TLDR INFORMATION SECURITY 2024-10-02

T-MOBILE PAYS 31.5M IN FCC SETTLEMENT OVER 4 DATA BREACHES

The FCC has announced a settlement with T-Mobile over a string of data breaches that impacted customers from 2021 to 2023. Half of the settlement will be used for cybersecurity enhancements and the other half will be paid to the U.S. Treasury as a penalty. T-Mobile has committed to introducing modern security practices such as zero trust and MFA as part of the settlement.

RACKSPACE INTERNAL MONITORING WEB SERVERS HIT WITH 0-DAY

Rackspace suffered a breach on its internal monitoring dashboard that resulted in the company needing to take it offline briefly. Rackspace has stated that only the monitoring dashboards were affected, not monitoring and alerting systems generally, and that only a limited amount of data was accessed. The attackers monitoring information that was available to the attackers included customer account name and numbers, customer usernames, internally generated device names IDs, name and device info, and encrypted internal device credentials. Rackspace says that the breach was caused by an RCE 0-day in a third party system.

AFP NEWS AGENCY'S CONTENT DELIVERY SYSTEMS HIT BY CYBERATTACK

AFP News Agency's content delivery systems were hit by a cyberattack, disrupting its ability to distribute news to clients. Despite the attack, AFP's news reporting remains uninterrupted, with technical teams working to restore full services and secure compromised credentials. The incident highlights ongoing concerns about cybersecurity in France. Experts are investigating the attack and urging partners to enhance security measures.

SECURING YOUR CONTINGENT WORKERS WITH ZERO TRUST

BPOs are often utilized to provide a large group of contractors for outsourcing certain tasks like customer service. Onboarding BPOs can be complicated in a zero-trust environment as zero-trust tools often rely on managed devices, but providing managed hardware to a BPO can prove prohibitively expensive. This post provides a number of options that can be considered. Cloud jump boxes, isolated browsers, managed devices, and managed VMs all provide methods of accessing resources in a way that can still tie into an organization's standard zero-trust procedures. If these solutions are impractical, an organization could consider using posture-based exclusions or implementing exclusions to still allow BPOs to access a limited set of data.

SIMPLIFYING XSS DETECTION WITH NUCLEI - A NEW APPROACH

Traditionally, XSS vulnerabilities are difficult to detect with tools like Nuclei as the tester needs to write a complex set of matchers to check if the payload is reflected in the response. Nuclei headless mode allows testers to configure templates to mimic real user actions on a webpage. When combined with the waitdialog action, a template can be instructed to wait for a dialog box and a matcher can be configured to check if the expected message appears in the dialog. This also enhances accuracy as in the traditional method there's no way to ensure that the script was triggered.

SECURING THE SOFTWARE SUPPLY CHAIN WITH THE SLSA FRAMEWORK

This post discusses how the SLSA framework can enhance software supply chain security by providing a standard for verifying the creation process of open-source software artifacts. The standard offers different compliance levels, with Level 3 providing the highest security through rigorous build platform hardening. Adoption of SLSA can help prevent attacks on build and distribution processes, but integrating the framework into package distribution tools is crucial for maximizing its benefits.

developers or teams. Get free access

SEGUGIO

Segugio is a DFIR tool that extracts IoCs from malware by tracking the critical steps in the malware detonation process.

WHOYOUCALLING

WhoYouCalling monitors network activity of processes and creates .pcap files automatically. It simplifies process network monitoring by recording TCP/IP activities and DNS requests. The tool can be used to start and monitor executables, generating detailed reports for analysis.

DRAGOS ACQUIRES NETWORK PERCEPTION TO BOOST VISIBILITY

Dragos has acquired Network Perception, a company specializing in network visibility solutions for OT networks. The acquisition will enhance Dragos' platform by improving network visibility, segmentation, and compliance capabilities. Network Perception's NP-View product helps security teams identify and address risks in OT environments through network topology mapping and firewall rule evaluations.

MICROSOFT ANNOUNCES NEW VERSION OF CONTROVERSIAL RECALL FEATURE

Microsoft delayed its Recall feature to address privacy and security concerns following an unpopular launch. Recall is now an opt-in feature and can be uninstalled by users. It will also encrypt data and screenshots with keys stored in the TPM and will require Windows Hello to access the keys.

WHATSAPP AND CLOUDFLARE ENHANCE SECURITY BY AUDITING KEY TRANSPARENCY FOR END-TO-END ENCRYPTION

WhatsApp and Cloudflare began their partnership in 2022 by designing the Code Verify tool to verify the integrity of WhatsApp Web clients. In continuation of this partnership, they've released Plexi for key transparency audits. Key transparency audits will now allow WhatsApp users to verify the integrity of the public keys used for end-to-end encryption as a further level of security.

NEW SECURITY PROTOCOL SHIELDS DATA FROM ATTACKERS DURING CLOUD-BASED COMPUTATION

MIT researchers have developed a security protocol that uses quantum light to protect data during cloud-based deep-learning computations. The protocol ensures data security while maintaining 96% accuracy in deep-learning models. By encoding data into laser light, the protocol prevents attackers from intercepting information without detection.

ARC BROWSER LAUNCHES BUG BOUNTY PROGRAM AFTER FIXING RCE BUG

The Browser Company launched an Arc Bug Bounty Program to encourage finding and reporting security flaws.

FOUR LOCKBIT RANSOM GANG ARRESTS, SERVERS SEIZED BY EUROPOL

Europol made four LockBit gang arrests and seized critical servers used by the ransomware group in a joint international operation with the FBI.

IMPACT OF VERIZON'S SEPTEMBER 30 OUTAGE ON INTERNET TRAFFIC

Cloudflare has published an analysis of Verizon's outage on September 30 that shows a decline in HTTP request traffic during the outage, with some cities experiencing significant drops in traffic while others saw increases.