TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-09-20

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

FAST-TRACKING SOC 2 AND ISO 27001 WITH VANTA

Achieving compliance with SOC 2 and ISO 27001 is crucial for unlocking growth and establishing customer trust, but it can be time-intensive and costly.

vanta.comSponsor

02ATTACKS & VULNERABILITIES

GITLAB WARNS OF CRITICAL PIPELINE EXECUTION VULNERABILITY

GitLab has released a bulletin urging CE and EE users to update their installation to fix a critical vulnerability. The vulnerability allows RCE via environment stop action jobs. The fix also addresses four other high severity vulnerabilities that can be exploited to achieve RCE.

bleepingcomputer.com2 min read

CLEVER 'GITHUB SCANNER' CAMPAIGN ABUSING REPOS TO PUSH MALWARE

A sneaky campaign on GitHub is tricking users into visiting a fake domain and installing Windows malware by falsely reporting security vulnerabilities. Users are receiving convincing email alerts from legitimate GitHub addresses, leading to the spread of malicious software. Threat actors are using GitHub's "Issues" feature to distribute malware through open-source repositories, highlighting the platform's vulnerability to abuse.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

A SAAS PROVIDER'S GUIDE TO SECURELY INTEGRATING WITH CUSTOMERS' AWS ACCOUNTS

SaaS providers often need to integrate with customers' AWS environments to perform a variety of tasks such as cost optimization or CSPM. The basics that a provider can do are to use IAM Roles with ExternalIDs instead of IAM users and to audit and minimize permissions that your role requires. Some paved roads and guardrails that providers can then take would be to provide CloudFormation templates and/or a Terraform provider as well as refusing to assume an overly permissive role. Finally, providers should treat their integrations as crown jewels and consider using defense-in-depth models such as bastion accounts and restricting the customer's trust boundary to a single role instead of a full account.

securitylabs.datadoghq.com9 min read

04LAUNCHES & TOOLS

1PASSWORD PYTHON SDK

1Password has released a Python SDK that allows for programmatic access and management of 1Password secrets.

github.comGitHub repository

CHROMEKATZ

ChromeKatz is a tool for dumping passwords and cookies from compromised Chromium browsers.

github.comGitHub repository

STOWAWAY

Stowaway is a Multi-hop proxy tool for security researchers and pentesters. Users can use it to proxy external traffic through multiple nodes to the core internal network, breaking through internal network access restrictions, constructing a tree-like node network, and easily realizing management functions.

github.comGitHub repository

05MISCELLANEOUS

CYBERSECURITY TECHNOLOGY ADOPTION CYCLE AND ITS IMPLICATIONS FOR STARTUPS AND SECURITY TEAMS

Security teams can be classified into three categories: mature and engineering-focused teams, mature but not engineering-focused teams, and less mature teams or organizations that lack resources. Mature and engineering-focused teams will look to build their own tools, become design partners with early stage startups, and only look to buy tooling once it becomes commodified. Mature but not engineering-focused teams will often buy tooling from early-stage startups. Less mature teams will primarily wait for larger companies to adopt new tooling and features to reduce the amount of products they pay for. Startups need to be aware of these trends as they are the inverse of typical strategies. Security teams need to consider this cycle when deciding to build vs buy tooling.

ventureinsecurity.net7 min read

CROWDSTRIKE EX-EMPLOYEES: ‘QUALITY CONTROL WAS NOT PART OF THE PROCESS'

Semafor interviewed 24 former CrowdStrike employees in the wake of the outage this past July. The employees detailed working conditions that prioritized speed above all else and omitted quality control. CrowdStrike disputes these claims and says that these were disgruntled former employees who are not reputable.

semafor.com4 min read

POLICY LANGUAGE SECURITY COMPARISON

AWS engaged Trail of Bits to evaluate three major authorization and access management policy languages: Cedar, Rego, and OpenFGA. Trail of Bits evaluated sixteen threat scenarios and grouped them by attack surface and mitigation similarity. Cedar's predictable evaluation model protects against DoS from users and the formalized semantics, testing, and typing system prevent language misuse and mis-evaluation, but data ingestion and engineering may cause complexities. Rego provides a flexible policy language which can make it easier to use but also may lead to language misuse, mis-evaluation, or performance considerations. OpenFGA provides a declarative language for mapping ReBAC constraints, which can simplify policy writing, but it relies on external attribute lists and can lead to unpredictable performance. The language also features mitigations for threats related to policy extension and replacement.

github.com65 min read