TLDR INFORMATION SECURITY 2024-08-19

→ If you're ready to get started with PolicyTree, why not start now?

→ To learn more about streamlining your compliance journey, check out the Compliance Starter Pathway [5].

AUTOCANADA INVESTIGATING CYBERSECURITY BREACH, AS IT ANNOUNCES LOSS FROM PREVIOUS INCIDENT

AutoCanada reported a cybersecurity breach on August 11, potentially disrupting operations. This follows a separate incident involving CDK Global's software outage in June, which contributed to AutoCanada's $33.1 million Q2 loss. The company is investigating the extent of the latest breach and its impact on data security.

460K IMPACTED BY KOOTENAI HEALTH RANSOMWARE ATTACK

Kootenai Health, an Idaho-based healthcare provider, reported a data breach affecting over 460,000 individuals. The incident involved network access and data exfiltration of personal and health information.

GOOGLE WILL UPDATE PIXEL PHONES TO REMOVE VERIZON'S UNSAFE DEMO APP

Security researchers discovered a vulnerable app called Showcase.apk that was included in numerous Pixels' firmware without any way to remove it. Google has clarified that this app is used in Verizon demo phones and has committed to removing it in a future update. There is no evidence that the app has been exploited as an attacker would first require physical access and a user's password to install the app, which provides numerous other attack vectors.

SSRF: A COMPLETE GUIDE TO EXPLOITING ADVANCED SSRF VULNERABILITIES

This is a guide on exploiting SSRF vulnerabilities. It begins by explaining what SSRFs are and how to exploit basic SSRF vulnerabilities before discussing how to bypass common defenses like host and protocol allowlisting. The guide then provides an introduction to some advanced SSRFs like SSRFs in PDF generators, second order SSRFs, blind SSRFs, and SSRFs via DNS rebinding.

REUSABLE WORKFLOW IS GOOD… UNTIL YOU REALIZE YOUR IDENTITY IS ALSO REUSABLE BY ANYONE

Keyless signing is used in conjunction with sigstore by organizations to sign artifacts to enable artifact attestation. A novel attack method shows that if a repository publishes a reusable workflow to sign artifacts using sigstore, an attacker can use that workflow to sign artifacts with a SAN of the reusable workflow's repository. The researcher does not believe that this is a worrisome threat as they could only find two repositories that the attack would actually work against and even then the impact would depend on how the potential victim verified the signature.

BUCKET MONOPOLY: BREACHING AWS ACCOUNTS THROUGH SHADOW RESOURCES

Researchers have discovered a novel attack technique in AWS whereby an attacker can create S3 buckets that utilize the naming system of AWS services to in some cases even achieve RCE. When certain features in Cloudformation, Glue, EMR, Sagemaker, ServiceCatalog, or Codestar are first used, AWS creates an S3 bucket with a scheme such as cf-templates-- (for Cloudformation templates). If an attacker were to create a bucket with a guessed hash that matches the one that AWS would create for an account, the attacker would control the bucket and its contents. AWS has fixed the vulnerabilities in all services other than Codestar, which is not accepting new customers.

DAZZ (PRODUCT LAUNCH)

Dazz is an ASPM platform focused on automating the remediation processes.

PASSWORDPUSHER

Securely share sensitive information with automatic expiration and deletion after a set number of views or duration. Track who, what, and when with full audit logs.

HUNTSMAN

Huntsman is a social engineering tool that features an email enumerator, username generator, and context validator. It offers full coverage of the hunter.io and snov.io APIs and limited coverage of the skrapp.io API.

IRANIAN GROUP USED CHATGPT TO TRY TO INFLUENCE US ELECTION, OPENAI SAYS

OpenAI has banned accounts from an Iranian group, Storm-2035, for using ChatGPT to generate content aimed at influencing the US presidential election and other issues.

INTRODUCING AUTOMATIC SSL/TLS: SECURING AND SIMPLIFYING ORIGIN CONNECTIVITY

Cloudflare offers various options to control encryption between Cloudflare and origin servers that range from never encrypting to following the client request's encryption mode to always using TLS. To simplify the decision process for Cloudflare customers, Cloudflare introduced the SSL/TLS Recommender which would scan origin pages to suggest the best encryption settings. However, Cloudflare found that only 30% of customers were enabling the chosen setting in the UI. To increase adoption, Cloudflare is introducing Automatic SSL/TLS, which will automatically enable the SSL/TLS Recommender's recommended setting.

EXPLOITING HUGGING FACE'S ASSISTANTS TO EXTRACT USERS' DATA

This article demonstrates how Hugging Face's Chat is vulnerable to techniques like Sleepy Agent and Image Markdown Rendering, which can be exploited to extract users' data. These vulnerabilities allow attackers to manipulate the AI model to extract sensitive information like email addresses without the user's knowledge. Users should be cautious when using AI assistants and read the system prompts to avoid falling victim to data extraction attacks.

PALO ALTO NETWORKS CEO APOLOGIZES FOR HAPPY HOUR DISPLAY FEATURING WOMEN WITH LAMPSHADES ON THEIR HEADS

The display was neither consistent with the company's values nor in line with its actions and aspiration to support and celebrate women in Cybersecurity.

GCORE RADAR: DDOS ATTACK TRENDS IN Q1-Q2 2024

This DDoS report shows a 46% increase in DDoS attacks in H1 2024 compared to H1 2023.

GOOGLE TOOK THREE MONTHS TO REMOVE SCAM APP THAT STOLE OVER $5 MILLION IN CRYPTO: LAWSUIT

Google took three months to remove a scam app from its Play Store that tricked into losing over $5 million in cryptocurrency.