TLDR INFORMATION SECURITY 2025-01-16

👉Download it here

FORTINET WARNS OF AUTH BYPASS 0-DAY EXPLOITED TO HIJACK FIREWALLS

Fortinet is warning customers of an actively exploited vulnerability in FortiOS and FortiProxy. The vulnerability allows remote attackers to gain super admin privileges via maliciously crafted requests to the Node.js websocket module. Fortinet reports that attackers are exploiting this vulnerability to randomly generate admin or local accounts and add them to new or existing SSL VPN groups.

OVER 660K RSYNC SERVERS EXPOSED TO CODE EXECUTION ATTACKS

Google Cloud and other independent security researchers discovered 6 new vulnerabilities in rsync, one of which is critical. When two of the vulnerabilities are chained together, attackers can achieve unauthenticated remote code execution on default installations of rsyncd. BleepingComputer detected 660K exposed rsync servers on Shodan but did not verify if they were vulnerable.

THE GREAT GOOGLE ADS HEIST: CRIMINALS RANSACK ADVERTISER ACCOUNTS VIA FAKE GOOGLE ADS

Criminals are tricking Google Ads users with fake ads to steal their account credentials. The scheme involves impersonating Google Ads and leading victims to fraudulent login pages. This malicious operation impacts Google's business and affects numerous customers globally.

OWASP'S NEW LLM TOP 10 SHOWS EMERGING AI THREATS

The article discusses emerging security risks in AI-powered software development, highlighted by OWASP's Top 10 LLM vulnerabilities. Key concerns include prompt injection, supply chain vulnerabilities, sensitive data exposure, and RAG technology risks.

RELIABLE SYSTEM CALL INTERCEPTION

Traditionally, ptrace is used for system call monitoring, modifying, and faking but this mechanism suffers from being very slow as it requires two traps for each system call. The author presents an alternative mechanism that uses seccomp user notify and BPF filters to replace this functionality. The author notes that this technique suffers from time-of-check to time-of-use attacks and should not be used for security-critical decisions.

DON'T USE SESSION (SIGNAL FORK)

The author advises against using Session due to security vulnerabilities, such as the removal of forward secrecy and misuse of cryptographic keys. Session's encryption practices are criticized for reducing security measures to a mere show, making it less trustworthy compared to other messaging apps. In summary, the author strongly recommends avoiding Session due to significant security flaws.

ORCHID SECURITY (PRODUCT LAUNCH)

Orchid Security automatically discovers applications and evaluates authentication and authorization flows to pinpoint weak spots and suggest areas for remediation.

ATTACKRULEMAP

This GitHub repository maps Atomic Red Team attack simulations to detection rules like Sigma and Splunk ESCU. The project helps security professionals test attacks and evaluate detection strategies effectively. Contributions are welcome, including testing detection rules on different platforms and providing feedback for project improvement.

CISO ASSISTANT

CISO Assistant is a tool for managing cybersecurity posture, compliance, and risk assessments. It supports multiple frameworks and automates various tasks like audit management and evidence collection. The app aims to simplify cybersecurity processes and save time for security teams.

‘GOODBYE TO MY CHINESE SPY' MIGHT BE THE LAST GREAT TIKTOK TREND

The US faces a potential TikTok ban, prompting users to humorously say goodbye to their "personal Chinese spy" - a reference to data privacy concerns. Users are posting videos thanking their "spies" for curating content and monitoring them, preferring TikTok despite security concerns.

2024 CVES IN REVIEW

Analysis of 2024's CVE trends shows decreasing severity scores, with average CVSS dropping from 7.09 to 6.9. Critical and High severity vulnerabilities declined, while total reserved CVEs fell 7%. WordPress-related vulnerabilities increased significantly, though this may indicate improved security maturity rather than declining security.

CISA DIRECTOR SAYS THREAT HUNTERS SPOTTED SALT TYPHOON ON FEDERAL NETWORKS BEFORE TELCO COMPROMISES

CISA's director Jen Easterly mentioned that threat hunters found suspicious activity from Salt Typhoon on federal networks before realizing it was part of a larger Chinese hacking campaign targeting U.S. telecommunications. By identifying and seizing virtual private servers leased by the hackers, CISA gained insight into the extent of the hacking campaign against telecommunications companies and provided assistance to potential victims. The incident highlights the ongoing challenge of defending critical infrastructure from foreign adversaries like China and the need for improved cybersecurity measures in vulnerable sectors like telecommunications.

LAZARUS GROUP TARGETS WEB3 DEVELOPERS WITH FAKE LINKEDIN PROFILES IN OPERATION 99

The Lazarus Group conducted cyber attacks through fake LinkedIn profiles targeting Web3 developers to distribute malware and victims were tricked into cloning malicious GitLab repositories, allowing the attackers to steal sensitive data.

NICKEL TAPESTRY INFRASTRUCTURE ASSOCIATED WITH CROWDFUNDING SCHEME

CTU researchers found connections between North Korean IT worker schemes and a 2016 crowdfunding scam, linking them to the NICKEL TAPESTRY threat group.

LEGITIMATE CHROME EXTENSIONS ARE STEALING FACEBOOK PASSWORDS

A recent attack targeted popular Chrome extensions to steal Facebook passwords and other data.