TLDR INFORMATION SECURITY 2024-10-28

Don't miss out — register now!

FORTINET WARNS OF NEW CRITICAL FORTIMANAGER FLAW USED IN 0-DAY ATTACKS

Fortinet has announced a new critical 9.8 severity CVE in the FortiManager API that allows for stealing credentials, sensitive files, and IP addresses. The vulnerability lies in an authentication bypass in the FortiManager FGFM API. Fortinet has confirmed that the vulnerability is being actively exploited and has provided updated versions, mitigations, and IoCs.

INSURANCE ADMIN LANDMARK SAYS DATA BREACH IMPACTS 800K PEOPLE

Landmark Admin, which provides back-office services to insurance companies, disclosed a breach of over 800K people's data. Landmark reported that it detected a suspicious attack on May 13 and immediately took action to cut off access. The breached data includes first and last names, Social Security numbers, tax identification numbers, driver's license numbers, part numbers, financial account numbers, medical information, date of birth, and insurance policy numbers.

NEW WINDOWS DRIVER SIGNATURE BYPASS ALLOWS KERNEL ROOTKIT INSTALLS

Attackers can bypass Windows security features and install rootkits by downgrading kernel components. Outdated software components can be introduced on fully patched systems by exploiting the Windows Update process, making them susceptible to past vulnerabilities. Microsoft has dismissed the issue and the vulnerability remains unfixed, allowing for downgrade attacks and potential rootkit deployment.

HOW AWS USES ACTIVE DEFENSE TO HELP PROTECT CUSTOMERS FROM SECURITY THREATS

AWS' active defense tool, Sonaris, works in conjunction with MadPot honeypot sensors to uncover new techniques that attackers are using to attack customer accounts (such as enumerating S3 buckets or vulnerable EC2 services) and attempts to proactively respond to them using other AWS services such as WAF, VPC, and AWS Shield. Its use led to an 83% reduction in abuse in MadPot tests. It was able to prevent more than 16k scanning attempts per hour during a Dota3 campaign in Q3 2024.

PASSWORD MANAGERS FOR SMALL & MIDSIZE BUSINESSES: ZATIK'S SAFETY BAR RATING

Zatik created a Safety Bar Rating to evaluate 5 password managers on features such as MFA, SSO, RBAC, audit logs, force logout, password complexity policies, encryption in transit, and support for data destruction requests. Zatik found that BitWarden had all of the features that it was testing for other than force logout and that LastPass and 1Password supported all 9 features. Zatik recommends distinct password managers over those in browsers or mobile devices and they can be centrally managed. Zatik concludes by addressing the LastPass hack by showcasing some of the efforts that LastPass has taken to improve security since then.

HOW I ACCESSED MICROSOFT'S SERVICENOW — EXPOSING ALL MICROSOFT EMPLOYEE EMAILS, CHAT SUPPORT TRANSCRIPTS & ATTACHMENTS

Moblig was able to access Microsoft's ServiceNow platform and view sensitive data including employee emails and support ticket attachments. The security flaw allowed unauthorized access to thousands of support ticket attachments and over 250,000 employee emails. The issue was reported to Microsoft and resolved without a bounty reward.

TRAFFICLLM

TrafficLLM is an LLM adaptation framework for enhancing LLMs for network traffic analysis.

PWNLOOK

Pwnlook is a post-exploitation tool that will give complete control over the Outlook desktop app and the emails that it is configured with.

P0 SECURITY (PRODUCT LAUNCH)

P0 provides access governance and identity security to help corporate security engineers lock down access to the cloud for users and developers.

SECURITY RESEARCH IN APPLE PRIVATE CLOUD COMPUTE

RETROFITTING ENCRYPTED FIRMWARE IS A BAD IDEA™

This blog post discusses a firmware encryption method on Lexmark printers called WTM, which interacts with kernel modules and uses netlink commands. The WTM firmware, likely developed by Marvell, handles secure boot, authentication, and key management. Its process involves analyzing kernel modules, reverse engineering the firmware, and understanding command structures for encryption operations.

THE WINDOWS REGISTRY ADVENTURE #4: HIVES AND THE REGISTRY LAYOUT

Hives are data structures that store keys, subkeys, and values for system configuration and user settings. Different types of hives, like application hives, have specific purposes and security considerations. Loading hives in Windows can be done through standard interfaces like RegLoadKey and RegLoadAppKey.

FOUR REVIL RANSOMWARE MEMBERS SENTENCED FOR HACKING AND MONEY LAUNDERING

Four members of the REvil ransomware group in Russia were sentenced for hacking and money laundering, with two also convicted of distributing malware.

OVER 70 ZERO-DAY FLAWS GET HACKERS $1 MILLION AT PWN2OWN IRELAND

The Pwn2Own Ireland 2024 hacking competition awarded over $1 million for finding 70 zero-day vulnerabilities in fully patched devices.

GOOGLE EXTENDS SOFTWARE UPDATES FOR ANDROID PHONES

Google and Samsung are extending software updates for Android phones for up to seven years by utilizing Google's Longevity GFR program, which helps manufacturers provide ongoing support by freezing chipset update requirements.