TLDR INFORMATION SECURITY 2024-09-30

Register now — space is limited!

CUPS: A CRITICAL 9.9 LINUX VULNERABILITY REVIEWED

HPE ARUBA NETWORKING FIXES CRITICAL FLAWS IMPACTING ACCESS POINTS

HPE Aruba Networking has fixed critical vulnerabilities in its Access Points that allowed attackers to execute code remotely. Attackers could exploit the flaws by sending specially crafted packets to the PAPI UDP port. Admins are urged to install security updates to prevent potential attacks, with workarounds available for temporary protection.

OVER 90M FRENCH RECORDS EXPOSED

Cybernews and another security researcher discovered an exposed Elasticsearch instance containing 90M records on French citizens (France has a population of 67.79M). The data seems to have been collected by a data hoarder and comprises data from at least 17 breaches. The data contains full names, phone numbers, physical addresses, email addresses, partial payment information, and other data.

HACKING KIA: REMOTELY CONTROLLING CARS WITH JUST A LICENSE PLATE

This post describes in detail a vulnerability in Kia's remote activation system that allowed an attacker to remotely control Kia vehicles using just a license plate number. The attack flow involved generating dealer tokens, retrieving victim information, and modifying access to take control of the vehicle. While this vulnerability has been fixed and the the hacking tool was never released or used maliciously, similar vulnerabilities may be present in other manufacturer's systems.

APPLYING SECURITY ENGINEERING TO MAKE PHISHING HARDER - A CASE STUDY

Doyensec conducted a security review for a client's communication platform to prevent phishing and social engineering attacks. Vulnerabilities such as file extension bypass and subdomain crafting were identified and addressed. Recommendations included removing trailing dots in filenames and implementing stricter URL filtering to enhance security.

CVE HUNTING MADE EASY

An automated process hunting for CVEs at scale across all WordPress plugins resulted in 14 new CVEs over three afternoons of work. The process involved downloading and cataloging all WordPress plugins, then running Semgrep on any plugins with recent releases and at least one install. Any findings were then manually reviewed and exploits were attempted. A worked example of the process is included at the end of the blog post.

Ready to ditch the security theater? Request Pricing Here

ONLYHUMANS PROXY

An experimental proxy that serves static websites as an image to defeat crawlers and scrapers.

UNICORN ENGINE V2.1.0

Unicorn emulator framework's 2.1.0 release introduces significant performance improvements, including up to 40x faster write speeds and optimized memory allocation. The release brings enhanced cross-platform support, full M1 compatibility, restored Python 2 compatibility, and new or improved bindings for Python, Java, and .NET. Other new features include QEMU logging revival, snapshot memory support, MMU bypass option, and various improvements across different architectures like RISCV and PPC32.

DNA

Dna is a static binary analysis framework built on top of LLVM, mostly written in C#. It includes features like control flow graph reconstruction and jump table solving. Dna supports x86_64 architecture but recompiled code is not CET compliant and requires custom patches to build on Windows.

CYBERSECURITY BURNOUT IS A REAL RISK

67% of respondents on ISC surveys feel like there is a shortage of staffing and 90% of organizations have a security skills gap, highlighting the fact that cybersecurity professionals at all levels are experiencing burnout. Organizations should take these statistics into account and aid their security teams. CISOs should push boundaries, advocate for their teams, and be cognizant of burnout potential in their organizations.

NIST PROPOSES NEW PASSWORD REQUIREMENTS

NIST has released a new draft of SP 800-63-4 that contains Digital Identity Guidelines. Notably, this version bars requirements for security questions, periodic password resets, and forced usage of specific character classes. Other notable inclusions are recommendations to use a 15-character minimum and requirements to accept all printing ASCII characters, accept Unicode characters, and implement a password maximum of at least 64 characters.

FIND THE RIGHT OSINT TOOLS WITH BELLINGCAT'S NEW ONLINE INVESTIGATIONS TOOLKIT

Bellingcat has published a new version of its Online Investigations Toolkit based on interviews with practitioners. The new toolkit is divided into categories to make locating tools easier and features in-depth descriptions of the tools, whether they are free or paid, and sample usage. Bellingcat is treating this version as collaborative and will be updating it based on community feedback.

IRISH DATA PROTECTION COMMISSION FINED META €91 MILLION FOR STORING PASSWORDS IN READABLE FORMAT

The Irish Data Protection Commission fined Meta €91 million for storing user passwords in a readable format, violating data protection regulations.

IRANIAN HACKERS CHARGED FOR ‘HACK-AND-LEAK' PLOT TO INFLUENCE ELECTION

Three Iranian hackers associated with Iran's IRGC have been charged by the DOJ for a "hack-and-leak" scheme targeting the 2024 U.S. presidential election.

THREAT LANDSCAPE FOR INDUSTRIAL AUTOMATION SYSTEMS, Q2 2024

Kaspersky ICS CERT has published the threat landscape for Industrial Control Systems Computers for Q2 2024.