TLDR INFORMATION SECURITY 2024-09-23

Through a series of talks with AI experts, this limited series

unpacks the impact of AI on the cyber landscape.

THIS WINDOWS POWERSHELL PHISH HAS SCARY POTENTIAL

GLOBAL INFOSTEALER MALWARE OPERATION TARGETS CRYPTO USERS, GAMERS

Recorded Future's Insikt Group is tracking a massive infostealer campaign with over 50 different variants. The campaign is targeting high-value targets in the crypto and gaming communities by spear phishing attacks impersonating job opportunities or collaborations to distribute malware. It is very sophisticated and utilizes a variety of different payloads depending on the OS of the target.

POLICE BROKE TOR ANONYMITY TO ARREST DARK WEB USERS IN MAJOR CSAM BUST

German authorities dismantled a Dark Web platform for child sexual abuse material in 2021 by identifying Tor users, raising concerns about Tor's privacy. The platform, Boystown, had over 400,000 users and hosted severe abuse content, leading to arrests and a significant blow to illegal dark web activity. Experts suggest outdated software and increased scrutiny of Tor nodes played a role, emphasizing the need for users to enhance their browser security.

METHODOLOGY FOR INCIDENT RESPONSE ON GENERATIVE AI WORKLOADS

AWS' Incident Response team has released guidance for investigating incidents on Generative AI workloads in AWS. The post begins by discussing the steps that can be taken before an incident to train users, set up logging, and create playbooks. It then details how to investigate each component of a workload such as the infrastructure changes, AI settings changes, access changes, private data changes, and invocation logs. The post concludes with a sample scenario.

SCORECARDING SECURITY

Security teams should introduce security scorecards to scale security beyond security champions or dedicated teams. They should also take care to establish partnerships with teams, improve the UX of security scorecards, go beyond vulnerability management, and allow room for risk acceptance. This post presents several case studies of organizations that have implemented and publicly discussed security scorecards.

A JOURNEY FROM SUDO IPTABLES TO LOCAL PRIVILEGE ESCALATION

This blog post demonstrates how a low-privileged user on a Linux machine can gain root privileges by manipulating iptables and iptables-save through sudo, potentially leading to local privilege escalation. Leveraging sudo commands with NOPASSWD privileges or combining sudo with tools like tcpdump can allow for executing arbitrary commands as root. By exploiting the functionalities of iptables and iptables-save, an attacker can craft a root entry in /etc/passwd and escalate privileges to root on the system.

MERKLEMAP-CLI

Merklemap-CLI is a tool to search and enumerate subdomains matching a given query and tail live subdomain discoveries from the Merklemap pipeline.

ZIPSLIPPER

zipslipper is a tool that can create tar/zip archives that try to exploit the zipslip vulnerability.

ONEPASSWORD-SDK-PYTHON

1Password SDK is a package that allows developers to build integrations to programmatically access secrets in 1Password using Python.

REDEFINING SECURITY COVERAGE FOR PYTHON WITH FRAMEWORK NATIVE ANALYSIS

SAST tools often struggle to detect vulnerabilities and follow control flow across complex frameworks or libraries. To address this, Semgrep Pro has added framework-aware analysis, global object tracking, and prebuilt rules for Django, Flask, FastAPI, and other major libraries. Semgrep's testing resulted in an 84% true positive rate on ~1,000 findings across 192 repositories containing ~20M lines of code.

THE CLOUD IS DARKER AND MORE FULL OF TERRORS

Chris Farris, an expert on cloud security, writes a scathing condemnation of the state of cloud security. Farris begins the post by detailing many major cloud security incidents from Code Spaces to CrowdStrike. He divides these incidents into those that were caused by blatant customer failures such as not disabling access of terminated employees, not storing backups, and not enabling security features, and those incidents that were caused by blatant cloud provider failures such as Snowflake not enforcing MFA. Farris argues that we must demand more security guardrails and baseline features from cloud providers.

AWS PRIVATE CA NOW SUPPORTS SCEP FOR MOBILE DEVICES

AWS Private CA has added SCEP support at no additional cost. SCEP is a protocol that is adopted by MDM solutions to obtain digital identities from a CA. This allows organizations that use an MDM provider to utilize their cloud CA for SCEP instead of needing to manage a separate CA for it.

INSTAGRAM TIGHTENS RESTRICTIONS ON TEEN USAGE

Instagram will be enrolling all current and new accounts under the age of 16 into Teen Accounts with additional restrictions and parental controls.

APPLE'S MACOS SEQUOIA UPDATE BREAKS SECURITY TOOLS

Apple's Sequoia update has affected major security providers like CrowdStrike, SentinelOne, and ESET, rendering their tools inoperable.

DISNEY DITCHING SLACK AFTER MASSIVE JULY DATA BREACH

Disney is moving away from Slack due to a massive data breach that exposed confidential messages and files.