TLDR INFORMATION SECURITY 2024-10-30

Download the report from Flashpoint →

ADMINS BETTER SPRING INTO ACTION OVER LATEST CRITICAL OPEN SOURCE VULN

CVE-2024-38821 is a new critical vulnerability that affects Spring WebFlux applications with specific configurations. While rated 9.1 CVSS by Spring, Red Hat considers it moderate (7.4) due to limited scope. It only impacts apps using WebFlux with static resources and non-permitAll authorization rules.

CHATGPT JAILBREAK: RESEARCHERS BYPASS AI SAFEGUARDS USING HEXADECIMAL ENCODING AND EMOJIS

ChatGPT's safety controls can be bypassed using malicious instructions encoded in hexadecimal format. The vulnerability was disclosed through Mozilla's 0Din bug bounty program. It represents another example of prompt injection bypassing AI safeguards.

FREE, FRANCE'S SECOND LARGEST ISP, CONFIRMS DATA BREACH

Free, which has 22.9M subscribers, reported that it suffered a data breach. The threat actor is auctioning the data on BreachForums, claiming that it contains IBAN numbers for almost a third of France's population. Free stated that the threat actor gained access to an administrative tool but was not able to access encrypted passwords, bank card information, or communications content.

WHAT MAKES A “GOOD” DETECTION?

The Shannon Signal Score is a way to combine qualitative and quantitative metrics to evaluate the quality of a signal based on the organization's context and the specifics of the threat. It combines qualitative and quantitative metrics to evaluate signal quality by considering threat alignment, detection integrity, operational costs, impact potential, and utility. The score uses weighted components including Threat Alignment and Coverage (measuring detection's threat alignment and attack surface coverage), Detection Integrity (quantifying effectiveness), Operational Cost (maintenance and false positive overhead), Impact and Risk Potential (threat impact assessment), and Utility (organizational value).

STRENGTHENING LOCAL ADMIN SECURITY IN WINDOWS 11 WITH LOCAL ADMIN PROTECTION

When using a local admin account in Windows, users are provided with both a limited user token and an elevated admin token which can potentially be stolen by malware on the system. Windows 11 recently introduced the Local Admin Protection or ShadowAdmin protection to solve this issue. In this system, a ShadowAdmin account is created for each local admin account, and when a process needs admin privileges, the task is run in an isolated context by the ShadowAdmin user. This post includes instructions to enable the feature and detailed technical details of how the Local Admin Protection flow works.

REFERENCE ARCHITECTURE FOR CONFIDENTIAL DATA PROCESSING IN A TRUSTED EXECUTION ENVIRONMENT

Trusted Execution Environment (TEE) architectures are designed to ensure privacy, security, and transparency for personal data processing. TEE solutions use hardware isolation, data encryption, and privacy policies to protect sensitive information. Different use cases, such as data minimization and data aggregation, can benefit from TEE-based solutions.

financial services. Watch on-demand

AUTOKAKER

Automated vulnerability discovery and refactoring using LLMs.

EASYDMARC (PRODUCT LAUNCH)

EasyDMARC protects domain and email infrastructure, ensuring emails sent from a domain are legitimate. This helps prevent phishing attacks while improving overall email deliverability.

SIMURAI

SIMurai provides a software SIM implementation for security researchers to explore and experiment with SIM cards.

THE STRAVA PROBLEM: HOW THE FITNESS APP WAS USED TO LOCATE THE WORLD'S MOST POWERFUL PEOPLE

Strava exposed world leaders' locations through its bodyguards' activity data. An investigation tracked the movements of US Secret Service agents protecting Biden and Trump, among others.

CROWDSTRIKE, DELTA SUE EACH OTHER OVER FLIGHT DISRUPTIONS

CrowdStrike and Delta Air Lines are suing each other over the July software update that caused global computer crashes. Delta claims the untested update cost $500 million, disrupted 1.3 million travelers, and canceled 7,000 flights. CrowdStrike denies responsibility, claiming Delta's response worsened the situation.

FIDO ALLIANCE PUBLISHES NEW SPECIFICATIONS TO PROMOTE USER CHOICE AND UX FOR PASSKEYS

The FIDO Alliance has published a draft of a new standard for the transfer of credentials (passwords, passkeys, etc) between credential managers securely. Currently, when a user wants to transfer credentials from one credential manager, the transfer generally takes place insecurely in the clear. The draft is not ready for implementation yet and is open for comments on the FIDO Alliance's GitHub page.

INTERNATIONAL LAW ENFORCEMENT OPERATION DISMANTLED REDLINE AND META INFOSTEALERS

A global law enforcement operation dismantled RedLine and Meta infostealers, seizing their infrastructure and making arrests.

NEW RESEARCH REVEALS SPECTRE VULNERABILITY PERSISTS IN LATEST AMD AND INTEL PROCESSORS

Both AMD and Intel processors are still vulnerable to Spectre attacks - users are advised to update their intel-microcode or install kernel updates to mitigate the risk.

FIVE EYES LAUNCH SHARED SECURITY ADVICE CAMPAIGN FOR TECH STARTUPS

Five Eyes intelligence partnership launched shared security guidance called Secure Innovation to protect tech startups from nation-state threats.