TLDR INFORMATION SECURITY 2024-11-01

CYBER ATTACK WIPES PUT DHL DELIVERY SYSTEMS

DHL is currently suffering from a cyberattack that took its delivery tracking systems offline. The attack targeted a third-party vendor used by DHL called Microlise. Microlise stated that it is working to contain the isolate and recover impacted systems but has not provided any further details.

TENS OF THOUSANDS OF TAXPAYER ACCOUNTS HACKED AS CRA REPEATEDLY PAID OUT MILLIONS IN BOGUS REFUNDS

The Canadian Revenue Agency (CRA) discovered that hackers had obtained confidential data belonging to H&R Block Canada. The attackers used the company's credentials to gain unauthorized access to Canadians' CRA accounts, change direct deposit info, submit false returns, and obtain more than $6M in funds. H&R Block Canada denies that the breach was its fault and states that it has no evidence that its systems were breached.

ITALIAN POLITICIANS EXPRESS ALARM AT LATEST DATA BREACH ALLEGEDLY AFFECTING 800,000 CITIZENS

Italian politicians are demanding stronger data protection after the discovery of a hacking scheme that breached sensitive public databases. The probe, which resulted in four arrests, revealed that 800,000 citizens' data was accessed by private investigators targeting high-profile figures.

BYPASSING NOEXEC AND EXECUTING ARBITRARY BINARIES

2024 LOOKS SET TO BE ANOTHER RECORD-BREAKING YEAR FOR RANSOMWARE — AND IT'S LIKELY GOING TO GET WORSE

Despite major law enforcement victories against ransomware groups, 2024 is set to break records for ransomware profits. Four victims have paid eight-figure ransoms, including Change Healthcare's $22M payment. This article goes into how ransomware is evolving and the continuous threat it poses.

BREAKING THE BARRIER

Spectre vulnerabilities still live in recent Intel and AMD processors, affecting speculation barriers (IBPB). The security flaw allows attackers to bypass process isolation and leak sensitive data across processes. In this article, researchers show the first practical cross-process Spectre attack, which successfully leaked root passwords.

MIND (PRODUCT LAUNCH)

Mind uses AI powered by tailored algorithms and a proprietary AI engine to classify sensitive data, assess potential risks, and automatically take prevention and remediation actions.

ZIZMOR

A tool for finding security issues in GitHub Actions CI/CD setups.

TAMEMYCERTS

TameMyCerts is a policy module for Microsoft Active Directory Certificate Services that enables security automation for many PKI use cases.

THE ENTERPRISE IDENTITY THREAT REPORT 2024

This report covers the state of enterprise identity attacks and underscores the pressing need for organizations to rethink their identity security strategies.

CHOOSING A STATIC ANALYSIS TOOL

This post introduces a SAST tool selection framework that begins with crowdsourcing recommendations and deciding between first or second generation analysis approaches. The framework covers evaluating tool compatibility with your environment, including language support, framework integration, customization options, and deployment preferences. It ensures policy and budget alignment.

AWS IDENTITY CENTER SIMPLIFIES CALLS TO AWS SERVICES WITH SINGLE IDENTITY CONTEXT

AWS has enabled the use of a single identity context to propagate the identity of users requesting access to AWS services. Prior to this release, developers that wanted to use trusted identity propagation had to call a service with separate IAM role sessions for services that can authorize access by user and a separate one for only logging the identity. Now, AWS will use the sts:identify_context to authorize user access.

MISCONFIGURED GIT CONFIGURATIONS TARGETED IN EMERALDWHALE ATTACK

Cybercriminals used automated tools in Operation EmeraldWhale to exploit misconfigured Git settings, compromising over 15,000 cloud credentials and 10,000 private repositories.

TYPOSQUAT CAMPAIGN TARGETING PUPPETEER USERS

An ongoing typosquat campaign is targeting developers of Puppeteer, Bignum.js, and cryptocurrency libraries with malicious packages.

STEAM NOW REQUIRES GAME DEVS TO DISCLOSE KERNEL-LEVEL ANTI-CHEATS

Valve now requires game developers on Steam to disclose if their games use kernel-level anti-cheat systems.