TLDR Information Security 2024-07-31

Between DSPM, AI data management, and cloud risk, it's a new era in data security. Explore the latest trends at BigID's virtual CISO summit, designed exclusively for security leaders like you.

This summit will feature a keynote by Denny's Head of Cybersecurity and Compliance and other expert-led panels focused on the cutting-edge of data security. You'll walk away with a detailed view of the landscape, best practices, and actionable takeaways for your organization.

Plus, you'll get 2 CPE credits and a raffle entrance for attending. Save your early-bird spot!

Microsoft has posted a warning about a vulnerability in domain joined ESXi hypervisors. ESXi hypervisors were found to consider any member of the AD group “ESX Admins” to have full administrative privileges. Microsoft recommends applying the latest patches. The post includes threat hunting queries.

A new version of Mandrake Android spyware infiltrated Google Play in 2022 and remained undetected for two years with over 32,000 downloads. This sophisticated spyware allows attackers to steal data, control devices, and blackmail victims. Five apps carried the malware, with AirFS being the most recent one.

Meta introduced Prompt-Guard-86M to detect prompt injection attacks in AI models. However, researchers found this guard itself vulnerable to such attacks. It turns out Meta's Prompt-Guard-86M classifier model can be asked to "Ignore previous instructions" if you just add spaces between the letters and omit punctuation.

Wiz has detected a campaign that targets exposed Selenium Grid services. The attackers are using the Selenium WebDriver API to run a Python reverse shell to download a crypto miner. Selenium warns against exposing Selenium Grid to the public Internet and enabling authentication by default.

iChano AtHome Camera is a pair of applications that enable smartphones and computers to be used as smart cameras. The applications use a custom encryption protocol instead of HTTPS. This author first attempted to crack the encryption protocol using static reverse engineering but discovered that it was using Blowfish in ECB mode. Decryption with this method didn't work, so the author utilized a Frida script to decrypt messages and hijack cameras on the network.

This blog post discusses how CISOs face urgent challenges in establishing effective security practices and provides some guidelines on how to create effective AI Cybersecurity policy. Key recommendations include prohibiting sensitive data sharing with public AI platforms, validating AI-generated information, and adopting a zero-trust approach. While AI presents risks, it also offers significant benefits when used wisely, making a thoughtful security strategy crucial for organizations navigating this evolving landscape.

RedGuard is a C2 front flow control tool with AV and EDR evasion.

Lineaje comprises a software bill of materials (SBOM) manager and an SBOM exchange, as well as a third-party risk manager and an open source risk manager, which can be used by companies that source, build, buy, or use software applications.

Arcjet's JS SDKs feature rate limiting, bot protection, email verification, and attack defense for Node.js, Next.js, Bun, and SvelteKit.

Last year saw a 429% increase in stolen data, along with an 84% increase in ransomware attacks. Is geopolitical instability to blame? How can security orgs outmaneuver adversary tactics and techniques? And what is the role of open-source intelligence (OSINT)? Download the free report now

SideWinder is targeting ports and maritime facilities in the Mediterranean Sea and Indian Ocean using phishing emails with specific themes and logos. The threat actor uses techniques like spear-phishing and document exploitation to deliver targeted implants. Malicious documents with remote template injection techniques are used to gain initial access to victims' systems.

This landmark settlement between Texas and Meta for $1.4 billion over Facebook's facial recognition feature sets a precedent for privacy rights enforcement. The lawsuit, filed in 2022, claimed the "Tag Suggestions" feature breached biometric identifiers and deceptive trade practices acts.

The Kids Online Safety Act (KOSA) has passed the Senate. This act requires online platforms to protect minors from various harms. It mandates transparency in algorithm use, opt-out options for data collection, and limits on addictive features. Critics worry about potential misuse of surveillance and censorship.

This post uncovers new cybercrime tools that pose increased threats to security, highlighting the rapid evolution of AI-powered hacking services and their potential for mass exploitation.

Crooks bypassed Google's email verification to create Workspace accounts and access third-party services - the issue was fixed within 72 hours of discovery.

New laws will require Australian businesses to disclose ransom payments to hackers to increase transparency and combat ransomware attacks.