TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-04-03

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

FIRST SOC 2? WE GOT YOU.

With a pre-mapped SOC 2 framework, Drata gives you everything you need to get and stay SOC 2 compliant.

try.drata.comSponsor

02ATTACKS & VULNERABILITIES

SHOPPING PLATFORM PANDABUY DATA LEAK IMPACTS 1.3 MILLION USERS

A data breach at PandaBuy, an online shopping platform, has exposed the personal information of over 1.3 million customers. Two threat actors allegedly exploited multiple vulnerabilities to gain access. The leaked data includes usernames, names, phone numbers, emails, IP addresses, order details, addresses, and more.

bleepingcomputer.com3 min read

SHADOWRAY: FIRST KNOWN ATTACK CAMPAIGN TARGETING AI WORKLOADS ACTIVELY EXPLOITED

This article provides a deep dive into a new critical vulnerability in the open-source AI framework Ray. The vulnerability is due to a lack of authorization in the Jobs API that is disputed and thus unpatched. The article goes in-depth into the framework, the vulnerability, the IoCs, and the impact of exploitation.

oligo.security12 min read

OMNI HOTELS EXPERIENCING NATIONWIDE IT OUTAGE

Omni Hotels has been experiencing a widespread outage affecting its reservation, hotel room door lock, and point of sale systems since Friday. All locations are open and accepting new customers but front desk employees have been experiencing widespread issues. Omni Hotels hasn't released any details on the cause, but internal IT employees have said that services are being built from scratch.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

SECURITY CODE CHALLENGE FOR DEVELOPERS & ETHICAL HACKERS – THE DAMN VULNERABLE RESTAURANT

Damn Vulnerable RESTaurant is an intentionally vulnerable API service designed as a learning and training platform for developers, ethical hackers, and security engineers. It covers popular API vulnerabilities, including OWASP Top 10 API Security Risks, providing an interactive environment to identify and fix vulnerabilities, exploit them manually or through automation tools, and test security mechanisms.

devsec-blog.com10 min read

MALICIOUS XZ BACKDOOR REVEALS FRAGILITY OF OPEN SOURCE

The backdoor in the widely-used open-source xz compression library could have led to a significant security disaster had it not been fortuitously detected by a curious Microsoft engineer investigating latency issues. This near-miss scenario has raised alarms about the potential for similar undetected compromises in software infrastructure. This post analyzes the current state of open source software.

theregister.com7 min read

USING TAILSCALE FOR PERSISTENCE

This post details a method that uses Tailscale to establish a C2 on a Kubernetes node. In this scenario, an attacker has obtained time limited cluster-admin credentials and wants to utilize those credentials to establish persistence. The described attack involves deploying Tailscale on the node via containerd or a static manifest and utilizing Tailscale ACLs to only allow communication from C2 controller nodes to the infected bot nodes.

raesene.github.io5 min read

04LAUNCHES & TOOLS

Sponsored

🆕 CYREBRO AND GOOGLE CLOUD INTRODUCE: PRECISION-GUIDED DETECTION

Security professionals know the struggle: an endless stream of alerts, limited resources, and the constant fear of missing critical threats. CYREBRO collaborated with Google Cloud to enhance its Managed Detection and Response solution [11] and tackle these challenges. Built on Google Cloud’s big data and machine learning capabilities, CYREBRO’s new security data lake and detection engine ingest vast amounts of security data, separating the signal from the noise. The enhanced MDR solution focuses on the most relevant threats, shortens MTTD and reduces false positives, to minimize business risk. Learn more about CYREBRO’s Precision-Guided Detection [11].

cyrebro.ioSponsor

ZAFRAN (PRODUCT LAUNCH)

Zafran connects to both vulnerability data and the organization’s security controls. It analyzes risk while taking into account controls’ efficacy as well as exploitability factors.

zafran.io

SNYK MAVEN PLUGIN

Snyk Maven Plugin tests and monitors Maven dependencies for vulnerabilities.

github.comGitHub repository

TRAILDISCOVER

TrailDiscover is an evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real world incidents, references, and security implications.

github.comGitHub repository

05MISCELLANEOUS

GOOGLE AGREES TO DESTROY BROWSING DATA COLLECTED IN INCOGNITO MODE

Google agreed to a proposed $5 billion class-action settlement requiring it to destroy or de-identify billions of web browsing data records collected from users in "Incognito mode," mandate better disclosures about data collection in Incognito, and impose limits on future data gathering. If approved, the settlement could apply to 136 million Google users who accused the company of illegally tracking their private browsing behavior.

bit.ly3 min read

OWASP DATA BREACH CAUSED BY SERVER MISCONFIGURATION

The OWASP Foundation announced a data breach exposing personal information provided by aspiring members in resumes submitted between 2006 and 2014 as part of the old membership process. The breach, caused by a misconfiguration on OWASP's old wiki server, compromised names, addresses, phone numbers, email addresses, and other identifiable information of tens of thousands of members from the non-profit software security community organization.

securityweek.com3 min read

THE EFFICIENT SECURITY PRINCIPLE

The Efficient Security Principle is essentially that security is only as good as it needs to be to keep people using the service. This post provides guidance to security practitioners and leaders on how to utilize this principle.

danielmiessler.com4 min read