TLDR INFORMATION SECURITY 2024-05-10

Spots are limited — register today

ASCENSION HEALTHCARE TAKES SYSTEMS OFFLINE AFTER CYBERATTACK

Private healthcare system Ascension reports that it has taken some systems offline to investigate a suspected cyberattack. Ascension has advised all partners to sever connections to its networks and has retained Mandiant for incident response. Clinical operations have also been impacted due to the attack.

UNIVERSITY SYSTEMS OF GEORGIA ADMITS MOVEIT ATTACK HIT DATA OF 800K PEOPLE

The University Systems of Georgia, which administers 26 higher education institutions in the state, sent a letter to 800k victims disclosing that it was a victim of several breaches by the Cl0p gang's campaign. The data obtained may include full SSNs, the last four digits of SSNs, dates of birth, bank account numbers, federal tax documents, and driver's licenses. USG reports that the data will likely be published and offered victims 13 months of credit monitoring.

DELL WARNS OF DATA BREACH, 49 MILLION CUSTOMERS ALLEGEDLY AFFECTED

Dell has warned customers of a data breach affecting 49 million people. The stolen information includes customer names, addresses, and purchase details, but not financial data. Customers should be cautious of potential targeted attacks and verify communications from Dell directly.

LLM PENTEST: LEVERAGING AGENT INTEGRATION FOR RCE

ADVANCING EMERGENCY RESPONSE SECURITY WITH AUTONOMOUS PENTESTING

Horizon3.ai's customer story highlights the implementation of autonomous pentesting to advance security in emergency response sectors, particularly 911 call centers. Utilizing its NodeZero platform, Horizon3.ai enables organizations to perform continuous security assessments, identifying vulnerabilities and enhancing defenses against cyber threats.

EVERYDAY GHIDRA: SYMBOLS — PRESCRIPTION LENSES FOR REVERSE ENGINEERS — PART 1

This blog post discusses the use of symbols in Ghidra for reverse engineering tasks. It emphasizes how symbols help clarify disassembled code by providing human-readable identifiers like function names, prototypes, and data types. This aids in transforming obscure assembly code into more understandable formats, similar to high-level programming languages. The post explains how symbols are extracted from binary exports and imports and their significance in making the reverse engineering process more intuitive and efficient.

KUBE NO TROUBLE

Kubent is a tool to check if a Kubernetes cluster is using deprecated APIs. It can be run in CI/CD pipelines or manually.

AWS SCP TO DENY FINANCIAL AGREEMENTS AND LONG-TERM RESERVATIONS

An SCP to prevent a member account from entering into long-term financial agreements or reservations.

BURPSCRIPT

BurpScript adds dynamic scripting abilities to Burp Suite, allowing you to write scripts in Python or Javascript to manipulate HTTP requests and responses.

ZSCALER TEST ENVIRONMENT EXPOSED

Zscaler has published a security update following posts on X that an isolated test environment on a server was unintentionally exposed. Zscaler has confirmed that there was no impact or compromise to customer, production, or corporate environments.

AMAZON ROUTE 53 RESOLVER DNS FIREWALL NOW SUPPORTS DOMAIN REDIRECTION

AWS has added the ability to enable Route 53 Resolver DNS Firewall to automatically skip the inspection of domains included in a redirection chain. Prior to this feature, all CNAMEs in a domain redirection chain would have to be explicitly allow-listed.

MINECRAFT SOURCE PACK BECOMES GATEWAY FOR ZEUS STEALER DISTRIBUTION

Fortinet's FortiGuard Labs has discovered that a dangerous malware called zEus stealer is being spread through a Minecraft source pack, targeting Windows users and stealing sensitive data like IP addresses and browser information. The malware cleverly disguises itself as a screensaver file to evade detection and maintains control over infected systems through auto-run entries and a command-and-control script. Users are urged to use MFA, download files from trustworthy sources, and be cautious when downloading custom game mods to protect against threats like zEus.

TIKTOK IS SUING THE U.S. GOVERNMENT TO STOP ITS APP BEING BANNED

TikTok has filed a lengthy lawsuit against the U.S. government arguing that the TikTok ban is unconstitutional and violates users' First Amendment rights.

MONDAY.COM REMOVES "SHARE UPDATE" FEATURE ABUSED FOR PHISHING ATTACKS

Monday.com removed its "Share Update" feature due to phishing attacks because it allowed users to send emails impersonating Monday.com.

FBI WARNS US RETAILERS THAT HACKERS ARE TARGETING THEIR GIFT CARD SYSTEMS

The FBI has issued a warning to US retailers about cybercriminals targeting gift card systems through phishing attacks on employees.