TLDR INFORMATION SECURITY 2024-12-06

👉 Register to save your spot

7-ZIP VULNERABILITY LETS ATTACKERS EXECUTE ARBITRARY CODE

7-Zip has released an update for a high (7.8) vulnerability that can allow for RCE. The vulnerability exists in the implementation of the Zstandard decompression where improper validation of user-supplied data can result in an integer underflow before writing to memory. It allows attackers to run arbitrary code under the current user.

760,000 EMPLOYEE RECORDS FROM SEVERAL MAJOR FIRMS LEAKED ONLINE

A massive data leak exposed over 760,000 employees' information from major organizations like Bank of America and Morgan Stanley. Originating from last year's MOVEit hack, the breach is attributed to the Cl0p ransomware gang. It revealed names, emails, and work details, potentially enabling sophisticated social engineering attacks.

TELECOM GIANT BT GROUP HIT BY BLACK BASTA RANSOMWARE

The Black Basta ransomware gang has attacked BT Group's Conferencing division, stealing 500 GB of sensitive data. The telecom giant claims limited impact, with core services unaffected. The leak could include financial information and even passport copies.

USING VBS ENCLAVES FOR ANTI-CHEAT PURPOSES

Virtualization-based security enclaves are a Windows 11 feature that allows code to be run in a Secure Enclave that runs at a higher privilege mode than the kernel. The author of this post decided to attempt to write a simple Pong game that would run the core game logic in a VBS enclave and only run the code to write the display and read keypresses in the user mode. The theory was that if a game could run in a VBS enclave, then an attacker would only be able to cheat if they hooked into the Windows boot chain before the VBS enclave was loaded. Ultimately, the author found that the performance and API limitations that result from using VBS enclaves makes it an infeasible option.

HOW TO USE AWS RESOURCE CONTROL POLICIES

AWS Resource Control Policies (RCPs) are like Service Control Policies (SCPs) for setting access limitations across your entire AWS Organization. RCPs help control resource sharing and enforce policy standards, making it easier to manage data perimeters and prevent undesired actions from external accounts. Deploy RCPs carefully across your organization to avoid potential issues and ensure security measures are maintained.

MOONLOCK'S 2024 MACOS THREAT REPORT

The 2024 macOS threat report by Moonlock Lab highlights a significant increase in malware targeting macOS users, with a focus on stealers. The rise of malware-as-a-service (MaaS) has made macOS threats more accessible and cost-effective, leading to an evolution in cybercriminal operations and techniques. The report emphasizes the need for users to stay vigilant as macOS malware continues to evolve rapidly and adapt to evade detection.

OVERSIGHT

Oversight is a modular LLM reverse engineering, red teaming, and vulnerability research platform. It currently has a single loader that supports loading plugins directly from Hugging Face but more are planned.

PERMCHECK

PermCheck is a little tool that checks if the files in a PHP project have the executable bit set properly.

INTRODUCING NACHOVPN: ONE VPN SERVER TO PWN THEM ALL

Amberwolf's NachoVPN is an open-source tool that demonstrates how vulnerabilities in popular corporate VPN clients can be exploited by attackers to gain remote code execution. NachoVPN simulates rogue VPN servers to showcase insecure behaviors in VPN clients and help security professionals understand and mitigate risks. Detailed advisories for vulnerabilities in clients like Palo Alto GlobalProtect and SonicWall NetExtender are also provided to aid organizations in protecting against threats.

EMPLOYEE LAWSUIT ACCUSES APPLE OF SPYING ON ITS WORKERS

An Apple employee has accused the company of privacy violations due to its monitoring of personal iCloud accounts when using personal devices for work. The employee alleges that Apple-provided devices have too many restrictions to be used, virtually forcing employees to use personal devices.

AWS ANNOUNCES DECLARATIVE POLICIES

AWS has announced a new type of management policy for AWS Organizations. Declarative policies enforce a security baseline that persists even when services add new APIs or features and when new principals or accounts are added to an Organization. Currently, declarative policies support blocking public access to VPCs, blocking public access to EBS snapshots, and various configurations for EC2 such as restricting available AMIs.

EU COUNCIL PROPOSES NEW CYBERSECURITY LAWS

The EU has adopted two new cybersecurity laws establishing a pan-European Cybersecurity Alert System and introducing certification schemes for managed security services. These measures aim to enhance cooperative threat detection, improve information sharing, and strengthen cyber resilience across member states through coordinated technological and regulatory approaches.

CRYPTO.COM LAUNCHES $2M BUG BOUNTY PROGRAM

Crypto.com has launched a bug bounty program with a maximum payout of $2M, the largest sum on HackerOne.

AWS ANNOUNCES BLOCK PUBLIC ACCESS FOR AMAZON VIRTUAL PRIVATE CLOUD

AWS introduced Virtual Private Cloud (VPC) Block Public Access (BPA) for enhanced network security, allowing administrators to block Internet traffic for their VPCs.