TLDR INFORMATION SECURITY 2024-11-06

Get a free demo of vPenTest >

OKTA AD/LDAP DELEGATED AUTHENTICATION VULNERABILITY

Okta discovered a vulnerability in the DelAuth procedure for Okta AD/LDAP that allows users with usernames with a length equal to or greater than 52 characters to authenticate with only a username and a stored cache key of a previous authentication (no password needed). This issue was resolved in Okta's production systems on October 30. Okta recommends that customers review their logs from July 23 to October 30 for evidence of exploitation.

LASTPASS WARNS OF FAKE SUPPORT CENTERS TRYING TO STEAL CUSTOMER DATA

There is a new phishing campaign that targets users by posting reviews with a fake customer support number. When users call the number, a fake customer support agent instructs them to enter a code on a website that installs the ConnectWise SmartConnect software. The customer support agent then asks questions and attempts to troubleshoot the issue while an accomplice uses the SmartConnect software to steal data or install other malware. The same customer support number has been seen in attacks on Netflix, Amazon, iCloud, and others.

RHYSIDA RANSOMWARE ATTACK ON COLUMBUS CLAIMED 500K VICTIMS

500,000 people in Columbus, Ohio were affected by a ransomware attack in July claimed by the Rhysida gang. The stolen personal information included names, addresses, bank details, and Social Security numbers. The city dropped a lawsuit against a security researcher who was accused of exposing sensitive data from the attack.

BREACHING THE DATA PERIMETER: CLOUDTRAIL AS A MECHANISM IN DATA EXFILTRATION

AWS CloudTrail's behavior with VPC Endpoints allowed data exfiltration through denied cross-account requests. Exploiting the vulnerability requires creating a DynamoDB table with specific resource policies and using custom user-agents to smuggle data through CloudTrail logs. While now patched, the vulnerability demonstrates how CloudTrail's inconsistent logging behavior across services can be exploited for data exfiltration.

HOW WE USE DATADOG FOR DETECTION AS CODE

This blog post outlines DataDog's Detection as Code (DaC) workflow, Terraform repository structure, and testing strategy. The DataDog team's process involves defining a query in the UI, exporting the detection to Terraform from the UI, committing it to source code with tests based on Stratus Red Team, and then deploying via a GitLab CI/CD pipeline. The post provides samples of rules, suppressions, tests, and Terraform configurations.

LEVERAGING WAZUH FOR ZERO TRUST SECURITY

Organizations can utilize Wazuh to build a zero trust security system that protects against cyber threats and compliance limitations of traditional security models. Zero Trust security changes how organizations handle security by continuously analyzing access requests and monitoring every device and user. Companies adopt Zero Trust security to protect against cyber threats and compliance limitations of traditional security models.

PINGGY

Pinggy is a tool that can create SSH tunnels over the public Internet without the need to download any binaries. There is a free plan that allows for custom domains and free persistent URLs for 7 days.

VULNERABLE APPS

Vulnerable Apps is a sample repository that includes over 100 examples of vulnerable apps that can be used for educational or training purposes.

ISCARIOT SUITE (GITLAB REPO)

The Iscariot Suite is a collection of tools that enhances and augments trusted open-source and commercial Blue Team/Sysadmin products, turning them into traitor-ware to achieve offensive security goals.

HOW TO BUILD A SECURITY GUARDIANS PROGRAM TO DISTRIBUTE SECURITY OWNERSHIP

AWS has developed a Security Guardians program that empowers builders to make security decisions to enable security efforts (threat modeling, security reviews, etc) at scale. AWS has defined five steps to creating a security guardians program: set the program vision, identify innovators with a passion for security, define the behaviors that guardians will be expected to perform, maintain guardians' interest by providing opportunities to learn new skills and potential for career advancement, and measure the success of the program by gathering feedback as well as other metrics.

WHEN AI GETS HIJACKED: EXPLOITING HOSTED MODELS FOR DARK ROLEPLAYING

Attacks on GenAI infrastructure like AWS Bedrock have increased, with attackers hijacking models for dark roleplaying applications. Permiso discovered attackers hosting a sexual roleplaying chatbot using hijacked LLM infrastructure in AWS. The attacker bypassed content filters to enable sexual and violent content, including potentially illegal material.

DOCUSIGN'S ENVELOPES API ABUSED TO SEND REALISTIC FAKE INVOICES

Threat actors are using DocuSign's Envelopes API to send fake invoices impersonating well-known brands like Norton and PayPal. Attackers are bypassing email security protections to trick recipients into e-signing these documents to authorize payments. This large-scale abuse of the API has been reported to DocuSign.

INTERPOL CYBER OPERATION TAKES DOWN 22,000 MALICIOUS IP ADDRESSES

A global INTERPOL operation involving law enforcement agencies from 95 countries took down 22,000 malicious IP addresses linked to cyber threats.

GOOGLE CLOUD TO ENFORCE MULTI-FACTOR AUTHENTICATION BY 2025 FOR ALL USERS

Google Cloud will require all users to use multi-factor authentication by the end of 2025 to enhance security.

FBI SEEKS PUBLIC HELP TO IDENTIFY CHINESE HACKERS BEHIND GLOBAL CYBER INTRUSIONS

The FBI is seeking the public's help to identify Chinese hackers responsible for cyber intrusions that targeted companies and government entities.