TLDR INFORMATION SECURITY 2024-06-17

Join the Service Partner Program (takes <1 minute)

ASCENSION SAYS PERSONAL, HEALTH INFORMATION STOLEN IN RANSOMWARE ATTACK

US healthcare organization Ascension has revealed that a recent ransomware attack led to the theft of patient PII and PHI data. The attack disrupted Ascension's EHR, phone systems, and medical ordering, forcing patient diversions. While restoring systems, Ascension found attackers exfiltrated files from 7 of its 25,000 servers containing patient data.

PANERA WARNS OF EMPLOYEE DATA BREACH AFTER MARCH RANSOMWARE ATTACK

Panera Bread has notified employees of a data breach after attackers stole its data. It notified employees that information that they provided pursuant to their employment was breached, including social security numbers. Panera offered affected employees a year of CyEx Identity Theft Total.

NEW ARM 'TIKTAG' ATTACK IMPACTS GOOGLE CHROME, LINUX SYSTEMS

A new research called TIKTAG demonstrates attacks on ARM's Memory Tagging Extension (MTE) to leak data, impacting Google Chrome and Linux Systems. The attack exploits speculative execution to bypass security measures, potentially enabling memory corruption vulnerabilities. Researchers have proposed hardware modifications and code changes to mitigate TIKTAG attacks.

SIMPLIFY RISK AND COMPLIANCE ASSESSMENTS WITH THE NEW COMMON CONTROL LIBRARY IN AWS AUDIT MANAGER

AWS Audit Manager has added a new common control library that provides common controls with predefined and remapped AWS data sources. The common control library is based on external audits and supports multiple frameworks. A working example is included in the post.

DIRTY LITTLE SECRETS OF VULNERABILITY MANAGEMENT

This article explores some common misconceptions about vulnerability management and sheds light on why these make vulnerability management for open source software incredibly complex. It begins by discussing the difference between MITRE's position as secretariat of the CVE program vs the NVD's catalog before addressing why many CVEs that may have exploits available don't make it to CISA's KEV list. The article explains how EPSS scores work and how open source maintainers often skip reporting CVEs and instead only report to the GitHub Advisory Database, complicating matters.

ASSUMED BREACH: THE EVOLUTION OF OFFENSIVE SECURITY TESTING

TrustedSec elaborates on its new approach to red teaming and pentesting, which focuses on scenario-based breaches, as opposed to traditional internal pen tests, which focus mostly on physical intrusion-based scenarios whereby attackers plant a rogue device in the network. TrustedSec tests seven scenarios: SSO compromise, network pivot, endpoint compromise, perimeter compromise, DevOps, workstation compromise, and physical intrusion. The post includes a detailed description of the scenarios and testing methods.

your virtual seat

PYTE (PRODUCT LAUNCH)

Pyte's proprietary Secure Multiparty Computation (SMPC) technology makes it easy to run AI or ML computations on encrypted data without the need to move or decrypt the data.

HIJAGGER

Hijagger checks all maintainers of all npm and PyPi packages for hijackable packages through domain re-registration.

YETIHUNTER

YetiHunter is a tool for querying Snowflake environments for evidence of compromise based on IoCs from Permiso and the community.

ALLEGED BOSS OF ‘SCATTERED SPIDER' HACKING GROUP ARRESTED

A 22-year-old UK man arrested in Spain is allegedly the ringleader of the Scattered Spider cybercrime group behind hacks of Twilio, LastPass, DoorDash, Mailchimp, and others. He is accused of stealing data to access millions in funds. The man allegedly controlled $27 million in Bitcoin.

META PAUSES PLANS TO TRAIN AI USING EUROPEAN USERS' DATA, BOWING TO REGULATORY PRESSURE

Meta has paused plans to train its AI systems using data from EU and UK users following pushback from regulators. The Irish Data Protection Commission and the UK's ICO requested that Meta halt the initiative until concerns over compliance with GDPR privacy rules could be satisfied.

A NEW NORTH KOREAN GROUP EMERGES, DISRUPTING THE OPEN SOURCE ECOSYSTEM

A new North Korean threat actor named Moonstone Sleet has emerged. The group is targeting the open-source ecosystem with malicious npm packages. Its tactics mirror those of other North Korean groups, posing a constant threat to developers. Collaboration and vigilance are key to safeguarding the open-source community against these risks.

FORMER HEAD OF NSA JOINS OPENAI BOARD

OpenAI has appointed former NSA director Paul M. Nakasone, who led the NSA until February 2023, to its board of directors.

PROTECT AI'S JUNE 2024 VULNERABILITY REPORT

This report highlights 32 security defects reported as part of its bug bounty program.

MICROSOFT: NEW OUTLOOK SECURITY CHANGES COMING TO PERSONAL ACCOUNTS

Microsoft is making security changes to Outlook personal email accounts, phasing out basic authentication by September 16.