Parse notes
Banshee Stealer, a macOS malware-as-a-service targeting browsers and crypto wallets, shut down after its source code leaked online. Developed by Russian hackers in August 2024, the malware's GitHub-published code may increase macOS cybersecurity threats.
A North West England NHS trust experienced a cybersecurity incident, forcing sites to revert to pen-and-paper operations. Systems were isolated and some appointments were affected. The trust is working with national cybersecurity services to restore normal operations.
Researchers at ESET discovered the first-ever UEFI bootkit (titled Bootkitty) targeting Linux devices when it was uploaded to VirusTotal. Bootkitty hooks UEFI security authentication protocols. It then hooks various GRUB functions to turn off kernel signature verification and intercepts the Linux kernel's decompression process to allow for loading malicious kernel modules. Bootkitty replaces the first environment variable to always load the malicious library at process startup. The bootkit relies on self-signed certificates, specific byte-pattern matching, and hardcoded offsets, so it will only work on specific GRUB and kernel versions. It is still likely in development.
Terraform automation platforms like Atlantis and Terraform Cloud are very popular for creating pull-request based CI/CD workflows. The typical workflow involves opening a pull-request that will trigger a read-only terraform plan which will then be reviewed and can be applied by a more privileged user with a comment. A malicious user can either inject code via the entry point of a malicious provider or through a malicious data source to bypass the read-only protections of terraform plan. This vulnerability has been confirmed on five Terraform automation platforms.
Sponsored
Give your cloud security career the boost it deserves this Black Friday. The Cloud Security Alliance [9] is offering TLDR readers 50% off the CCSK + CCZT exam and online training bundle [8], or 50% off the exam-only bundle [10]. Use discount code TLDRDOUBLEDIP24 from today at 12am PST through 12am PST Tuesday, December 3. Don't miss out!
Visio Trust collects, analyzes, and monitors artifacts from vendors to deliver real-time, comprehensive assessments and provide security teams with the security intelligence needed to make informed decisions during procurement.
Security automation content in SCAP, Bash, Ansible, and other formats.
Am I Isolated is a security posture benchmarking tool that evaluates the isolation of a given container runtime.
Thai authorities have arrested two organized fraud gangs, one of which used "SMS blasting" technology to send nearly 1 million malicious texts in Bangkok to trick recipients with fake prize messages and potential cyber threats.
Geico and Travelers were fined $11 million by New York for data breaches affecting over 120,000 individuals. The attacks compromised insurance quoting tools to steal driver's license numbers. Some of the data was used to file fraudulent unemployment claims during COVID-19.
Uniswap has launched a new bug bounty with payouts ranging from $2K to $15.4M, which could potentially mark the highest bounty payout in history.
One common implementation of the paved roads philosophy is through Terraform modules that employ secure defaults for common tasks (such as creating S3 buckets).