TLDR INFORMATION SECURITY 2024-11-11

* Turn security and compliance into a revenue accelerator

Watch the recorded session here

D-LINK WON'T FIX CRITICAL FLAW AFFECTING 60,000 OLDER NAS DEVICES

Over 60,000 older D-Link NAS devices are at risk due to a critical security flaw that won't be fixed by the company. The vulnerability allows attackers to inject commands using specially crafted HTTP requests. D-Link has advised users to retire these vulnerable products or restrict their internet access.

CISCO BUG LETS HACKERS RUN COMMANDS AS ROOT ON UWRB ACCESS POINTS

Cisco has disclosed a new critical CVE that allows for RCE on Ultra-Reliable Wireless Backhaul (URWB) access points. Attackers can exploit improper input validation on the web-based management interface of vulnerable devices by sending crafted requests to execute arbitrary commands. The vulnerability only affects URWB devices running vulnerable software with the URWB operating mode enabled which can be checked by seeing if the show mpls-config CLI command is available.

CISA WARNS OF CRITICAL PALO ALTO NETWORKS BUG EXPLOITED IN ATTACKS

The CISA warned that attackers are actively exploiting a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool for migrating firewall configurations from other vendors to PanOS. The vulnerability allows attackers with network access to takeover Expedition admin accounts and potentially access configuration secrets, credentials, and other data. All Expedition usernames, passwords, API keys, and any firewalls processed by Expedition should be rotated after upgrading. Various proof-of-concept attack chains that exploit the vulnerability to obtain admin access to Palo Alto Networks firewalls are available in the article.

A NEW ERA OF MACOS SANDBOX ESCAPES: DIVING INTO AN OVERLOOKED ATTACK SURFACE AND UNCOVERING 10+ NEW VULNERABILITIES

Researchers have discovered multiple vulnerabilities in macOS sandbox escapes that allow attackers to bypass app sandbox restrictions and execute arbitrary system commands. Exploiting overlooked XPC services in system frameworks can lead to full sandbox escapes where dropped files are not quarantined, enabling attackers to escape sandbox restrictions. Apple addressed some of these vulnerabilities in macOS Ventura 13.3 by implementing checks on incoming XPC clients to prevent unauthorized sandbox escapes.

BEYOND RCE: AUTONOMOUS CODE EXECUTION IN AGENTIC AI

Anthropic's Computer Use is a new feature of Claude that allows Claude to use a virtual environment to complete tasks on the user's computer. Claude can be deceived into running malicious web content in computer use mode. The model does include some protections against hijacking as well as some protections against running some malicious commands but can still be “phished” to execute arbitrary commands. Claude can be convinced to curl an arbitrary file and pipe it to bash by a document telling it that it was a necessary codec. The model can be fooled into opening the calculator application by a remote PDF.

DELEGATING SECURITY REMEDIATIONS TO EMPLOYEES VIA SLACK

Slack interactions come in four categories: remind, alert, delegate, and respond. Remind and alert actions are more commonplace. Remind interactions remind users to take an action (such as mandatory training) and alert actions alert the security team to various alerts from other sources. There are two new categories in SlackSecOps called delegate and respond. Delegate actions involve an alert asking a user if a behavior was intentional (adding a contractor to a sensitive permission, sharing documents, etc) and only alerts the security team based on the response. Respond interactions are when a security team receives a request and can respond to it directly via Slack such as approving an access request and granting the access directly in Slack.

FLASK-VAULT

Flask-Vault is a robust library that empowers Flask applications to securely store and manage sensitive credentials.

ACSECURITY

AcSecurity is a Python module designed to scan applications for common security vulnerabilities. It checks for hardcoded secrets, dependency vulnerabilities, and code quality issues.

SAFE-HTTPX

safe-httpx is a small Python library that helps developers protect their applications from SSRF by implementing a wrapper around httpx.AsynchronousClient.get(), which performs DNS validation on the supplied URL and protects against DNS rebinding attacks.

DISCORD TERRORIST KNOWN AS “RABID” GETS 30 YEARS FOR PREYING ON KIDS

Richard Densmore was sentenced to 30 years for running online chat rooms that targeted children through gaming sites. As part of terrorist network 764, he coerced minors into self-harm, sexual acts, and violence.

A NEW IOS 18 SECURITY FEATURE MAKES IT HARDER FOR POLICE TO UNLOCK IPHONES

Apple's iOS 18 reportedly includes a new security feature that automatically reboots inactive iPhones after four days, resetting them to a more secure "Before First Unlock" state. This makes it harder for law enforcement to break into locked devices.

OPENAI LOSES ANOTHER LEAD SAFETY RESEARCHER, LILIAN WENG

OpenAI's VP of research and safety, Lilian Weng, is leaving the company after 7 years. She will leave on November 15, joining several other AI safety researchers and executives who have left the company recently. This continues a pattern of departures amid concerns about OpenAI's prioritization of commercial products over safety.

‘STEELFOX' MINER AND INFORMATION STEALER BUNDLE EMERGES

A crimeware bundle called SteelFox, active since early 2023, impersonates legitimate software like Foxit PDF Editor and AutoCAD.

BUILDING A RESILIENT CLOUD: ESSENTIAL AWS SECURITY SERVICES EXPLAINED

AWS offers a suite of security tools to boost any company's security.

HACKERS ARE STEALING TICKETS FROM TICKETMASTER ACCOUNTS

Hackers are stealing tickets from Ticketmaster accounts, causing concertgoers to lose access to their purchased tickets.