TLDR INFORMATION SECURITY 2024-11-15

>> Get a Free Demo

>> Learn More about NIS2

AMERICAN DEBT RELIEF SERVICE EXPOSES 1.5M

Set Forth, a debt relief firm, has disclosed a data breach affecting 1.5M individuals. The breached data includes names, SSNs, addresses, and dates of birth. Set Forth plans on taking steps to prevent future attacks such as deploying endpoint monitoring and performing global password resets. It is offering 12 months of free access to identity theft services by Cyberscout. Some lawyers are pursuing class action lawsuits.

MICROSOFT POWER PAGES LEAK MILLIONS OF PRIVATE RECORDS

Microsoft Power Pages websites are exposing sensitive data due to poorly configured access controls. The low-code platform, used by over 100 million users across various industries, offers security features that many developers aren't implementing properly. There are widespread data exposure risks on these sites.

210,000 IMPACTED BY SAINT XAVIER UNIVERSITY DATA BREACH

Saint Xavier University reported a data breach affecting 212,267 people between June and July 2023. Alphv/BlackCat ransomware claimed responsibility for the breach. It has been confirmed that personal data including SSNs was compromised.

MODELEAK: PRIVILEGE ESCALATION TO LLM MODEL EXFILTRATION IN VERTEX AI

Palo Alto Networks discovered two vulnerabilities in Google's Vertex AI platform: privilege escalation through custom jobs and model exfiltration via malicious models that could expose sensitive AI models and data. This post dives into the vulnerabilities and how they were identified.

WHAT I'VE LEARNED: MY TOP AWS WAF TIPS FOR STRONGER PROTECTION

A collection of tips for utilizing AWS WAF most effectively. Some of the tips are common best practices such as ensuring that all external endpoints are mapped, testing rules in counting mode before fully deploying, and making sure that logging and alerting are enabled. Some other tips involve utilizing features that are not enabled by default such as bot control and rate limiting.

NPM PROVENANCE: THE MISSING SECURITY LAYER IN POPULAR JAVASCRIPT LIBRARIES

NPM provenance could have prevented the recent security incident involving the lottie-player library. Many top NPM packages lack proper provenance attestation, leaving them vulnerable to supply chain attacks. Implementing provenance can strengthen package security by verifying where and how a package was built.

WEBSITE FINGERPRINTING LIBRARY

Website Fingerprinting Library (WFLib) is a PyTorch-based library that implements 11 different website fingerprinting attacks.

GHOST

Ghost is a shellcode loader designed to evade common detection mechanisms such as kernel callbacks, stack unwinding, and memory scanning.

EVILURL

EvilURL is a Python tool designed to analyze and identify potential Internationalized Domain Name (IDN) homograph attacks. These attacks exploit the visual similarity of characters from different Unicode scripts to create deceptive domain names for phishing and other malicious purposes. EvilURL helps assess the vulnerability of domains to these attacks.

USING CLOUDFLARE ON YOUR WEBSITE COULD BE BLOCKING RSS USERS

OpenRSS has flagged an issue where Cloudflare bot management is breaking RSS readers by forcing them to attempt a human challenge that they cannot fulfill. OpenRSS has suggested that domain admins could attempt to allowlist RSS readers by User Agent on reader IP but called upon Cloudflare for a more comprehensive solution. OpenRSS' latest update on the issue states that it is working with Cloudflare to become a “verified bot” but is still trying to press Cloudflare for a more comprehensive and universal solution.

PYPI NOW SUPPORTS DIGITAL ATTESTATIONS

In an effort to enhance supply chain security, PyPi has added the ability for package maintainers to publish digital attestations with their packages. Attestations provide an additional layer of security over digital signatures as they are tied to an identity, must be verifiable, and include a link to the upstream source. Attestations can be viewed via the new Identity API or using the web UI.

FIVE EYES INFOSEC AGENCIES LIST 2024'S MOST EXPLOITED SOFTWARE FLAWS

The Five Eyes intelligence alliance has revealed its top 15 exploited vulnerabilities - Citrix vulnerabilities lead the list, followed by Cisco IOS XE and Fortinet FortiOS issues.

EXPERTS UNCOVER 70,000 HIJACKED DOMAINS IN WIDESPREAD 'SITTING DUCKS' ATTACK SCHEME

Cybercriminals hijacked nearly 70,000 legitimate domains in the last three months for phishing and fraud schemes using a technique called Sitting Ducks.

HACKERONE URGES U.S. TO ADVOCATE FOR RESEARCH PROTECTIONS IN UN CYBERCRIME TREATY

HackerOne is advocating for the U.S. government to ensure the UN cybercrime treaty includes explicit protections for ethical hackers and security researchers, warning that without such safeguards, legitimate security research could be criminalized globally.

BITDEFENDER RELEASED A DECRYPTOR FOR THE SHRINKLOCKER RANSOMWARE

Bitdefender has released a decryptor for the ShrinkLocker ransomware, which targets BitLocker configurations to encrypt system drives.