TLDR InfoSecJuly 8, 2024

TLDR INFORMATION SECURITY 2024-07-08

6 sections16 entrieslinks blockcomplete parse

Parse notes

Subscription/account footer truncated before parsefooter_truncated

01GENERAL

TESTING — AND COSTS 50% LESS

Does your network have vulnerabilities hackers can exploit? If you're not network pentesting, you're not going to know.

vonahi.ioSponsor

02ATTACKS & VULNERABILITIES

ALABAMA STATE DEPARTMENT OF EDUCATION SUFFERED A DATA BREACH FOLLOWING A BLOCKED ATTACK

The Alabama State Department of Education stopped a ransomware attack on June 17, but some data was accessed and services disrupted. Parents and education employees are advised to monitor their credit, as student and employee data may have been compromised.

securityaffairs.com2 min read

ROLL20, AN ONLINE TABLETOP ROLE-PLAYING GAME PLATFORM, DISCLOSES DATA BREACH

Roll20 announced a data breach on June 29 where a hacker accessed its administrative website for an hour. The breach potentially exposed users' personal information including names, email addresses, partial credit card numbers, and IP addresses.

techcrunch.com3 min read

APACHE FIXED A SOURCE CODE DISCLOSURE FLAW IN APACHE HTTP SERVER

The Apache Foundation fixed a critical vulnerability (CVE-2024-39884) in its Apache HTTP Server related to source code disclosure. The vulnerability could lead to unauthorized access and remote code execution issues. Users are advised to update to version 2.4.61 to address these security concerns.

securityaffairs.com1 min read

03STRATEGIES & TACTICS

JULY 2: POLYFILL.IO SUPPLY CHAIN ATTACK – DIGGING INTO THE WEB OF COMPROMISED DOMAINS

This post dives into a supply chain attack on the JavaScript library Polyfill.io that affected over 384,000 hosts, including major websites. While the immediate threat has been mitigated, experts advise removing all references to Polyfill.io.

censys.com10 min read

CATCHING COMPROMISED COOKIES

This post details how Slack detects compromised session cookies to prevent session hijacking. Slack Initially attempted to build its system by looking at the last accessed timestamp of a particular cookie to determine session forking but quickly determined that this led to a lot of false positives and added more information such as the IP address. The post also examines how performance concerns were mitigated and the rollout procedure.

slack.engineering10 min read

EXPLOITING CLIENT-SIDE PATH TRAVERSAL TO PERFORM CROSS-SITE REQUEST FORGERY

A group of researchers have discovered a method that utilizes Client-Side Path Traversal (CSPT) to achieve Cross-Site Request Forgery (CSRF). CSPT vulnerabilities have historically been viewed as low severity due to limited impact. This research shows that an attacker could utilize a CSPT vulnerability to chain a CSRF vulnerability and execute actions on behalf of an end user to a web application. The post includes examples of how CSPTs can be utilized to cause CSRF such as by using an open redirect to leak sensitive data associated with the source.

blog.doyensec.com5 min read

04LAUNCHES & TOOLS

GETREAL LABS

GetReal Labs provides real-time detection and deep understanding of deep fakes and supports forensic analysis.

getreallabs.comTool

BBOT

A recursive internet scanner for hackers.

github.comGitHub repository

IMAGE AUTOMATION CONTROLLER

A GitOps controller that patches container image tags in Git.

github.comGitHub repository

05MISCELLANEOUS

MICROSOFT'S MIDNIGHT BLIZZARD SOURCE CODE BREACH ALSO IMPACTED FEDERAL AGENCIES

Microsoft notified the US Department of Veterans Affairs and other agencies about potential impacts from the "Midnight Blizzard" Russian hacking group's breach. The VA department reported a brief unauthorized access to a test environment. While some agencies' data may have been stolen, sensitive information was reportedly not compromised.

theverge.com3 min read

HACKERS LEAK ALLEGED TAYLOR SWIFT TICKETS, AMP UP TICKETMASTER EXTORTION

Hackers have allegedly leaked Taylor Swift concert ticket data and demanded $2 million from Ticketmaster in an attack that seems to be attributable to the Snowflake breach. The data breach involved 166,000 barcode entries for upcoming concerts.

bleepingcomputer.com2 min read

ROCKYOU2024: 10 BILLION PASSWORDS LEAKED IN THE LARGEST COMPILATION OF ALL TIME

A new password compilation that consists of nearly 10 billion passwords was discovered by security researchers. The compilation expands on RockYou2021 with an additional 1.5 billion passwords.

links.tldrnewsletter.com2 min read