TLDR INFORMATION SECURITY 2024-07-10

Check out the article on the Hyperproof blog ↗️

CRITICAL UNPATCHED FLAWS DISCLOSED IN POPULAR GOGS OPEN-SOURCE GIT SERVICE

Four unpatched security vulnerabilities, including three critical ones, have been discovered in the open-source Git service Gogs. These flaws require authentication, but allow attackers to execute arbitrary commands, steal or delete source code, and plant backdoors.

HEALTHEQUITY DATA BREACH EXPOSES PROTECTED HEALTH INFORMATION

Healthcare fintech company HealthEquity is reporting that it experienced a breach due to a compromised partner. HealthEquity detected anomalous behavior from a partner's personal device, leading to the discovery that their account had been compromised and used to exfiltrate PII. HealthEquity is notifying impacted individuals and has committed to providing credit report monitoring and identity restoration services.

ROBLOX DEVELOPER CONFERENCE ATTENDEES' INFORMATION LEAKED

FNTech, a third-party vendor that Roblox uses for managing conference registrations, has suffered a data breach. Registrants to the 2022-2024 Roblox Developer Conference may have had their registered name, email, and IP address leaked. FNTech has not yet released a statement on the breach.

ACCESS AWS SERVICES PROGRAMMATICALLY USING TRUSTED IDENTITY PROPAGATION

AWS introduced trusted identity propagation to allow applications to propagate a user's IdP identity to applications running in AWS to access a subset of AWS services with SSO. Users can use the AWS CLI to obtain an auth token from their IdP which then gets used by IAM Identity Center to create an identity-enhanced IAM role session. This blog post includes a tutorial on building and using the CLI application to access data on S3 Access Grants, query Athena, and programmatically interact with other AWS services.

GRAFANA LOKI AND UNINTENDED AWS DATA WRITE ATTEMPTS TO AMAZON S3 BUCKETS

Grafana has announced that the “unnamed open source project” cited in the “How an empty S3 bucket can make your AWS bill explode” medium post was Grafana Loki. The author of the post used the same name as the default bucket in the Loki Helm chart when he was setting up the S3 bucket for his Loki installation, leading to other Loki clusters deployed using the default configuration to attempt writes to his bucket. Helm charts have been updated to not include default names unless using local storage. AWS also announced changes to S3 billing due to this bug.

APP-LEVEL EBPF APPLICATIONS - USER VS. KERNEL PROBES

Leveraging eBPF technology allows for the detailed monitoring of application performance and behavior in real-time without heavy instrumentation. This post describes two main methods, user and kernel probes, that offer different levels of visibility with varying impacts on application performance. Kernel probes provide efficient insights into applications without the performance overhead typically associated with user probes.

Learn more about Tines

AUTHZED (PRODUCT LAUNCH)

Authzed is a permissions system that leverages open source project SpiceDB to provide fine-grained access control so that only authorized users have access to specific assets.

BOF-LAUNCHER

Beacon Object File (BOF) launcher is a library for executing BOF files in C/C++/Zig applications.

BULLFROG

Bullfrog is a tool that increases the security of GitHub Actions workflows by defining a domain/IP allow list for outbound network connections that a workflow can access.

EXPLORING COMPILED V8 JAVASCRIPT USAGE IN MALWARE

Malware authors are using compiled V8 JavaScript, a feature in Google's V8 engine, to convert JavaScript to low-level code. Checkpoint's "View8" tool can decompile malicious V8 applications, revealing how threat actors hide code and evade detection. This article analyzes malicious V8 bytecode to reveal insights into malware behavior.

MICROSOFT-OWNED ADTECH XANDR ACCUSED OF EU PRIVACY BREACHES

European privacy group noyb is supporting a complaint against Xandr filed with Italy's data protection authority. The complaint alleges GDPR violations, including transparency failures and data access rights breaches related to microtargeted advertising profiles. If upheld, Xandr could face compliance orders and fines up to 4% of Microsoft's annual turnover.

RUSSIA FORCES APPLE TO REMOVE DOZENS OF VPN APPS FROM APP STORE

Apple has removed 25 VPN apps from the Russian App Store at the request of Roskomnadzor, Russia's telecommunications watchdog. The ban targets apps used to access content deemed illegal in Russia, including NordVPN and Proton VPN.

RANSOMWARE ATTACK DEMANDS REACH A STAGGERING $5.2M IN 2024

The average extortion demand per ransomware attack was over $5.2m in the first half of 2024, which saw 421 confirmed ransomware attacks impacting around 35.3 million records.

LINKSYS VELOP ROUTERS SEND WI-FI PASSWORDS IN PLAINTEXT

Two models of Linksys Velop routers send SSIDs and passwords to AWS in plaintext.

US AND PARTNERS DISRUPT BOT FARM PUSHING RUSSIAN PROPAGANDA

A bot farm pushing Russian propaganda on X was disrupted by a joint international law enforcement operation led by the U.S. Justice Department.