERO TRUST NETWORK AND ENVIRONMENT PILLAR

The NSA has released a Cybersecurity information sheet that provides guidance on how to strengthen internal network control and contain network intrusions to a segmented portion of the network using Zero Trust principles. It is assisting DoD customers in piloting Zero Trust systems and is developing additional guidance for incorporating Zero Trust principles and designs into enterprise networks.

WORLDCOIN HIT WITH TEMPORARY BAN IN SPAIN OVER PRIVACY CONCERNS

Spain’s data protection authority has ordered Worldcoin to temporarily stop collecting and processing personal data from the market.

FLIPPER ZERO WIFI ATTACK CAN UNLOCK AND STEAL TESLA CARS

Security researchers report that Flipper Zero devices can be used to execute an easy phishing attack that can compromise Tesla accounts and unlock and steal cars.

FBI: U.S. LOST RECORD $12.5 BILLION TO ONLINE CRIME IN 2023

The FBI's Internet Crime Complaint Center (IC3) reported a record $12.5 billion in online crime losses in 2023, a 22% increase from the previous year, with 880,000 complaints received.