TLDR INFORMATION SECURITY 2024-05-31

Register for free to save your spot

MYSTERY MALWARE DESTROYS 600,000 ROUTERS FROM A SINGLE ISP DURING 72-HOUR SPAN

Last October, there was an incident where over 600,000 routers belonging to an unnamed ISP were permanently bricked by malware over 72 hours. The malware, known as Chalubo, executed custom code that overwrote router firmware, rendering ActionTec T3200 models unusable with a red light.

DATA BREACH EXPOSES DETAILS OF 25K CURRENT AND FORMER BBC EMPLOYEES

The BBC's pension scheme notified 25K current and former employees that their personal data had been exposed in a breach. The notification did not include details of how the breach occurred other than that the data had been copied from an online data storage service. Exposed information includes dates of birth, home addresses, and national insurance numbers, but does not include financial information.

COOLER MASTER HIT BY DATA BREACH EXPOSING 500K CUSTOMERS' INFORMATION

A threat actor called Ghostr claimed to have stolen 103 GB of data from Cooler Master including corporate, vendor, sales, warranty, inventory, and HR data as well as 500K fanzone members' information. The threat actor claims that the fanzone information includes names, addresses, dates of birth, phone numbers, emails, and unencrypted credit card information. Data samples did not confirm whether credit card information was stolen.

COVERAGE GUIDES FUZZING - EXTENDING INSTRUMENTATION TO HUNT DOWN BUGS FASTER

Coverage guided fuzzing is a technique used by some fuzzers to determine if a fuzzing input will discover a new edge. This article walks through the process of modifying the Fuzzli fuzzer to find a known vulnerability in JerryScript. The article also contains instructions to set up an environment to replicate the findings.

THE BEST WAY TO START WITH AWS SECURITY HUB

A lab from Rich Mogull's Cloud Security Lab A Week series on using AWS Security Hub. Security Hub is a unified view of various AWS security services across all regions and accounts in an organization. Mogull goes over the steps of setting up AWS Security Hub to act as a CSPM.

HOW MALWARE AUTHORS PLAY WITH THE LNK FILE FORMAT

Malware authors are utilizing LNK files as a malware delivery mechanism now that Microsoft is deprecating Macros. This blog post goes into detail on various techniques that are used by the malware authors like running minimized, executing other binaries as well as icon smuggling. The post contains links for defenders to use for analyzing LNK files.

ZENDATA

Zendata is a no-code platform that provides data usage insights and controls to address risks and maintain compliance, particularly when it comes to the use of AI.

PDNSSOC

pDNSSOC is a toolset that leverages MISP indicators via a pDNS-based infrastructure to act as a poor man's SOC.

AWESOME DETECTION ENGINEERING

A collection of resources on the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity

EURO COPS DISRUPT MALWARE DROPPERS, SEIZE THOUSANDS OF DOMAINS

An international law enforcement operation led by Europol named Operation Endgame resulted in multiple arrests, searches, seizures, and takedowns targeting malware droppers and their operators. The coordinated action across several countries, described as the largest-ever crackdown on botnets used for ransomware deployment, disrupted the operations of notorious droppers like IcedID, Bumblebee, SystemBC, Pikabot, Smokeloader, and Trickbot.

MOONSTONE SLEET EMERGES AS NEW NORTH KOREAN THREAT ACTOR WITH NEW BAG OF TRICKS

Microsoft has identified a new North Korean threat group called Moonstone Sleet that employs a combination of traditional and unique attack methods. Notable techniques the group uses include creating fake companies and job postings, using trojanized tools, and developing a fully functional malicious game called DETANKWAR.

RESEARCHERS HELP RECOVER $3M IN LOST BITCOIN

Two hackers helped recover funds in a Trezor wallet that an owner had lost the password to. The owner had created the password using the RoboForm password manager in 2013. The hackers exploited a known vulnerability in RoboForm to recover the wallet. A video demonstrating the hack is included in the article.

NIST AWARDS ADDITIONAL FUNDING TO NATIONAL VULNERABILITY DATABASE

NIST has said that it will be receiving outside help to get the National Vulnerability Database (NVD) back on track within the next few months.

OKTA WARNS USERS TO BE AWARE OF DAMAGING CYBERATTACKS TARGETING CUSTOMERS

Okta warned customers of an ongoing credential stuffing attack targeting its Customer Identity Cloud (CIC) tool, advising users to either disable the cross-origin authentication feature being abused or implement recommended mitigations.

TICKETMASTER HIT WITH CLASS ACTION SUIT OVER MASSIVE DATA BREACH

A class action lawsuit has been filed against Ticketmaster for a massive data breach affecting millions of consumers.