TLDR INFORMATION SECURITY 2024-12-02

Get the cheat sheet ↗️

PROJECTSEND CVE-2024–11680 EXPLOITED IN THE WILD

ProjectSend is a moderately popular open source web application for hosting file-sharing servers. An authentication bypass vulnerability that was discovered in January 2023 and has had Nuclei and Metasploit templates available for months has just been assigned a CVE. The delay in the assignment of the CVE is problematic as VulnCheck researchers have noted only 1% of servers being patched and evidence of active exploitation on many others.

ANNIEMAC DATA BREACH IMPACTS 171,000 PEOPLE

AnnieMac Home Mortgage experienced a data breach affecting 171,000 people, with hackers accessing personal information like names and Social Security numbers between August 21-23. The company is offering free credit monitoring. It has assured that it hasn't seen any misuse of the stolen data.

CODE FOUND ONLINE EXPLOITS LOGOFAIL TO INSTALL BOOTKITTY LINUX BACKDOOR

Researchers found a Linux malware exploit called LogoFAIL that hijacks device boot processes by bypassing Secure Boot. The weaponized code, discovered on a web server, can inject malicious firmware and potentially install a Linux bootkit, marking a shift from theoretical to real-world threat.

GAME ENGINES: AN UNDETECTED PLAYGROUND FOR MALWARE LOADERS

Check Point researchers have detected a new malware campaign that has infected over 17K machines since late June. The new campaign uses the Godot cross-platform gaming engine to execute GDScript code, which can trigger the GodLoader malware loader. The current variant of this malware employs several sandbox-evasion techniques such as checking for the presence of 3D acceleration and checking for the amount of free space available. After infection, the script adds the full C:\\ disk to the Microsoft Defender exclusion list and then downloads further malware from Bitbucket. The current variant targets Windows systems but Check Point researchers have provided PoCs for Linux and macOS.

FLYING UNDER THE RADAR - SECURITY EVASION TECHNIQUES

Cybersecurity is an ongoing cat-and-mouse game between attackers and defenders. Phishing techniques have evolved from simple credit card theft to sophisticated attacks using device mimicry, social engineering, and evasion tactics like randomized resources, multi-step redirections, and AI-powered tools to bypass traditional security measures. This post dives into these techniques.

EDR SILENCERS AND BEYOND: EXPLORING METHODS TO BLOCK EDR COMMUNICATION - PART 1

This article discusses a novel technique that blocks EDR (Endpoint Detection and Response) communications by manipulating the Windows Name Resolution Policy Table (NRPT) to redirect DNS queries for EDR domains to localhost or invalid IP addresses. The NRPT method can effectively prevent Microsoft Defender for Endpoint from sending data by manipulating DNS resolution, though it requires administrative permissions. The article also covers detection opportunities through PowerShell command execution and registry changes and suggests mitigation strategies for EDR vendors such as monitoring NRPT changes and implementing backup IP addresses for critical FQDNs.

CyberArk

ANALYSIS TOOLS (WEB APP)

Analysis Tools is a list of peer-verified linters and static analysis tools for various programming languages.

C/SIDE (PRODUCT LAUNCH)

C/side helps businesses monitor, optimize, and secure third-party scripts, improving client-side protections to prevent zero-day attacks and the exploitation of known vulnerabilities.

HUMBLE

A humble and fast security-oriented HTTP headers analyzer.

PHISHING-RESISTANT MFA SUCCESS STORY: USDA'S FIDO IMPLEMENTATION

The US Department of Agriculture (USDA) primarily uses personal identity verification (PIV) cards for authentication but found that it could not solely rely on PIV cards for situations like when there were temporary employees or for the waiting period before a PIV card can be issued. To solve these issues, users were originally given an exception policy that allowed for username and password login, which was phishing prone. To improve its systems, USDA leveraged a centralized Entra ID system to roll out FIDO MFA using either Windows Hello for Business or FIPS-140 security keys. Leveraging FIDO + SSO allowed the USDA to protect over 600 applications through gradual organizational maturity.

IMPORTANT CHANGES TO CLOUDTRAIL EVENTS FOR IAM IDENTITY CENTER

AWS IAM Identity Center is streamlining its CloudTrail events to simplify user identification in CloudTrail and enhance the correlation between IAM Identity Center users and external directory services like Okta or Microsoft Active Directory. Specifically, IAM Identity Center will replace userName and principalID fields under the user identity element in CloudTrail events with the user ID and Identity Store ARN when a user signs into the console or accesses the AWS CLI. IAM Identity Center will also be omitting the value of a group's display name in CloudTrail events when a group is created or updated. Specific examples and transition guidance are provided in the blog post.

RANSOMWARE GANGS SEEK PEN TESTERS TO BOOST QUALITY

Cybercriminals are actively recruiting cybersecurity professionals on underground forums to develop sophisticated ransomware and dark AI models. They are aiming to enhance their malware's resilience and reduce vulnerability detection, reflecting a more professional approach to malicious software development.

SPYLOAN ANDROID MALWARE ON GOOGLE PLAY INSTALLED 8 MILLION TIMES

McAfee discovered 15 malicious SpyLoan apps on Google Play that were downloaded over 8 million times, primarily targeting users in South America, Southeast Asia, and Africa with predatory loans while secretly collecting extensive sensitive data to facilitate extortion.

QNAP ADDRESSES CRITICAL FLAWS ACROSS NAS AND ROUTER SOFTWARE

QNAP's recent security bulletin addresses 9 vulnerabilities - the most critical include an authentication bypass in Notes Station 3 that allows unauthorized command execution and an OS injection flaw in QuRouter that enables remote command execution.

MEDICAL TESTING COMPANY LIFELABS FAILED TO PROTECT CUSTOMER DATA, REPORT FINDS

A 2019 ransomware attack on Canadian medical testing company LifeLabs compromised 15 million patients' lab results and 8.6 million people's personal data.