TLDR INFORMATION SECURITY 2024-06-03

THREAT ACTOR COMPROMISING SNOWFLAKE DATABASE CUSTOMERS

A campaign by threat actors to use stolen credentials to breach Snowflake databases that do not have MFA or 2FA enabled has been reported. The threat actor is using custom tooling for the Snowflake environment to carry out theft and extortion operations. It is believed that there hasn't been any compromise of Snowflake's internal systems.

LIVE NATION TOOK 11 DAYS TO CONFIRM THE MASSIVE TICKETMASTER DATA BREACH

Live Nation Entertainment acknowledged a data breach in a regulatory filing after an individual claimed to be selling data on 560 million Ticketmaster customers on hacking forums for $500,000. The breach involved unauthorized access to a third-party cloud database containing customer data like names, addresses, and credit card details.

HUGGING FACE SAYS IT DETECTED ‘UNAUTHORIZED ACCESS' TO ITS AI MODEL HOSTING PLATFORM

Hugging Face disclosed late Friday that its security team detected unauthorized access to Spaces, its platform for sharing and hosting AI models, earlier in the week. The intrusion involved potential access to private "secrets" used as keys to protected resources. As a precaution, Hugging Face revoked numerous tokens and recommended users refresh keys and switch to more secure access tokens.

SERVER-SIDE REQUEST FORGERY (SSRF) LAB

This post explains what server-side request forgery (SSRF) is and describes some common examples while walking through a PortSwigger Lab. It also demonstrates how to identify and exploit SSRF vulnerabilities.

CREDENTIALS LEAKING WITH SUBDOMAIN TAKEOVER

Truffle Security's team provides a deep dive into how localStorage can be abused in a subdomain takeover. They discovered a subdomain takeover vulnerability on Readme.io that could allow an attacker to compromise any credentials entered in the original or compromised page. The Readme team originally did not intend to fix the issue so Truffle Security created custom domains for 600 vulnerable companies and contacted them directly.

NON-PRODUCTION ENDPOINTS AS AN ATTACK SURFACE IN AWS

The Datadog Security team discovered a new method for AWS privilege enumeration that can bypass CloudTrail logging. The method involves querying ce:GetCostAndUsage and route53resolver:ListFirewallConfigs for access to various other resources. The AWS team has fixed the specific bypasses and worked with the Datadog team to identify additional potential attack vectors.

the webinar here!

SECRETGEN-CONTROLLER

secretgen-controller provides Custom Resource Definitions (CRDs) to specify which secrets need to be generated on a Kubernetes cluster. It supports generating secrets, exporting and importing secrets, registry secrets across namespaces, and generating secrets from data residing in other Kubernetes resources.

STORMSPOTTER

Stormspotter is a red team tool for graphing and visualizing Azure and Azure AD objects.

C/SIDE (PRODUCT LAUNCH)

C/side provides tools for monitoring, optimizing, and securing third-party scripts in browsers to keep users safe from vulnerabilities and zero-day attacks.

JAPANESE CRYPTO EXCHANGE DMM BITCOIN SUFFERS $305M HACK

Japanese cryptocurrency exchange DMM Bitcoin disclosed a major hack resulting in the loss of 48 billion yen ($305 million) worth of bitcoin, with 4,502.9 BTC stolen. The hacker split the funds across 10 wallets. DMM halted spot buys and warned of delayed yen withdrawals. It vowed to compensate the lost bitcoin with group company support to guarantee the full amount.

NETFLIX PAID OUT OVER $1 MILLION VIA BUG BOUNTY PROGRAM

Netflix announced that it has paid out over $1 million in bug bounties since launching its program in 2016. Over 5,600 researchers have contributed nearly 8,000 vulnerability reports, with 845 rewarded, including over 25% critical or high severity.

INTRODUCING ARTIFACT ATTESTATION

The OpenSSF and GitHub have launched Artifact Attestations to allow for generating SigStore artifact attestations but adding a GitHub action to configure the signature without the need to manage a PKI infrastructure. The signatures utilize the OpenSSF's PKI infrastructure and can be verified using the GitHub CLI. Integrations with Kubernetes and other providers are planned.

BEWARE: FAKE BROWSER UPDATES DELIVER BITRAT AND LUMMA STEALER MALWARE

Fake browser updates are being used to spread malware like BitRAT and Lumma Stealer.

THE NSA ADVISES YOU TO TURN YOUR PHONE OFF AND BACK ON ONCE A WEEK - HERE'S WHY

The NSA recommends turning your phone off and back on weekly to protect against security threats like malware and spyware.

POLICE DISMANTLE PIRATED TV STREAMING NETWORK THAT MADE $5.7 MILLION

Spanish police dismantled a network that made $5.7 million from illegal TV streaming by arresting 8 individuals and taking the servers offline.