TLDR INFORMATION SECURITY 2024-07-22

🔍 Start evaluating FOSSA on your terms

VULNERABILITY IN CISCO SMART SOFTWARE MANAGER LETS ATTACKERS CHANGE ANY USER PASSWORD

Another Cisco critical vulnerability has been disclosed. CVE-2024-20419 allows unauthenticated attackers to change any user's password, including administrators'. This flaw in the password-change process enables access to the web UI or API with compromised user privileges. No workarounds exist. Cisco released a security update and reports no active exploitation.

MNGI DIGESTIVE HEALTH DATA BREACH IMPACTS 765,000 INDIVIDUALS

MNGI Digestive Health is notifying over 765,000 individuals about a data breach from August 2023. The breach, discovered nearly a year later, potentially exposed sensitive personal and health information, including names, Social Security numbers, medical data, and financial details. MNGI is currently working to inform affected individuals through written notifications.

TECHNICAL DETAILS: FALCON CONTENT UPDATE FOR WINDOWS HOSTS

CrowdStrike has shared technical details on the Falcon Update that caused a global outage on July 19. The issue impacted customers using the Falcon sensor for Windows version 7.11 and above between specific times on July 19. CrowdStrike has fixed the error in Channel File 291 and is conducting a root cause analysis to prevent similar incidents in the future.

PHANTOM SECRETS: UNDETECTED SECRETS EXPOSE MAJOR CORPORATIONS

The AquaSec team scanned over 50k repositories belonging to the top 100 organizations on GitHub for secrets using conventional (git clone) and unconventional methods. Using git clone --mirror fetches a more complete git history that includes PRs and other dangling refs. It led to finding additional secrets on 18% of scanned repositories. The Aqua team also tested a novel approach to scanning cached views from SCMs and found that some additional secrets could be found, though the process is difficult and has a lower chance of success.

SNEAKY WRITE HOOK: GIT CLONE TO ROOT ON K8S NODES

The gitRepo volume driver is a deprecated k8s storage driver that allows for reading files into a pod from a remote git repository. This post examines a vulnerability in the gitRepo driver whereby a maliciously crafted git repository could sneak git hooks into a node and execute commands as root. The authors submitted a PR to fix this issue which will be released in version 1.31.

VIEW STATE, THE UNPATCHABLE IIS FOREVER DAY BEING ACTIVELY EXPLOITED

This blog post discusses why the ViewState vulnerability is not used for exploits despite being around for a long time and explains how it can be done on a fully patched Microsoft Exchange 2019 host. It explains how to exploit view state vulnerabilities and the process of resetting compromised machine keys in IIS. It also highlights the risks associated with resetting machine keys and provides steps to regenerate them based on whether they were automatically generated or static.

COMMAND ZERO (PRODUCT LAUNCH)

Command Zero's platform for investigation combines autonomous and user-led methods in a federated data model and leverages automation and advanced Language Learning Models to augment human investigations.

OVER THE WIRE

Network inspection library for Node that allows packet crafting and parsing as well as capturing network traffic and sending packets in all formats.

FRAGTUNNEL

Fragtunnel is a PoC tool for tunneling TCP traffic through IDS/IPS engines and Next Generation Firewalls. It exploits the fact that they allow a limited number of packets before making a decision on whether to allow or deny the traffic.

WEST AFRICAN CRIME SYNDICATE TAKEN DOWN BY INTERPOL OPERATION

Operation Jackal III, a global law enforcement effort targeting West African crime groups, resulted in 300 arrests and $3 million in asset seizures. There are 400 additional suspects across 21 countries.

THE CLOUD SHARED IRRESPONSIBILITY MODEL

The Shared Responsibility Model is used by cloud providers to describe a split in security responsibilities where cloud providers are responsible for the underlying services and users are responsible for securing their workloads built on those services. Customer breaches could result in negative reputational damage to cloud providers. This forces cloud providers to improve their defaults to be more secure.

NAVIGATING THE RDP SECURITY CONSEQUENCES OF TLS VS. NLA FROM A THREAT EXPOSURE PERSPECTIVE

This article compares RDP security using TLS-only versus NLA. NLA-secured servers faced significantly more login attempts but also provided more insights into attacker tactics. Geographical origins of attacks differed between NLA and TLS, with certain countries showing preferences for one protocol over the other. While NLA is considered more secure, it may attract more sophisticated attacks. Researchers found NLA honeypots to be more valuable for understanding cybersecurity threats and the human element behind them.

CROWDSTRIKE'S FAULTY UPDATE CRASHED 8.5 MILLION WINDOWS DEVICES, SAYS MICROSOFT

Microsoft says that “less than one percent of all Windows machines” were affected, but it was enough to create problems for retailers, banks, airlines, and many other industries.

SECURE SOFTWARE DEVELOPMENT EDUCATION 2024 SURVEY

Report on the state of education for secure software development that highlights gaps in education, time constraints in training, and AI security as a critical future area for education.

JUDGE DISMISSES MAJOR SEC CHARGES AGAINST SOLARWINDS AND CISO

A judge dismissed major SEC charges against SolarWinds and its CISO Timothy Brown regarding cybersecurity practices after a supply chain attack.