TLDR InfoSecOctober 25, 2024

TLDR INFORMATION SECURITY 2024-10-25

6 sections17 entrieslinks blockcomplete parse

Parse notes

Subscription/account footer truncated before parsefooter_truncated

01GENERAL

UNMANAGED IOT DEVICES ARE GROWING NETWORK VULNERABILITIES

+90% of ransomware attacks leverage unmanaged devices in the network to gain access to systems and assets, according to a Microsoft report.

threatlocker.comSponsor

Save your seat: register now →

threatlocker.com

02ATTACKS & VULNERABILITIES

FAKE GOOGLE MEET CONFERENCE ERRORS PUSH INFOSTEALING MALWARE

Security researchers are warning of new ClickFix campaigns that use fake Google Meet pages to distribute malware. The ClickFix campaign works by sending users a fake Google Meet link that masquerades as a Google Meet loading room informing users of an issue with their headphones or microphones. The page then prompts users to copy and execute a Powershell command to fix the issue, which downloads malware to the device. The article includes IoCs.

bleepingcomputer.com2 min read

INTERNET ARCHIVE HACKED AGAIN DURING SERVICE RESTORATION

After recovering from a data breach and DDoS attack, the Internet Archive has reported another attack. This attack involved a compromised Zendesk token with users being notified by an attacker-sent email. Compromised information includes potentially sensitive data that was sent in support cases.

securityweek.com2 min read

MICROSOFT SHAREPOINT VULN IS UNDER ACTIVE EXPLOIT

darkreading.com2 min read

03STRATEGIES & TACTICS

HUNTING FOR REMOTE MANAGEMENT TOOLS: DETECTING RMMS

This blog post discusses hunting for Remote Management and Monitoring (RMM) tools in organizations, highlighting challenges in identifying different tools. By searching for keywords in various fields like filenames and process command lines, the likelihood of detecting RMMs increases. The query language used to search through SIEM logs helps optimize the process by attributing events to specific RMM tools based on identified keywords.

blog.nviso.eu9 min read

USING NIX TO FUZZ TEST A PDF PARSER (PART ONE)

This post discusses how Nix simplified fuzz testing by automating setup and execution with a single command. The process involved compiling the PDF reader from source, generating test inputs, and identifying bugs. Nix allows beginners to fuzz test efficiently and discover vulnerabilities in software.

mtlynch.io14 min read

SPOOFING INTERNAL PACKETS FOR MULTIHOMED LINUX DEVICES

A vulnerability in multihomed Linux devices can be exploited to spoof and inject packets into internal communication streams. This issue can be leveraged by attackers with adjacent network access to manipulate data flows on devices like NAT routers and virtual machines. Mitigations such as anti-spoofing firewall rules and socket binding can help protect against these attacks.

anvilsecure.com4 min read

04LAUNCHES & TOOLS

DLL PROXY GENERATOR

DLL Proxy Generator is a tool to create a proxy DLL for an arbitrary DLL that optionally loads a secondary DLL.

github.comGitHub repository

VULNHUNTR

Vulnhuntr leverages the power of LLMs to automatically create and analyze entire code call chains starting from remote user input and ending at server output for detection of complex, multi-step, security-bypassing vulnerabilities that go far beyond what traditional static code analysis tools are capable of performing.

github.comGitHub repository

MALLOX RANSOMWARE DECRYPTOR

Free decryption tool for Mallox ransomware that targets files encrypted in 2023 or early 2024, and which have the extensions .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx, and .xollam.

links.tldrnewsletter.com6 min read

05MISCELLANEOUS

NOT ALL TYPES OF MFA ARE CREATED EQUAL

The UK's NCSC has released updated MFA guidance to address new threats. Foremost in its guidance, the NCSC recommends using phishing-resistant factors. Additionally, the NCSC recommends only prompting for MFA when necessary and provides an example of utilizing MDM-managed laptops and mobile devices as a factor instead of requiring a prompt.

ncsc.gov.uk5 min read

HAVE YOU BEEN KEEPING UP WITH YOUR LOW CONFIDENCE DETECTIONS?

Traditionally, detection engineering focuses on prioritizing high confidence, high severity alerts to not overwhelm SOC analysts. Teams should also utilize low-confidence alerts. These alerts can be useful to provide more context to the full cyber kill chain that attackers utilized and can also detect activity that may be relevant but did not trigger a high confidence, high severity alert.