TLDR INFORMATION SECURITY 2024-10-09

↗️ Get your free genAI inventory

AMERICAN WATER, THE LARGEST WATER UTILITY IN US, IS TARGETED BY A CYBERATTACK

American Water, the largest U.S. water utility, reported a cyberattack on Thursday. The company paused billing and shut down certain systems but believes facilities and operations weren't affected. It is working with law enforcement to investigate the incident's scope.

GORILLABOT GOES APE WITH 300K CYBERATTACKS WORLDWIDE

A new Mirai variant called GorillaBot launched 300,000 DDoS attacks last month, affecting 20,000 organizations worldwide. It employs 19 attack methods, primarily UDP and TCP ACK Bypass floods. The botnet, which supports multiple architectures, targeted organizations in 113 countries, with China and the US most affected.

5.11 TACTICAL SUFFERED A DATA BREACH

5.11 Tactical, which mashes tactical equipment that is favored by local and national law enforcement agencies, suffered a data breach. In a filing with the Maine Attorney General, 5.11 Tactical disclosed that 27,742 individuals who purchased products online between July 12 to August 22 may have had their information exposed. Exposed information includes full names, email addresses, payment card numbers, payment card expiration dates, and payment card security codes.

INVESTIGATING INFRASTRUCTURE AND TACTICS OF PHISHING-AS-A-SERVICE PLATFORM SNIPER DZ

The Phishing-as-a-Service platform Sniper Dz has been detected using over 140,000 unique phishing websites. It uses various techniques to hide its malicious activity such as utilizing proxymesh[.]com to hide backend servers, obfuscating template code, abusing legitimate SaaS platforms, and employing malicious redirects. Sniper Dz offers these services free of charge on its platform and also provides a centralized infrastructure for exfiltrating credentials and tracking victims.

EXPLOITING TRUST: WEAPONIZING PERMISSIVE CORS CONFIGURATIONS

Websites can employ CORS to allow for sharing of data to a different website, bypassing same-origin restrictions. This blog post presents a collection of case studies that showcase CORS misconfigurations that can be exploited such as arbitrary reflected origin, only checking the beginning of the Origin header, trusting related subdomains or localhost, and other more complicated techniques. Advice to pentesters hunting for CORS vulnerabilities includes making sure to scan all endpoints, considering related domains, applying context to findings, and testing for subdomain reflection.

DOCKER CONTAINERS SECURITY

This is a series of articles that describe how Docker Container Security works, how to exploit vulnerabilities as well as how to fix and secure your Docker deployment. Another series on Linux Privilege Escalation as well as some fundamental understanding of Docker are prerequisites for this course.

LYNIS

Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening.

TAMNOON (PRODUCT LAUNCH)

Tamnoon combines purpose-built AI technology for cloud remediation, guided by cloud security experts, to safely reduce critical threat exposures.

GHOSTPORT

Ghostport is a tool that misleads port scanners by responding with convincing signatures.

HUGE HACK SHUTS DOWN RUSSIAN ONLINE STATE MEDIA ON PUTIN'S BIRTHDAY

Ukrainian-linked hackers reportedly conducted an "unprecedented" cyberattack on Russian state broadcaster VGTRK, disabling online broadcasting and internal services, on Putin's birthday. The Kremlin expressed support and is investigating the incident.

APPLE FIXES BUGS IN MACOS SEQUOIA THAT BROKE SOME CYBERSECURITY TOOLS

Apple has released macOS 15.0.1, addressing compatibility issues with third-party security software that arose in the initial Sequoia release. The update reportedly fixes networking problems that affected products from CrowdStrike and Microsoft.

VULNERABILITY MANAGEMENT ISN'T ABOUT FINDING ISSUES - IT'S ABOUT FIXING THEM

Most vulnerability management tools only handle the simplest portion of vulnerability management - finding vulnerabilities. Most tools don't have enough context to provide helpful remediation advice for practitioners to take action on their findings. The future of vulnerability management tools will include a set of AI agents that constantly build up context and state of the environment to not only find vulnerabilities, but pinpoint everywhere that they're in use and how they could be fixed.

EVALUATING MITIGATIONS & VULNERABILITIES IN CHROME

The Chrome Security team describes how they evaluate and prioritize security improvements based on how they reduce potential harm to users and increase costs for attackers, considering factors like bug reliability, ease of exploitation, and impact across Chrome's large user base.

PATCH TUESDAY, OCTOBER 2024 EDITION

Microsoft, Adobe, and Apple have released security updates to fix numerous vulnerabilities, including active attacks on Windows and other software.

LUA MALWARE TARGETING STUDENT GAMERS VIA FAKE GAME CHEATS

Lua malware has been discovered in fake game cheats and is spread globally through techniques like SEO poisoning.