TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-08-28

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

Taking place on SEPTEMBER 19, 2024, dive deep into AWS and learn how to build a more secure cloud.

sonrai.coSponsor

02ATTACKS & VULNERABILITIES

CODE EXECUTION VULNERABILITY FOUND IN WPML PLUGIN INSTALLED ON 1M WORDPRESS SITES

A critical vulnerability (CVE-2024-6386) in the WPML WordPress plugin could allow remote code execution on over one million websites. The flaw stems from improper input sanitization in Twig templates. A proof-of-concept is available for the vulnerability. Users should update to WPML version 4.6.13 immediately.

securityweek.com2 min read

MOVEIT HACK EXPOSED PERSONAL DATA OF HALF MILLION TDECU USERS

Texas Dow Employees Credit Union has reported a data breach stemming from compromised MOVEit file transfer software that affected over 500,000 members. The breach, which was discovered in July 2024 but occurred a year earlier, exposed sensitive personal and financial information.

infosecurity-magazine.com2 min read

MICROSOFT UPDATE BREAKS DUAL-BOOT

Microsoft's GRUB patch to fix CVE-2022-2601 has led to errors when trying to boot Linux partitions in dual-boot systems due to incompatible EFI boot loaders. The workaround for users on affected distros is to either disable Secure Boot or delete the Microsoft SBAT. Microsoft maintains that the update should only be installed on systems without a Linux boot option and has stated that it's working with Linux partners to address the issue.

arstechnica.com4 min read

03STRATEGIES & TACTICS

ADDRESSED AWS DEFAULTS RISKS: OIDC, TERRAFORM, AND ANONYMOUS ACCESS TO ADMINISTRATORACCESS

This post introduces a novel AWS attack in which an attacker can utilize Terraform Cloud to gain AdministratorAccess on an AWS account by only knowing (or guessing) the Terraform OIDC role and AWS account ID of a victim. This attack is possible when an OIDC's role is created with a trust relationship that does not specify a subject key, which previously was the default when creating a Federated Identity using the GUI. AWS has addressed this vulnerability by adding a mandatory Organization field that becomes the subject field when creating a Federated Identity using the GUI. This post suggests a Lambda strategy that defenders can use to periodically scan for this vulnerability.

hacktodef.com11 min read

CLOUD DFIR - AWS IAM PRIVESC LEADS TO EC2 RANSOMWARE

This post examines the AWS DFIR process in a fictional scenario where an organization suffered a ransomware attack that encrypted all files on all of its EC2 instances. The analyst first investigated Sysmon logs on a Windows EC2 instance and identified that the AWS SSM Run Command was used to download malicious scripts from a GitHub repo which were then executed as SYSTEM. They then analyzed CloudTrail logs to identify the role that was used to run the SSM commands, but since it was a commonly used role to execute SSM Commands, the analyst also needed to track down the user that assumed the role in the given timeframe. Upon identifying the compromised user, the analyst also identified that the attacker moved laterally from the initially compromised account by creating access keys for the account that had permissions to assume the SSM commands role.

links.tldrnewsletter.com13 min read

MACOS X MALWARE DEVELOPMENT

The blog post, in which the author discusses designing malware for macOS, covering its architecture, security features, Mach API, kernel internals, and shellcode injection, was originally written in 2022 and updated for macOS X Catalina. It emphasizes the importance of understanding system calls, memory protection mechanisms, and code injection techniques using Mach APIs on macOS. The author recommends further reading on the topic and highlights the importance of understanding the environment, features, and security of macOS through practical examples.

0xf00sec.github.io36 min read

04LAUNCHES & TOOLS

STIX-SHIFTER

This project consists of an open source library that allows software to connect to data repositories using STIX Patterning and return results as STIX Observations.

github.comGitHub repository

SECURECODEBOX

secureCodeBox is a Kubernetes-based modularized toolchain for continuous security scans on software projects. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.

github.comGitHub repository

RANSOMWARE TOOL MATRIX

A repository containing a list of tools that different ransomware gangs utilize to aid defenders in threat hunting.

github.comGitHub repository

05MISCELLANEOUS

UBER HIT WITH $324 MILLION EU FINE FOR IMPROPER DATA TRANSFER

Uber faces a €290 million fine from Dutch regulators for improperly transferring EU driver data to the US, violating GDPR. The investigation, prompted by French drivers' complaints, found sensitive information stored on US servers without adequate protection.

theverge.com3 min read

HOW SOME LET'S ENCRYPT RENEWAL FAILURES POINTED TO AN AWS TRAFFIC HIJACKING ISSUE

An AWS customer began to notice connectivity issues with Let's Encrypt renewals in a VPS that they used that they were not able to resolve with support from the VPS provider. After debugging with AWS, they discovered that the traffic was being routed to a third party that was advertising a typoed BGP route through Direct Connect that unintentionally overlapped with the original AWS customer's IP range. AWS support confirmed that its BGP route verification process failed in this circumstance and has added process improvements to prevent possible malicious traffic hijacking through this vector in the future.

chair6.net10 min read