TLDR INFORMATION SECURITY 2024-10-23

👉Get NordPass for your business with 35% off

HACKERS EXPLOIT ROUNDCUBE WEBMAIL FLAW TO STEAL EMAIL CREDENTIALS

Russian cybersecurity company Positive Technologies has detected an ongoing campaign that exploits a medium-severity stored XSS flaw in Roundcube webmail. The flaw lies in the improper processing of SVG elements in emails which bypass syntax checks. The threat actor sends an email with no visible text and a .doc attachment which contains a hidden payload disguised as a href that injects an unauthorized login form into the HTML message.

50,000 FILES EXPOSED IN NIDEC RANSOMWARE ATTACK

Nidec suffered a ransomware attack in August where hackers stole 50,694 files after obtaining domain credentials. It refused ransom demands, so attackers have leaked its documents on the dark web.

CISCO DISABLES DEVHUB ACCESS AFTER SECURITY BREACH

Cisco has disabled public access to DevHub as it investigates a breach from earlier this month. The attackers have sold customer data, which includes source code, credentials, and certificates from major companies.

AUTOMATING CLIENT SIDE PATH TRAVERSAL DISCOVERY

Client Side Path Traversal (CSPT) is a vulnerability that occurs when a client can provide path traversal characters (../) in a request to modify a different request. This can be chained with Open Redirect vulnerabilities to control the response returned to the client. This post describes the process of creating a Chrome extension to automate the discovery of CSPT vulnerabilities using dynamic analysis.

APPLYING LLMS AND GENAI TO CYBERSECURITY

This post shares various resources and tactics for applying LLMs and Generative AI to CyberSecurity. It highlights how LLMs are being used for security tasks, sparking interest in the field. Various studies and projects are exploring LLM capabilities in code analysis and bug hunting. The potential of augmenting language models with tools and agentic approaches can be instrumental for various cybersecurity jobs.

FINDING VULNERABILITY VARIANTS AT SCALE

BlackWing security found vulnerabilities in a JPEG processing program called jpeg-recompress by analyzing its source code. The company identified two vulnerabilities in the program related to buffer overflow and integer overflow. It discovered over 40 projects with similar vulnerabilities by using automated and manual searches.

HYDDEN (PRODUCT LAUNCH)

Hydden creates a single data layer across IAM, identity governance and administration (IGA), privileged access management (PAM), and identity threat detection and response (ITDR) solutions.

CODEPENDENCE

Codependence is a JavaScript utility for checking dependencies to ensure they're up-to-date or match a specified version.

VULNCOV

Vulncov is a tool that correlates Semgrep SAST scans with Python test code coverage to determine which unit tests run vulnerable code to help prioritize findings. It includes a self-hosted LLM that suggests bug fixes.

CHALLENGES WITH IP SPOOFING IN CLOUD ENVIRONMENTS

IP spoofing is an attack technique where attackers report an incorrect IP address in the X-Forwarded-For header to bypass rate limiting or IP based restrictions. Nearly a third of organizations that use Datadog's product receive X-Forwarded-For headers but 25% of those also receive suspicious X-Forwarded-For headers. To defend against this attack, use trusted vendor headers, add a custom header at the edge, or instruct frameworks to parse the header to the depth appropriate for your environment.

MANDIANT: 70% OF EXPLOITED FLAWS DISCLOSED IN 2023 WERE ZERO DAYS

Analysts from Google's Mandiant warn that threat actors are getting more sophisticated. Specifically, 70% of the vulnerabilities that were reported as being actively exploited in 2023 were zero days. Mandiant also reported that the time to exploit a newly disclosed vulnerability has dropped to 5 days from 32 days in 2021-2022.

SIGN-IN TO AWS CONSOLE MOBILE APPLICATION WITH AN AWS ACCESS PORTAL OR THIRD-PARTY IDP URL

AWS has added the ability to sign in via SSO to the AWS Console mobile app. Once a user provides their sign-in URL in the application, it will redirect to the sign-in URL and provide a similar experience as the web login flow. This post includes a walkthrough of the new sign-in flow.

INTRODUCING GOOGLE CLOUD'S NEW VULNERABILITY REWARD PROGRAM

Google Cloud has launched a Vulnerability Reward Program that offers up to $101,010 for security researchers who discover vulnerabilities.

STATE OF CLOUD SECURITY 2024

Overall, security practices have improved, but risky credentials and misconfigurations across infrastructure remain as the major vulnerabilities for AWS, Azure, and Google Cloud.

EXPOSED AND ENCRYPTED: INSIDE A MALLOX RANSOMWARE ATTACK

This post discusses a scenario where Mallox ransomware was deployed on a server due to a misconfiguration allowing unauthorized access.