TLDR INFORMATION SECURITY 2025-01-22

Download the Gartner report from SUSE →

BITBUCKET SERVICES “HARD DOWN” DUE TO MAJOR WORLDWIDE OUTAGE

Atlassian reported a major outage affecting Atlassian Bitbucket Cloud customers. Impacted services included the website, API, git via HTTPS and SSH, Webhooks, source downloads, pipelines, git LFS, email delivery, purchasing and licensing, and signup. Bitbucket has managed to restore services and disclosed that the issue was due to saturated database connections. A full postmortem will be published.

7-ZIP FIXES BUG THAT BYPASSES WINDOWS MOTW SECURITY WARNINGS

7-Zip has released a patch for a vulnerability that could allow maliciously crafted archives to bypass Windows MotW protection. Mark of the Web (MotW) is a flag that alerts users and the operating system that a file may have come from an untrusted source and prompts for permission before running. In this vulnerability, 7-Zip failed to propagate the MotW from the archive to the extracted files.

WINDOWS BITLOCKER - SCREWED WITHOUT A SCREWDRIVER

This blog post discusses how to exploit a vulnerability in BitLocker-encrypted Windows systems through a bootloader downgrade and Secure Boot bypass. By downgrading the bootloader, attackers can gain full read/write access to the encrypted disk without changing the target system. The exploit highlights the importance of Secure Boot and the potential risks associated with default BitLocker configurations.

UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

Archive Path Traversal is a vulnerability that can occur when extracting an archive file if the implementation does not properly check that filename sequences don't exit the archive (ex: ../../evil). An intern at Doyensec created a project that provides Semgrep rules as well as a playground with various malicious archive files and vulnerable implementations to demonstrate this vulnerability. The post concludes by discussing path sanitization and path validation as possible mitigations.

UNIQUE 0-CLICK DEANONYMIZATION ATTACK TARGETING SIGNAL, DISCORD, AND HUNDREDS OF PLATFORMS

An attacker discovered a method to find a person's location within a 250-mile radius through a unique 0-click deanonymization attack on platforms like Signal and Discord. By exploiting Cloudflare caching, the attacker could pinpoint a target's location by causing them to load a resource that gets cached in a local datacenter. While Cloudflare patched the bug, the attack shows how infrastructure designed for performance can be used for tracking, highlighting ongoing risks for users.

SUMMITING THE PYRAMID: BRING THE PAIN WITH ROBUST AND ACCURATE DETECTION

Summiting the Pyramid introduces a methodology to score analytics for robust detection against adversary behavior, aiming to make it harder for adversaries to hide. The framework helps defenders build accurate and resistant detections using a combination of specificity and exclusion criteria. It also provides guidance on creating robust detections for both host-based and network data.

EVILKNIEVELNOVNC

EvilKnievelnoVNC can be used for scalable and semi-automated MFA-phishing through a "browser-in-the-middle" approach. It includes features like concurrent sessions, victim-specific URLs, and real-time monitoring. Users are advised to use the tool responsibly, customize settings, and conduct tests before usage.

CYBERBRO (WEB APP)

Cyberbro is a user-friendly application for checking the reputation of online observables like IP addresses and URLs. It integrates with multiple services like VirusTotal and Google Safe Browsing to provide detailed reports efficiently. Users can easily deploy Cyberbro using Docker and customize it with API keys from different services.

GLIBC_HEAP_EXPLOITATION_TRAINING

This GitHub repository offers resources for a glibc Malloc heap exploitation course by Maxwell Dulin and Security Innovation. It includes free videos, slides, and exercises for learning about heap exploitation. The training covers various techniques and modules.

3 TAKEAWAYS FROM RED TEAMING 100 GENERATIVE AI PRODUCTS

Microsoft founded its AI red team in 2018 to address the growing landscape of AI security and threats. Generative AI systems can be vulnerable to both existing/traditional security vulnerabilities as well as novel ones. Humans will be necessary to augment Generative AI systems with subject matter expertise, emotional intelligence, and cultural context. Both technical and nontechnical, defense-in-depth approaches will be necessary to protect Generative AI systems.

PRODUCT SECURITY BAD PRACTICES

A list from CISA of product security bad practices for software manufacturers with recommendations on how to fix the issues. The first set of product practices focuses on using memory-unsafe languages, usage of default or hardcoded credentials, usage of dependencies with critical vulnerabilities, and unsafe cryptography. The second set focuses on security practices such as supporting MFA and providing access to logs that would enable intrusion detection. The last set focuses on organizational practices such as having a VDP and publishing CVEs and EoL timelines.

MALICIOUS EXTENSIONS CIRCUMVENT GOOGLE'S REMOTE CODE BAN

This blog post discusses how malicious extensions found ways to hide their harmful functions in Chrome Web Store, despite Google's restrictions. Several extensions, like Phoenix Invicta and Sweet VPN, were discovered using obfuscated code and accessing sensitive data. Domain names associated with these malicious extensions were identified, hinting at potential spying and fraud activities.

CLOUDFLARE MITIGATED A RECORD BREAKING 5.6 TBPS DDOS ATTACK

Last October, Cloudflare mitigated a 5.6Tbps UDP-based DDoS attack from a 13k Mirai botnet that lasted 80 seconds.

MICROSOFT TEAMS VISHING ATTACKS TRICK EMPLOYEES INTO HANDING OVER REMOTE ACCESS

Ransomware groups are conducting sophisticated social engineering attacks by bombarding employees with spam emails and then posing as IT support on Microsoft Teams to trick them into granting remote access to their computers.

REDLINE, VIDAR, AND RACCOON MALWARE STOLE 1 BILLION PASSWORDS IN 2024

Over 1 billion passwords were stolen by malware in the past year, including commonly used weak passwords like "123456."