TLDR INFORMATION SECURITY 2024-07-29

Start for free now →

MALICIOUS PYTHON PACKAGE TARGETS MACOS DEVELOPERS TO ACCESS THEIR GCP ACCOUNTS

A Python package named "lr-utils-lib" was found to have hidden malicious code targeting macOS systems to steal Google Cloud Platform credentials. The malware sends harvested credentials to a remote server and is linked to a fake LinkedIn profile, raising concerns about social engineering tactics and AI verification challenges. This incident highlights the importance of cybersecurity practices, such as vetting third-party packages and critically evaluating information from AI sources, in preventing potential security risks for individuals and enterprises.

CRYPTO EXCHANGE GEMINI DISCLOSES THIRD-PARTY DATA BREACH

Gemini cryptocurrency exchange disclosed a data breach involving banking information of some customers. The breach was caused by a cyberattack on a third-party service provider. Gemini is advising impacted individuals to stay vigilant and take measures to protect their bank accounts from potential fraud.

CRITICAL BUG IN DOCKER ENGINE ALLOWED ATTACKERS TO BYPASS AUTHORIZATION PLUGINS

A critical bug in Docker Engine lets attackers bypass authorization plugins in certain versions by sending API requests with no content, leading to potential unauthorized actions like privilege escalation. The vulnerability, tracked as CVE-2024-41110, affects specific versions of Docker Engine up to v27.1.0 and Docker Desktop up to version 4.32.0. It can be mitigated by updating to the latest patched versions, avoiding AuthZ plugins, and restricting access to the Docker API.

MAPPING THE ATTACK SURFACE FROM THE INSIDE

The Mercari Security team discusses its process for creating a tool to map an attack surface. The first iteration of the tool sought to scan IaC for domains and scan them using the Burp Enterprise API. This strategy failed, as their IaC did not contain all domains. The next iteration involved directly querying asset inventories from AWS and GCP and then spinning up a GCR task to utilize a Chromium browser to take screenshots and then visualize the hostnames and IP addresses found.

THREAT HUNTING - SUSPICIOUS NAMED PIPES

This blog post discusses how Named Pipes can be used by attackers for Command and Control and how defenders like EDRs can detect these usages. Attackers can exploit named pipes to move laterally within a network. Monitoring named pipe creation and communication patterns can help detect malicious activities.

NVIDIA EMBRACES LLMS & COMMONSENSE CYBERSECURITY STRATEGY

Nvidia's team will be sharing insights from red-teaming the company's AI systems. While AI applications pose significant enterprise risks due to their privileged status, existing security practices can be adapted to address these new threats.

Tired of endlessly triaging open source vulnerabilities? FOSSA

cuts through the noise by identifying package upgrades that resolve multiple security issues at once. Now you can knock out dozens of vulnerabilities with one fix, instead of chasing CVEs one at a time.

Ready to work smarter? Try FOSSA free today

ASKJOE

AskJOE is a Ghidra script that calls OpenAI's API to add meaning to decompiled functions.

INTRODUCING SIGMA FILTERS

Sigma Filters are a new tool that helps Security Operations Centers manage threat detection more effectively. They allow for the creation of specific filters separate from detection rules, improving rule management and reducing false positives. By using Sigma Filters, SOC analysts can better tailor detection rules to their unique environments and avoid detection evasion by attackers.

ZEROTIER (PRODUCT LAUNCH)

Zerotier creates secure connections between devices such as routers or IoT devices and has them talking away as if they're on a local network to secure them.

BUILDING A SECURITY PLATFORM ENGINEERING TEAM

Kane Narraway, a security manager at Canva, writes about the benefits of a Security Platform Engineering team that can develop new solutions to scale security as well as build secure-by-default systems with other teams. Narraway reflects on the reality that in many organizations, security engineers form this function as another part of their role which can lead to complications when employees leave or maintain the system. Narraway suggests that this function should come after a security team is fully staffed and should ideally be composed of at least two software engineers and a manager.

DAGGERFLY: ESPIONAGE GROUP MAKES MAJOR UPDATE TO TOOLSET

The Macma backdoor is linked to the Daggerfly toolkit. Symantec has shared code and infrastructure with other known Daggerfly malware. A new Windows backdoor named Suzafk, capable of using TCP or OneDrive for command and control purposes, has been added to the Daggerfly toolkit. Daggerfly is a sophisticated espionage group with a wide range of tools targeting various operating systems and the ability to quickly update its toolset to evade detection.

CHECK POINT RESEARCH REPORTS HIGHEST INCREASE OF GLOBAL CYBER ATTACKS SEEN IN LAST TWO YEARS – A 30% INCREASE IN Q2 2024 GLOBAL CYBER ATTACKS

There was a 30% YoY increase in global cyberattacks in Q2 2024, averaging 1,636 attacks per organization weekly. Education/Research, Government/Military, and Healthcare were the most targeted sectors with Latin America, Africa, and Europe seeing the largest increase in attacks.

X BEGINS TRAINING GROK AI WITH YOUR POSTS, HERE'S HOW TO DISABLE

X quietly started using public posts to train its Grok AI chat platform without notifying users - this post discusses how this can be disabled.

CHROME WILL NOW PROMPT SOME USERS TO SEND PASSWORDS FOR SUSPICIOUS FILES

Google is extending Enhanced mode feature for Safe Browsing in Chrome to allow users to upload password-protected executable files for deep scanning for malware detection.

US DOJ INDICTS NORTH KOREAN HACKER FOR RANSOMWARE ATTACKS ON HOSPITALS

The US Department of Justice indicted a North Korean hacker for ransomware attacks on healthcare facilities, linking the funds to illicit activities in North Korea.