TLDR INFORMATION SECURITY 2024-07-26

Try AI in Tines for free →

MICHIGAN MEDICINE NOTIFIES NEARLY 57K PATIENTS AFTER HEALTH INFORMATION POTENTIALLY EXPOSED IN CYBERATTACK

Michigan Medicine reported a data breach affecting approximately 57,000 individuals. Hackers accessed employee email accounts on May 23 and 29 and potentially accessed personal and health information.

KNOWBE4 DISCOVERS REMOTE WORKER IS REALLY A NORTH KOREAN HACKER

KnowBe4 recently disclosed that a remote software engineer that it hired was a North Korean hacker who was able to make it through the interview process and pass a background check. KnowBe4 detected that the hacker's Mac immediately started loading malware. The employee refused to take a call with the team and then became unresponsive, which led KnowBe4 to contact the FBI and Mandiant.

PKFAIL: UNTRUSTED PLATFORM KEYS UNDERMINE SECURE BOOT ON UEFI ECOSYSTEM

The Binarly team has published research on how leaked private keys like the ones from Intel Boot Guard and American Megatrends International were exposed. Hardware containing these keys is still being deployed. The PKfail issue exposes poor cryptographic management practices that put devices at risk of being bypassed during the boot process. To mitigate PKfail, device vendors should follow best practices for key management and users should stay informed about security patches.

HOW WE SECURELY GENERATE SENSITIVE SECRETS

Monzo wanted a secret generation process that no entity could compromise or manipulate. Password managers with passkeys grant this assurance but don't scale to services that need to run in cloud environments. To achieve its goal, Monzo built a repeatable, deterministic build process that utilized AWS Nitro Enclaves to securely generate secrets. This was used to cryptographically verify the integrity of environments.

A HARD LOOK AT GUARDDUTY SHORTCOMINGS

This article evaluates Amazon GuardDuty's coverage, efficacy, and cost. Coverage was limited to core attacks on core services, with few finding types across a few services. Foundational features are worth enabling, but others can be costly. GuardDuty failed to detect many tested attacks and had a best-case latency of 5:08 for an S3 ransomware simulation.

UNFASHIONABLY SECURE: WHY WE USE ISOLATED VMS

This blog post discusses the use of isolated virtual machines (VMs) to provide complete customer data separation in the architecture of Thinkst Canary. Each customer has their own VM, ensuring strong boundaries between services and data. This approach offers benefits like improved security, performance monitoring, regulatory compliance, and hardware fault isolation.

LAKERA (PRODUCT LAUNCH)

Lakera is a low-latency AI application firewall that secures traffic into and out of generative AI applications

GPT4-CAPTCHA-BYPASS

This project is a CLI tool for testing various types of captchas including puzzle, text, complicated text, and reCAPTCHA using Python and Selenium. The tool uses OpenAI GPT-4 to help solve the captchas.

FLOWANALYZER

FlowAnalyzer is a tool to help with low level understanding of OAuth 2.0 Grants/Flows. It includes support for OIDC as well as a dedicated section on JWTs.

FORGET SECURITY – GOOGLE'S RECAPTCHA V2 IS EXPLOITING USERS FOR PROFIT

Google's reCAPTCHA service, while promoted as a security mechanism, is actually harvesting user information and labor worth billions. reCAPTCHA is disliked by users, costly in time and resources, and vulnerable to bots.

INVISIBLE GHOST: ALARMING VULNERABILITY IN GITHUB COPILOT

The "Invisible ghost" vulnerability in GitHub Copilot allows hidden instructions to be embedded using invisible Unicode characters. It can be used to manipulate code suggestions without developer awareness and potentially inject harmful code.

CLOUDFLARE REPORTS THAT NEARLY 7% OF INTERNET TRAFFIC IS MALICIOUS

Cloudflare's State of Application Security Report revealed that 6.8% of all Internet traffic is malicious, with wars and elections theorized to be driving the uptick. It also noted that DDoS attacks are also on the rise, having blocked 4.5M DDoS attacks in the first quarter of 2024. About 38% of all HTTP requests processed by Cloudflare are classified as bot traffic.

DOUBLE DIPPING CHEAT DEVELOPER GETS CAUGHT RED-HANDED

The developer of the EvolvedAim cheat for Escape From Tarkov was caught selling the cheat with an information stealer embedded, putting users at risk.

ANYONE CAN ACCESS DELETED AND PRIVATE REPOSITORY DATA ON GITHUB

GitHub's repository design allows access to data from deleted and private repositories indefinitely, creating a significant security vulnerability known as Cross Fork Object Reference (CFOR).

MOVING TO A MORE PRIVACY-RESPECTING AND EFFICIENT METHOD OF CHECKING CERTIFICATE REVOCATION

Let's Encrypt will stop supporting OCSP in favor of CRLs for better privacy and efficiency.