TLDR INFORMATION SECURITY 2024-12-16

Prevention_

YEARLONG SUPPLY-CHAIN ATTACK TARGETING SECURITY PROS STEALS 390K CREDENTIALS

A sophisticated supply-chain attack has been targeting security and technical personnel for a year using Trojanized open-source software from GitHub and NPM to steal login credentials. The campaign employs infected packages and spear phishing techniques to infiltrate researchers' devices with a stealthy backdoor.

RHODE ISLAND'S ONLINE BENEFITS SYSTEM SHUTS DOWN AFTER CYBERATTACK

Rhode Island's RIBridges public assistance system was taken offline after a cyberattack potentially exposing personal data of hundreds of thousands of people. The state plans to provide call center support, credit monitoring, and alternative application methods while investigating the breach.

390,000+ WORDPRESS CREDENTIALS STOLEN VIA MALICIOUS GITHUB REPOSITORY HOSTING POC EXPLOITS

A GitHub repository hosting a WordPress tool was used to steal over 390,000 credentials by a threat actor named MUT-1244. The attacker targeted security researchers and pentesters, exfiltrating sensitive data like SSH keys and AWS access keys. The malicious campaign involved phishing, trojanized GitHub repositories, and a cryptocurrency miner payload.

LINUX LKM PERSISTENCE

This post discusses different methods to establish persistence with a Linux loadable kernel module type rootkit. Two simple methods that are briefly touched upon are to use a user space persistence mechanism that runs with root privileges to load the module or add the module to /etc/modules. Instead, this author explores using a systemd-modules-load file with the Diamorphine LKM rootkit which will hide any file that contains a given magic string from the kernel to hide the configuration file. The author then describes how timestamps or checking for a tainted kernel can be used to detect this attack.

SUPPLY-CHAIN ATTACK ANALYSIS: ULTRALYTICS

The Ultralytics Python project was recently targeted in a supply-chain attack through compromised GitHub Actions workflows and PyPI API tokens. PyPI experts were able to analyze the attack and emphasize the importance of securing software forges and building workflows for open source projects. To improve PyPI security, developers are advised to use trusted publishers, audit workflows for security vulnerabilities, and follow best practices like using 2FA and rotating secrets.

DETECTING WIFI DUMPING VIA DIRECT WINAPI CALLS AND INTRODUCTION TO IMMUTABLE ARTIFACTS

Many detection rules rely on artifacts that are mutable by the attacker. This author sought to investigate detections that relied on immutable artifacts with the example of an attacker that enumerated WiFi networks and dumped passwords directly via the WinAPI as opposed to using tools such as netsh. The author initially ran into issues as the program they wrote to enumerate networks did not cause any obvious registry calls, spawn netsh, or read the Wlansvc\Profiles\Interfaces file. The only method that the author found to detect the attack was by enabling the noisy Sysmon Event ID 7 where a rule can be created by searching for an event where the ImageLoaded is wlanapi.dll and the Image contains an unfamiliar .exe.

State of Cloud Security 2024 report

SILENT PUSH (PRODUCT LAUNCH)

Silent Push proactively detects potential cyber threats using an automated global intelligence system to monitor and predict attack patterns, helping organizations defend against various digital threats through advanced monitoring and data enrichment techniques.

VANIR

Vanir is a source code-based static analysis tool that automatically identifies the list of missing security patches in the target system. By default, Vanir pulls up-to-date CVEs from Open Source Vulnerabilities (OSV) together with their corresponding signatures so that users can transparently scan missing patches for an up-to-date list of CVEs.

JWT-CLI

A CLI tool to encode and decode JWTs, written in Rust. It works as a pipe command and can be helpful to decode access tokens from other commands like curl.

UNITEDHEALTH'S OPTUM LEFT AN AI CHATBOT, USED BY EMPLOYEES TO ASK QUESTIONS ABOUT CLAIMS, EXPOSED TO THE INTERNET

Optum restricted access to an internal AI chatbot after it was found publicly accessible online. The chatbot, designed to help employees handle insurance claims, did not contain sensitive data but raised concerns about AI's role in claims processing.

GERMANY SINKHOLES BOTNET OF 30,000 BADBOX-INFECTED DEVICES

Germany's cybersecurity agency reported that 30,000 media devices were infected with BadBox malware before sale. The agency has sinkholed communication with command servers, advised internet providers, and recommended users disconnect and scan potentially compromised devices from pre-infected Android equipment.

CONFIDENTIAL COMPUTING AT 1PASSWORD

To ensure the security of its customers' secrets, 1Password utilizes end-to-end encryption to ensure that the data is not accessible by anyone, even at 1Password. To achieve this goal, 1Password utilizes AWS Nitro Enclaves to create a cryptographically verifiably, isolated confidential compute environment. 1Password publishes each enclave release to a public transparency log and then verifies the attestation when the client opens an encrypted channel. This ensures that no 1Password or AWS employees can access the code or communications running in the enclaves.

CISA WARNS WATER FACILITIES TO SECURE HMI SYSTEMS EXPOSED ONLINE

CISA and EPA urge water facilities to protect online interfaces for HMIs that help operators control industrial machines remotely from cyberattacks.

SERBIAN POLICE USED CELLEBRITE TO UNLOCK, THEN PLANT SPYWARE, ON A JOURNALIST'S PHONE

Amnesty International has reported that Serbian authorities used Cellebrite to unlock a journalist's phone and plant spyware for surveillance.

FTC WARNS OF ONLINE TASK JOB SCAMS HOOKING VICTIMS LIKE GAMBLING

The FTC warns about a rise in online job scams, called "task scams," that resemble gambling, where victims are lured into earning money by completing simple tasks and depositing their own money for higher earnings.