TLDR INFORMATION SECURITY 2024-06-05

2️⃣ Learn more about Orca's CNAPP

3️⃣ Get a live demo

COX FIXED AN API AUTH BYPASS EXPOSING MILLIONS OF MODEMS TO ATTACKS

Bug bounty hunter Sam Curry discovered an API authentication bypass in Cox Communications' systems that could give attackers the same permissions as a tech support agent for the ISP. Attackers could use the bypass to obtain the PII of customers, reset modems, or gather WiFi information. Cox took the 700 exposed API endpoints down within hours of the report and fixed the issue the following day. It has found no evidence of exploitation.

MAJOR CYBERATTACK SEES NHS LONDON HOSPITALS DECLARE CRITICAL INCIDENT WITH OPERATIONS CANCELED

Two London hospital trusts were forced to cancel non-emergency operations and blood tests due to a major ransomware cyberattack on Synnovis, the company supplying pathology services to hospitals across six boroughs. The attack affected tens of thousands of NHS patients.

ZYXEL ISSUES EMERGENCY PATCH FOR END-OF-LIFE NAS DEVICES

Zyxel Networks has released a patch to address 3 critical vulnerabilities on older NAS devices. The vulnerabilities allowed for remote code execution. However, two flaws that could lead to information disclosure and privilege escalation were not fixed. Zyxel released these patches even though the devices have reached end-of-life as they were of critical severity and proof-of-concept exploits exist.

PHISHING WITH CLOUDFLARE WORKERS: TRANSPARENT PHISHING AND HTML SMUGGLING

Netskope Threat Labs is tracking two common phishing techniques that have been observed in phishing campaigns that utilize Cloudflare Workers. Attackers are utilizing Cloudflare Workers to deliver an encoded blob, which is reconstructed on the client to execute HTML smuggling attacks. Attackers are also utilizing Cloudflare Workers for transparent phishing attacks, creating MitM channels where attackers can intercept victims' credentials and MFA while relaying them to a destination server.

SOPHISTICATED RAT TARGETING GULP PROJECTS ON NPM

SECURING THE BUILDING BLOCKS: A DEEP DIVE INTO DEPENDENCY SECURITY

Choosing secure dependencies for your project to prevent security risks is important. Delete unused dependencies and vet the trustworthiness of the ones you use. Developers need to regularly scan and update dependencies to address any vulnerabilities.

APPTEGA

Apptega is a full-lifecycle compliance platform that gives MSSP providers the ability to build and manage cybersecurity and compliance programs. It delivers continuous compliance offerings and standardizes and validates existing services.

PROWLER

Prowler is an Open Source Security tool for AWS, Azure, GCP, and Kubernetes for performing security assessments, audits, incident response, compliance, continuous monitoring, hardening, and forensics readiness. It includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS, and more

AWESOME CI/CD ATTACKS

A curated list of techniques and tools for attacking and defending CI/CD pipelines.

LEAKED GOOGLE DATABASE REVEALS ITS SECRET PRIVACY AND SECURITY FAILURES

404 Media obtained a leak of internal Google privacy cases from 2013-2018. The leak provides insight into how Google manages privacy flags and the volume that it receives. Google has confirmed the authenticity of the leak but stressed that each flag was investigated and resolved.

MICROSOFT HIT WITH EU PRIVACY COMPLAINTS OVER SCHOOLS' USE OF 365 EDUCATION SUITE

A privacy rights non-profit has lodged two complaints against Microsoft with Austria's data protection authority over the use of Microsoft 365 Education by schools. The complaints raise concerns about the lack of transparency and legal basis for processing minors' data, which potentially violates GDPR's stringent requirements for protecting children's data.

CROOKS THREATEN TO LEAK 3B PERSONAL RECORDS 'STOLEN FROM BACKGROUND CHECK FIRM'

A criminal gang claimed to have obtained a massive database of 2.9 billion personal records on US, Canadian, and British citizens from a Florida firm handling background checks. The database allegedly contains sensitive information like full names, addresses, social security numbers, and details of relatives. The gang is planning to leak the 277GB of data.

HIGH-RISK ATLASSIAN CONFLUENCE RCE FIXED, POC AVAILABLE (CVE-2024-21683)

CVE-2024-21683 is a remote code execution vulnerability in the Confluence Server and Data Center that allows an authenticated attacker with high privileges to execute malicious Java code.

FCC VOTE ON TAP FOR RULES TO SECURE FUNDAMENTAL COMPONENT OF THE INTERNET

The FCC is considering a rule to enhance security for a vital part of the internet known as the Border Gateway Protocol.

DATA FIRM EXECS CONVICTED FOR HELPING FRAUDSTERS TARGET THE ELDERLY

Two former executives of Epsilon Data Management LLC were convicted of selling consumer data to fraudsters for over a decade.