TLDR InfoSecJuly 17, 2024

TLDR INFORMATION SECURITY 2024-07-17

6 sections16 entrieslinks blockcomplete parse

Parse notes

Subscription/account footer truncated before parsefooter_truncated

01GENERAL

SEC MATERIALITY FRAMEWORK

What defines a “material” cybersecurity incident?

lacework.comSponsor

02ATTACKS & VULNERABILITIES

RITE AID BECOMES RANSOMHUB'S LATEST VICTIM AFTER DATA BREACH

Rite Aid reported a "limited cybersecurity incident" in June. A threat actor impersonated an employee, gaining unauthorized access to company systems. The breach exposed customer information including names, addresses, and IDs. The RansomHub gang claimed responsibility, alleging it obtained 10GB of data affecting 45 million customers.

darkreading.com3 min read

CRYPTO EXECS ON DEFI DOMAIN HACKS: DON'T INTERACT WITH CRYPTO FOR NOW

A large swath of crypto domains are suffering from domain hijacking attacks. These domains were left vulnerable after the forced migration from Google Domains to Squarespace led to MFA being disabled. CoinGecko founder, Bobby Ong, is advising people to avoid interacting with crypto for a few days and wait for the situation to be resolved.

cointelegraph.com2 min read

EMAIL ADDRESSES OF 15 MILLION TRELLO USERS LEAKED ON HACKING FORUM

A threat actor leaked 15 million Trello users' email addresses collected via an unsecured API. The leaked data can be used for phishing attacks and doxxing by linking email addresses to individuals. Atlassian confirmed the breach and made changes to secure the Trello REST API.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

HERE'S HOW CAREFULLY CONCEALED BACKDOOR IN FAKE AWS FILES ESCAPED MAINSTREAM NOTICE

This post dives into how two fake AWS packages on the NPM JavaScript repository contained hidden code that backdoored developers' computers. The packages, which were downloaded hundreds of times, mimicked a legitimate library but included additional files with concealed malicious code.

arstechnica.com9 min read

CLOUD ATTACK EMULATION: DEMOCRATIZING SECURITY OPERATIONS IN THE CLOUD

Security operations in the cloud are particularly complex as they require operators to have knowledge of security operations as well as cloud security. Cloud attack emulation can be the bridge needed as it allows teams to stress test their infrastructure against attacks. It can be utilized for cloud penetration testing, red/purple teaming, incident response readiness, and security assurance.

mitigant.io6 min read

AWS NETWORK FIREWALL EGRESS FILTERING CAN BE EASILY BYPASSED

AWS Network Firewall is a fully managed service that works as an IDS/IPS to control egress between workloads running in a VPC and the Internet. AWS recommends the use of a domain list to allow specific domains that can be contacted. This post demonstrates that this security measure can be trivially bypassed by spoofing the host name to avoid the block as it doesn't utilize DNS lookups or IP blocking.

canglad.com5 min read

04LAUNCHES & TOOLS

GOOGLE'S KURIAN APPROACHED WIZ, $23B DEAL COULD TAKE A WEEK TO LAND, SOURCE SAYS

Alphabet is in advanced talks to acquire cybersecurity startup Wiz for $23 billion, doubling its last private valuation. If successful, it would value Wiz at 46 times its current ARR.

techcrunch.com3 min read

RITA

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

github.comGitHub repository

TOUCH ID CLI

Touch ID CLI (tidcli) provides a utility to open a Touch ID prompt and return an exit code of 0 on success or 1 on failure. This is meant to be used in shell scripts to add Touch ID authentication.

github.comGitHub repository

05MISCELLANEOUS

IT'S NEVER BEEN EASIER FOR THE COPS TO BREAK INTO YOUR PHONE

The FBI quickly accessed the phone of Trump rally shooter Thomas Matthew Crooks, demonstrating advanced phone-hacking capabilities with the widespread use of tools like Cellebrite by law enforcement.

theverge.com3 min read

KASPERSKY CULLS STAFF, CLOSES DOORS IN US AMID BIDEN'S BAN

Kaspersky is closing its US operations and cutting jobs following President Biden's ban on the Russian company. The closure affects fewer than 50 employees, with layoffs starting this week.

theregister.com2 min read

HOW TO CONVINCE YOUR EMPLOYER TO COVER TRAINING

When requesting training, the first step is to check if your company has any benefits related to training. You should approach your mentor with either the specific courses that you're looking to take or ask for help in finding courses. This post includes a template that can be used to submit a formal budget request after obtaining manager approval.

linkedin.com4 min read