TLDR INFORMATION SECURITY 2025-02-27

Get started with ThreatSpike Blue

AUSTRALIAN IVF GIANT GENEA BREACHED BY TERMITE RANSOMWARE GANG

One of Australia's largest fertility service providers, Genea, has reported a breach in which attackers stole 940.7GB of data. Gather attackers obtained access through a Citrix server and then obtained access to the company's primary file server, DC, backup program, and BabySentry patient management system. The breached data includes full names, email addresses, phone numbers, dates of birth, emergency contacts, next of kin data, health insurance numbers, and medical history.

PYPI PACKAGE WITH 100K INSTALLS PIRATED MUSIC FROM DEEZER FOR YEARS

Socket has discovered a malicious Python package called automslc that pirates music from the Deezer streaming service via hardcoded credentials. The automslc package utilized user supplies credentials to login to Deezer or hardcoded credentials and stores downloaded files locally. Socket reported that the package has been downloaded over 100K times.

VSCODE EXTENSIONS WITH 9M INSTALLS PULLED OVER SECURITY RISKS

Two security researchers reported the ‘Material Theme - Free' and ‘Material Theme Icons - Free' to Microsoft because they seemed malicious. BleepingComputer found a heavily obfuscated release-notes.js file that upon partial deobfuscation makes reference to usernames and passwords in several places. The author of the themes denies any malicious intent and states that a dependency may have been compromised but that Microsoft should have alerted them instead of removing the package.

SECURING TOMORROW'S SOFTWARE: THE NEED FOR MEMORY SAFETY STANDARDS

This blog post, from Google's Security team, discusses the urgent need to eliminate memory safety vulnerabilities in software to enhance security and trust in technology. The authors propose a standardization framework to promote the widespread adoption of memory-safe practices and tools in the software industry. Google is actively involved in advocating for memory safety standards, developing potential standards with partners, and prioritizing memory-safe languages to reduce vulnerabilities and enhance security in its products and services.

THREE PASSWORD CRACKING TECHNIQUES AND HOW TO DEFEND AGAINST THEM

This post discusses brute force, dictionary, and rainbow table attacks to crack passwords. To defend against these techniques, users should choose strong, unique passwords and enable multi-factor authentication. Tools like Specops Policy provide an extra layer of protection by continuously scanning Active Directory against a database of over 4 billion breached passwords.

JOB PROFILES OF CERTIFIED SOC ANALYST: ROLE, RESPONSIBILITIES, AND CAREER PATH

This blog post explains the role of a SOC Analyst, which involves monitoring and responding to cybersecurity threats within organizations. Their progression requires technical skills with SIEM tools and security systems.

STREAMLINING VULNERABILITY RESEARCH WITH IDA PRO AND RUST

Marco Ivaldi of HN Security has released new tools in Rust for reverse engineering and vulnerability research in IDA Pro that leverage the IDA SDK and Binarly's idalib Rust bindings for a faster user experience. These tools, which include rhabdomancer and haruspex, help locate potentially insecure API calls and extract pseudo-code for analysis, enhancing the efficiency of vulnerability research efforts. The availability of idalib opens up opportunities for developers to create standalone analysis tools in Rust, expanding the capabilities of IDA Pro in security research.

TURBO INTRUDER SCRIPTS

A collection of Turbo Intruder scripts to emulate the 4 main types of Burp Intruder attacks - battering ram, cluster bomb, pitchfork, and sniper.

ECLIPSERECON

EclipseRecon is a powerful and stealthy web reconnaissance tool designed to uncover hidden vulnerabilities, subdomains, and intricate site structures that may otherwise remain in the dark.

OPENSSF RELEASES SECURITY BASELINE FOR OPEN SOURCE PROJECTS

The Linux Foundation's Open Source Security Foundation (OpenSSF) released a security baseline for open source projects to improve their security and trustworthiness. This checklist outlines best practices to reduce vulnerabilities and enhance project security levels. Developers are encouraged to meet at least level 1 requirements, with larger projects advised to aim for level 3.

AN ICLOUD BACKDOOR WOULD MAKE OUR PHONES LESS SAFE

The UK government asking Apple to create a backdoor in iCloud could put everyone's data at risk. This could perhaps be a coordinated effort with other “Five Eyes” countries of the United States, Canada, Australia, and New Zealand: the rich English-language-speaking spying club. Everyone can help with privacy and support companies like Apple not buckle down by enabling the Advanced Protection feature as well as being proactively involved in the policy front.

HOW AI IS CHANGING SECURITY OPERATIONS

This blog post highlights some of the challenges that AI brings to the SecOps field as well as some opportunities that it brings to defenders. Attackers can utilize AI to aid in social engineering research and crafting spear phishing emails or craft deepfakes as well as aid in developing malware. Defenders can incorporate AI Agents in their threat hunting workflows.

WINDOWS 11 KB5052093 UPDATE RELEASED WITH 33 CHANGES AND FIXES

Microsoft released the Windows 11 KB5052093 update with 33 fixes and improvements for common issues like SSH problems, File Explorer bugs, and audio volume glitches.

HACKED CRYPTO EXCHANGE BYBIT OFFERS $140M BOUNTY TO TRACE STOLEN FUNDS

Bybit is offering a total of $140 million in bounties for anyone who can help trace and freeze the funds that were stolen last week.

INCOMING DEPUTY BOSS OF HOMELAND SECURITY SAYS AMERICA'S TOP CYBER-AGENCY NEEDS TO BE REINED IN

Deputy Homeland Security nominee Troy Edgar has endorsed the dismantling of CISA's Cyber Safety Review Board, claiming the agency needed "reining in” as it had overstepped its boundaries by getting too involved in election interference investigations.