TLDR INFORMATION SECURITY 2025-02-04

GET THE PLAYBOOK

INSURANCE COMPANY GLOBE LIFE NOTIFYING 850,000 PEOPLE OF DATA BREACH

Globe Life discovered a data breach affecting up to 850,000 individuals after an extortion attempt in October 2024. The breach, linked to its American Income Life Insurance subsidiary, potentially exposed personal, health, and insurance data.

HACKERS USE FAKE WEDDING INVITATIONS TO SPREAD ANDROID MALWARE IN SOUTHEAST ASIA

A malware campaign was spotted targeting Android users in Malaysia and Brunei with fake wedding invitations that prompt users to download an app to view the invitation. The malware is an infostealer that harvests sensitive data from messaging apps, email, and call logs. It utilizes compromised WhatsApp and Telegram accounts to spread further.

GOOGLE FIXES ANDROID KERNEL ZERO-DAY EXPLOITED IN ATTACKS

Google patched 48 vulnerabilities in February's Android security releases, including a new kernel zero-day under active exploitation. The kernel vulnerability was a privilege escalation vulnerability in the USB Video Class driver that could allow local, authenticated attackers to escalate privileges. The updates also include a fix for a critical vulnerability in Qualcomm's WLAN component.

STEALING SECONDS: WEB SKIMMER COMPROMISES CASIO UK AND GROWING NUMBER OF WEBSITES

This post dives into web skimmers and how they were used in a web skimming campaign affecting 17+ websites. The skimmer used a unique approach, operating on all pages except checkout and presenting a fake payment form when users clicked the checkout button from their cart.

SAFEGUARDING YOUR DATA WHEN USING DEEPSEEK R1 IN RAG PIPELINES

This post describes the RAG process and where authorization fits in. SpiceDB can be used to apply Relationship-Based Access Control (ReBAC), which can be used to create pre or post query filters to the pipeline. The second part of the series contains a step-by-step guide for implementing this authorization scheme using Langchain.

OPA GATEKEEPER BYPASS REVEALS RISKS IN KUBERNETES POLICY ENGINES

Gatekeeper enforces security policies in Kubernetes by using Constraints and ConstraintTemplates to control cluster access and prevent unauthorized actions. Administrators can define custom policies or use pre-built templates to enhance cluster security by leveraging Gatekeeper. However, misconfigurations in policy logic, such as omitting trailing slashes in Constraint values, can introduce security risks and allow for policy bypasses.

CONIFERS.AI (PRODUCT LAUNCH)

Conifers.ai maps incidents to a relevant security use case and uses pre-trained underlying agents and models to handle the complexities of security operations incidents.

PWN

PWN is an open security automation framework that promotes trust and innovation by leveraging pre-built modules and allowing users to create custom automation drivers. Installation is straightforward on Debian-Based Linux Distros and OSX, with instructions provided on GitHub. Users are encouraged to contribute to the framework's success by providing access to commercial security tools and following the guidelines for contributing.

AUTHENTIK

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It supports various protocols like OAuth2 and LDAP for easy integration with existing environments. The product offers user-friendly dashboards and comprehensive documentation for easy installation and configuration.

I FOUND A GAME EXPLOIT THAT LETS HACKERS TAKE OVER YOUR PC

A Remote Code Execution vulnerability was found in Marvel Rivals that allows attackers on shared networks to exploit the game's unverified hotfix system. The risk is heightened as the game runs with admin privileges.

OWASP NON-HUMAN IDENTITIES TOP 10: FORGING A NEW STANDARD IN CLOUD SECURITY

The OWASP recently launched a new project called the OWASP Non-Human Identities Top 10 to categorize the most common vulnerabilities affecting non-human identities. This post includes an overview of each vulnerability class as well as additional insights from the Orca Research Pod. It concludes with recommendations on how to prevent these vulnerabilities, such as using JIT provisioning, rotating secrets, and mapping third-party integrations.

AWS DATASYNC ADDS SUPPORT FOR KERBEROS AUTHENTICATION

AWS has added support to DataSync SMB locations for Kerberos authentication. DataSync is used for syncing data between AWS services, on-prem networks, or multiple clouds using SMB. Previously, only NTLM authentication was available.

2024 TRENDS IN VULNERABILITY EXPLOITATION

768 vulnerabilities were reported as exploited in the wild in 2024, up from 639 CVEs in 2023, registering a 20% increase year-over-year.

ALPINE LINUX SEEKING SUPPORT AFTER EQUINIX METAL SUNSETS

Alpine Linux is seeking infrastructure support for the project since its previous provider is sunsetting their bare metal hosting service.

HACKERS HIDE MALWARE IN FAKE DEEPSEEK PYPI PACKAGES

Researchers discovered malicious malware hidden in fake DeepSeek PyPI packages targeting developers and AI enthusiasts stealing sensitive data from users' systems.