Sponsored
MISCONFIGURATIONS IN GITHUB AND GITLAB
'Shift Left Security' doesn't end with code. Misconfigurations in source code management [4] (SCM) platforms like GitHub can be a serious problem. For example:
orca.securitySponsor
TLDR INFORMATION SECURITY 2024-06-28
6 sections16 entrieslinks blockcomplete parse
Parse notes
- Subscription/account footer truncated before parsefooter_truncated
01GENERAL
02ATTACKS & VULNERABILITIES
FRESH MOVEIT BUG UNDER ATTACK MERE HOURS AFTER DISCLOSURE
A new vulnerability affecting the SFTP module of MOVEit's software has been disclosed. With a CVSS score of 7.4, the vulnerability allows attackers to perform a forced authentication attack or upload an SSH public key to impersonate users without authentication. The vulnerability is under active exploitation.
darkreading.com2 min read
OLLAMA PATCHES REMOTE EXECUTION VULNERABILITY
Ollama recently fixed a vulnerability discovered by Wiz that could result in path traversal. The vulnerability exploits the lack of input validation in the /api/pull endpoint of the Ollama servers by using a specially crafted request to overwrite arbitrary files on the host system. Wiz's researchers note that there are still publicly exposed Ollama servers that are vulnerable to this flaw.
siliconangle.com2 min read
SOUTH KOREAN TELECOM COMPANY ATTACKS CUSTOMERS WITH MALWARE
A South Korean telecom company infected over 600,000 users with malware for using torrent services. The malware caused missing files, created strange folders, and disabled PCs. Police identified and charged individuals connected to the attack. Investigations are still ongoing.
tomshardware.com3 min read
03STRATEGIES & TACTICS
TALES FROM THE CLOUD TRENCHES: RAIDING FOR AWS VAULTS, BUCKETS, AND SECRETS
This blog post examines behavior from an attacker that Datadog saw in several customer environments. The attacker probed for S3 buckets and AWS Secrets Manager secrets, which is common but also, less commonly, probed for Glacier vaults. In all cases, the attacker did not take follow on actions. The attacker also signed their AWS API requests manually as opposed to using a library such as boto3, which handles signing.
securitylabs.datadoghq.com6 min read
WHY ARE HMAC KEYS CONSIDERED UNAUDITABLE AND UNMANAGEABLE IN GOOGLE CLOUD?
This blog post describes how Google Cloud HMAC keys have vulnerabilities related to logging, management, and auditing. Users can create unlimited HMAC keys without proper oversight or control. These issues could lead to security risks and challenges for administrators in Google Cloud.
vectra.ai6 min read
AUTOMATED LLM BUGFINDERS
This blog post was written as a response to Google Project Zero's naptime LLM tool and proposes an alternative approach to building automated bug finders. Different approaches, such as the Catalyst-AI Reasoning Module, aim to enhance LLMs' effectiveness in detecting bugs by utilizing specific prompts and tools.
cybersecpolitics.blogspot.com6 min read
04LAUNCHES & TOOLS
FUZZ MAP
Fuzz Map is a fuzzer for GUIs that automatically identifies states using code coverage and builds a visual map. The page includes an interactive demo.
fuzzmap.ioGitHub repository
CLOUD COMMOTION
Cloud Commotion is a tool that deploys deliberately vulnerable infrastructure using Terraform for alerting capabilities testing.
github.comGitHub repository
WHISPERS
Whispers is an information security analysis tool designed for identifying hardcoded secrets in structured text and static code.
github.comGitHub repository
05MISCELLANEOUS
CISA, JCDC, GOVERNMENT, AND INDUSTRY PARTNERS CONDUCT AI TABLETOP EXERCISE
The Joint Cyber Defense Collaborative organized a 4 hour tabletop exercise with government and AI industry experts. The goal of the exercise was to spearhead the development of an AI Security Incident Collaboration Playbook by JCDC. The exercise simulated an incident involving an AI-enabled system. Participants worked through operational collaboration and information sharing protocols for incident response.
cisa.gov5 min read
CHAMELGANG & FRIENDS | CYBERESPIONAGE GROUPS ATTACKING CRITICAL INFRASTRUCTURE WITH RANSOMWARE
Cyberespionage groups are using ransomware for financial gain and to disrupt critical infrastructure. ChamelGang, a suspected Chinese APT group, targeted institutions in India and Brazil with ransomware. BestCrypt and BitLocker were also used in ransomware attacks affecting organizations in North America, South America, and Europe.
sentinelone.com3 min read
LOCKBIT GROUP WRONGLY CLAIMED THE HACK OF THE FEDERAL RESERVE
The LockBit ransomware group falsely claimed to have hacked the US Federal Reserve. The real victim was Evolve Bank & Trust. Evolve Bank & Trust confirmed a security breach that involved leaked personal information and is conducting an investigation. The incident has been contained, and affected customers will be directly contacted.
securityaffairs.com3 min read
06QUICK LINKS
CRITICAL GITLAB BUG LETS ATTACKERS RUN PIPELINES AS ANY USER
A critical vulnerability in GitLab allows attackers to run pipelines as any user.
bleepingcomputer.com2 min read
POLYFILL CLAIMS IT HAS BEEN 'DEFAMED', RETURNS AFTER DOMAIN SHUT DOWN
The Polyfill service, which was found to be serving malware, claims it has been defamed and has relaunched on a new domain.
bleepingcomputer.com3 min read
MICROSOFT SAYS MORE CUSTOMER EMAILS ACCESSED BY RUSSIAN HACKERS
Microsoft disclosed that Russian hackers accessed more customer emails than previously known, including those of senior leadership and government agencies.
links.tldrnewsletter.com2 min read