TLDR INFORMATION SECURITY 2024-10-14

Auditive is the better way.

🧠 AI instantly parses vendor documents and public data against your specific requirements.

Get your first vendor risk review for free, in 2 minutes.

P.S.: Use the links above to book a qualified demo and get a 20% DISCOUNT on Auditive before EoY 2024.

POKÉMON DEVELOPER GAME FREAK REPORTEDLY HACKED, STOLEN DATA ON UNANNOUNCED GAMES AS WELL AS NINTENDO SWITCH 2 CODENAME LEAKED ONLINE

Game Freak has confirmed that a data breach affecting 2,606 employees' information occurred in August. Earlier reports suggested the leaked data included codenames for future Pokémon games, Nintendo Switch 2, and other confidential information.

HACKERS TOOK OVER ROBOVACS TO CHASE PETS AND YELL SLURS

Ecovacs' Deebot X2 Omni robotic vacuums were hacked across US cities, with attackers using them to harass pets and owners with racist slurs. Ecovacs identified a credential stuffing event and blocked the IP address, but found no evidence of stolen user credentials.

FIDELITY SAYS DATA BREACH EXPOSED PERSONAL DATA OF 77K CUSTOMERS

Fidelity Investments has disclosed a data breach that resulted from a third party accessing information from its systems between August 17 and August 19 using two customer accounts that they created. According to data breach filings, the attacker was able to access customer data by making fraudulent requests against an internal database and retrieving images of documents pertaining to Fidelity customers. Fidelity disclosed that the breached data includes customers' social security numbers and driver's licenses.

INNOVATIVE SECURITY SOLUTIONS: KEY INSIGHTS FROM PASSWORD MANAGEMENT RESEARCH

This blog covers the latest research on password security, with new compelling ideas, unexpected discoveries, and questions for future exploration.

1 BUG, $50,000+ IN BOUNTIES, HOW ZENDESK INTENTIONALLY LEFT A BACKDOOR IN HUNDREDS OF FORTUNE 500 COMPANIES

This 15-year-old bug hunter discovered a critical Zendesk vulnerability that affected Fortune 500 companies. The bug exploited weak email validation in Zendesk's ticket system, allowing attackers to spoof emails and access sensitive support conversations. This security gap exposed companies using Zendesk for customer support to potential breaches of confidential information.

MITIGATING ATTACK VECTORS IN GITHUB WORKFLOWS

A comprehensive guide from OpenSSF on various GitHub Workflows vulnerabilities and their mitigations. The guide covers running untrusted code in privileged workflows, code injections, vulnerable actions, malicious releases, tag-renaming attacks, imposter commits, and unsafe use of caches. It concludes by introducing the OpenSSF scorecard CLI tool and GitHub Action, which can be used to check for these vulnerabilities in a GitHub Workflow.

👉 Reserve your seat.

BREACHRX (PRODUCT LAUNCH)

BreachRx automatically generates tailored incident response plans and provides targeted guidance to relevant stakeholders through every step of the process.

PYWALL

A small app that makes it easy to administrate simple firewall configurations.

POLYDROP

Polydrop is a Bring-Your-Own-Script-Interpreter toolkit that leverages 13 different scripting languages to deploy via trusted applications and evade detection by most AV and EDR solutions, including MS-Defender.

LOLRMM: A UNIFIED APPROACH TO RMM SOFTWARE MANAGEMENT

Living Off the Land: Remote Monitoring and Management is a project that aims to systematically catalog remote monitoring and management software. It aims to provide defenders with IoCs of software to watch out for in their environment. The project is looking for community contributors.

CAN YOU RUN AN AWS COMMAND FROM SLACK WITHOUT ANY AWS CREDENTIALS?

AWS ChatBot is an AWS service that's designed to be used with messaging services (Teams, Slack, etc) to monitor and respond to AWS events. The service can be configured using a Channel Role which will give all members of the channel the same permissions without requiring AWS credentials. If this is combined with a permissive Channel Guardrail policy, any user will be able to execute AWS CLI commands in the configured account without any permissions.

FBI CREATED A CRYPTOCURRENCY SO IT COULD WATCH IT BEING ABUSED

The FBI created its own cryptocurrency to catch fraudsters in a global scheme that involved manipulation and wash trades. The fraud involved creating a false market signal to inflate prices and profit from selling assets. Several individuals have been charged in the crypto fraud case across multiple countries.

EU ADOPTS CYBER RESILIENCE ACT

The EU has officially adopted the Cyber Resilience Act, which introduces cybersecurity requirements for products with digital elements.

AI GIRLFRIEND SITE BREACHED, USER FANTASIES STOLEN

A hacker stole a database of users' interactions with AI chatbots from the Muah.ai site.

OPENAI CONFIRMS THREAT ACTORS USE CHATGPT TO WRITE MALWARE

OpenAI confirms cyber threat actors are using ChatGPT to develop malware and enhance offensive operations.