TLDR INFORMATION SECURITY 2024-09-06

Get the report for free

PLANNED PARENTHOOD CONFIRMS CYBER-ATTACK AS RANSOMHUB THREATENS TO LEAK DATA

Planned Parenthood in Montana experienced a cyber-attack on August 28. It is working with federal law enforcement and cybersecurity experts to investigate and restore systems. Ransomware group RansomHub claims to have stolen 93GB of data and has threatened to leak it unless paid.

REVIVAL HIJACK SUPPLY-CHAIN ATTACK THREATENS 22K PYPI PACKAGES

JFrog has detected a new attack, dubbed Revival Hijack, where attackers register a package under the name of a previously deleted package. 22k packages are vulnerable to this attack because PyPi makes package names available immediately upon deletion. JFrog took action to mitigate this vulnerability by registering packages under the name of more popular vulnerable projects.

GOOGLE CONFIRMS CVE-2024-32896 EXPLOITED IN THE WILD, RELEASES ANDROID SECURITY PATCH

Google has released its monthly security updates for the Android operating system, addressing a known security flaw that it said has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), allows privilege escalation in the Android Framework component.

A SECURITY ANALYSIS OF AZURE DEVOPS JOB EXECUTION

Azure DevOps is a key tool in CI/CD practices - particularly its Azure Pipelines feature for automating code building and testing. This post explores the server-side processes when pipelines are triggered, focusing on potential security risks and the importance of protecting against unauthorized access and data breaches in modern development workflows.

THREAT MODELING AUTOMATION: OPPORTUNITIES, CHALLENGES, AND THE ROLE OF AI

Traditional threat modeling struggles with scalability due to needing dedicated security resources as well as engineering resources to understand both the security aspects and application components. Recent innovations in the threat modeling process are meant to integrate threat modeling throughout the SDLC as well as offering tools for diagramming or threat models as code. With the advent of LLMs, it could be possible to generate threat models directly from source code. Current efforts such as STRIDE GPT can generate threat models from a natural language description.

AVOIDING SECURITY INCIDENTS DUE TO REQUEST COALESCING

Web caching is often utilized to speed up costly calculations or decrease response times by maintaining a copy of data closer to users. Request coalescing is when Amazon CloudFront is used as a CDN and sees requests for the same cache key come in simultaneously and the CDN waits for the first response to be cached and then uses the cached copy for the following responses. Wiz found an unexpected behavior where Amazon CloudFront was ignoring the Cache-Control: no-cache header and sending sensitive cached content to users via request coalescing. To prevent this behavior, users must configure the managed cache policy CachingDisabled for those cache keys or set the minimum TTL for the cache behavior to 0 AND configure the origin to send the Cache-Control: no-cache header.

WUSH

Wush is a command line tool that allows for transferring files and opening shells over peer-to-peer WireGuard connections. It is built on top of Tailscale's tsnet package and utilizes Tailscale's public DERP relays, but does not require a Tailscale account.

ACUVITY (PRODUCT LAUNCH)

Acuvity helps adopt AI platforms through a governance platform to detect and monitor employee interactions and helps companies develop secure in-house AI Applications.

SUASS

The Secure ur Ass By Learning Cybersecurity repository is a comprehensive resource for cybersecurity professionals, students, beginners, and anyone interested in the field of cybersecurity. It contains a wide range of cybersecurity study materials to help students enhance their knowledge and skills.

ANNOUNCING AWS KMS ECDH SUPPORT

AWS has announced support in KMS for asymmetric keys using ECDH. Each party generates a key using the same key spec and selects KEY_AGGREEMENT for the usage. The parties then retrieve and exchange their public key from KMS. Each party can then utilize the other party's public key and their KEY_AGREEMENT key to call the new DeriveSharedSecret API to derive an asymmetric key that can be utilized for secure communication. This post provides a walkthrough for a sample use case of end-to-end encryption using the new DeriveSharedSecret API.

AWS NETWORK FIREWALL INTRODUCES GEOIP FILTERING

AWS Network Firewall has introduced GeoIP-based filtering for ingress to and egress from a VPC. GeoIP filtering allows for the creation of firewall rules that target a country as opposed to previously where users needed to maintain an IP list for each country.

X IS HIRING STAFF FOR SECURITY AND SAFETY AFTER TWO YEARS OF LAYOFFS

X is hiring for safety and cybersecurity roles. The company has posted two dozen job openings, including positions for content moderation and platform security.

CLEARVIEW AI FACES €30.5M FINE FOR BUILDING ILLEGAL FACIAL RECOGNITION DATABASE

The Dutch Data Protection Authority fined Clearview AI €30.5 million for GDPR violations, citing its database of billions of facial images collected without consent.

BITCOIN ATM SCAMS ON THE RISE: AMERICANS LOSE $65 MILLION IN SIX MONTHS

Scammers are using bitcoin ATMs to steal money, with Americans losing $65 million in just six months.

COMPUTER GLITCH NEARLY DROWNS AMSTERDAM, UTILITY WORKER SAVES THE DAY

A computer glitch caused a near-flooding disaster in Amsterdam when sluice gates were left open.