TLDR INFORMATION SECURITY 2024-12-18

HUNK COMPANION WORDPRESS PLUGIN EXPLOITED TO INSTALL VULNERABLE PLUGINS

Researchers from WPScan have discovered a remote code execution vulnerability in the WordPress plugin Hunk Companion. Hunk Companion is used to complement the features provided by ThemeHunk which is a plugin designed to install new themes. The vulnerability allows for the installation of plugins via an unauthenticated POST request. Attackers have been actively exploiting this vulnerability to install PHP droppers which allow for maintaining persistent access.

EYECARE & HEALTHTECH COMPANY EXPOSED ALMOST 5 MILLION RECORDS

Jeremiah Fowler discovered an unencrypted, non-password protected database containing 4.8 million records belonging to AI optometry software company Care1. The database contained eye exams in PDF format which included patient PII, doctor's comments, and images of the exam results. The database also included spreadsheets that contained patient addresses, personal health numbers, and other PHI. Care1 removed the database after it was notified of the exposure.

CONNECTONCALL DATA BREACH IMPACTED OVER 900,000 INDIVIDUALS

ConnectOnCall, a telehealth platform, experienced a data breach that affected over 900,000 individuals. The breach exposed personal and medical information, prompting the company to take swift action and offer identity and credit monitoring services to affected individuals. ConnectOnCall is working with cybersecurity experts and law enforcement to address the security incident.

THE CURIOUS CASE OF AN EGG-CELLENT RESUME

An in-depth look at a sophisticated campaign conducted by TA4557/FIN6 that utilized a resume lure to compromise a system. The fake resume zip contained a malicious .lnk file which was used to start an execution flow with several LOLBins payloads to establish a foothold. The threat actor then established persistence by deploying C2 software and creating a new user before performing recon to discover a target for lateral movement. The threat actor then compromised and pivoted to a Veeam backup server which they used to compromise another server. The attacker then utilized Cloudflared and Cobalt Strike for persistence but didn't perform any more actions before being evicted.

THE QUALCOMM DSP DRIVER - UNEXPECTEDLY EXCAVATING AN EXPLOIT

This technical analysis examines several vulnerabilities discovered in Qualcomm's adsprpc driver, which Google's Threat Analysis Group found was being exploited in the wild. The researchers identified six different bugs, including CVE-2024-43047, which involved a use-after-free vulnerability that could be triggered through map collisions in the driver's memory management system. By analyzing kernel panic logs from the exploit, the researchers determined that attackers were likely using inotify_event_info objects to exploit the vulnerability, highlighting how chipset drivers remain one of the weakest links in Android's security model in 2024.

PERFORMING ANDROID STATIC ANALYSIS 101-A COMPLETE GUIDE FOR BEGINNERS

This is a comprehensive guide to Android Static Analysis, which is a method of examining Android applications for security vulnerabilities without executing them. It covers several essential tools including APKTool, MobSF, Dex2jar, JD-GUI, Androguard, Ghidra, and APKleaks, explaining how each tool can be installed and used to analyze different aspects of Android applications such as permissions, hardcoded credentials, and potential security risks. The tools work together to create a robust security analysis approach, with each tool offering unique capabilities - from decompiling APKs to inspecting code and identifying vulnerabilities in the early stages of development.

CyberArk.

SKULD

Skuld is an infostealer malware that is designed for stealing user data in Discord, Browsers, Crypto Wallets, and more. The malware also includes persistence and evasion functions.

MISCONFIGURATION MANAGER

The Misconfiguration Manager repository on GitHub is a central hub for Microsoft Configuration Manager tradecraft and defense guidance. It aims to simplify SCCM attack path management for defenders and educate offensive security professionals. The project includes attack and defense matrices, techniques, and resources for the SCCM community to contribute and learn from.

MICROSOFT RECALL SCREENSHOTS CREDIT CARD NUMBERS AND SOCIAL SECURITY NUMBERS

The author of this post was investigating the efficacy of Microsoft Recall's “sensitive information” filter, which comes enabled by default in the current Windows Insider build, and found that it still captured credit card information and SSNs. The researcher tested entering credit card numbers into a Notepad file with clear text delineating it as a credit card number, filled out a PDF of a loan application in Microsoft Edge that included an SSN and other personal information, and even created an HTML page that had a text input explicitly requesting credit card information and found that Recall copied all of them. Recall did omit capturing information inputted in actual shopping sites though.

KALI LINUX 2024.4 RELEASED

Kali Linux 2024.4 has been released as the last release of the year. This release adds 14 new tools, GNOME 47 on the desktop release, a new default Python version, and increased support for the Raspberry Pi imager. The release also ends support for i386 images, disallows the installation of pip packages by default, and deprecates SSH DSA keys.

COMPROMISING OPENWRT SUPPLY CHAIN VIA TRUNCATED SHA-256 COLLISION AND COMMAND INJECTION

The blog post discusses a security vulnerability in the OpenWrt supply chain due to a truncated SHA-256 collision and command injection. The attacker exploited the truncated hash to force the server to return a malicious firmware, potentially compromising devices. The issue was reported and fixed after investigation by the OpenWrt team.

AUSTRALIAN GOVERNMENT PUBLISHES GUIDELINES FOR CRYPTOGRAPHY

According to Australia's official cyber security guidelines, traditional asymmetric algorithms (like RSA and ECDH), shorter hash lengths (SHA-224/256), and smaller AES key sizes will be deprecated by 2030 due to quantum computing threats.

AWS RE:INVENT 2024 SECURITY TALKS (YOUTUBE PLAYLIST)

A playlist containing 63 talks on security from AWS Re:Invent.