TLDR Information Security 2024-09-04

Transport for London (TfL) is addressing a cybersecurity incident affecting its internal systems. While no customer data breach or service disruption has been reported, TfL is working with government agencies to respond.

Fota Wildlife Park is notifying customers who bought tickets on the park's website since May 12 of a breach. Users are being advised to change any passwords associated with the site, be aware of phishing attempts to their email, and notably to cancel any debit or credit cards used. The park has not revealed exact details on what data was stolen, how the data was stolen, or the number of customers impacted

The YubiKey 5 hardware token for two-factor authentication has a cryptographic flaw that makes it vulnerable to cloning attacks when physically accessed by an attacker. Yubico has confirmed that all YubiKey 5 models are susceptible to cloning due to a side channel vulnerability in the Infineon microcontroller used in various authentication devices. Updating firmware on affected YubiKeys is not possible, leaving them permanently vulnerable to potential attacks.

This article provides a comprehensive overview of the various tools that are available to fine tune AWS IAM access. It suggests some important SCPs such as limiting access to specific regions and blocking root user access, establishing zones of trust, utilizing permissions boundaries, using IAM Access Analyzer, and separating humans and non-human identities. The article suggests starting with a more permissive set of permissions to understand how your team utilizes AWS and then limit permissions from there.

The first part in a series on Linux detection engineering from Elastic Labs, which focuses on installing and configuring auditd. The first part of the article lists installation methods for auditd and explains the types of rules that auditd supports. Control type rules configure the auditd process, file system rules watch files for read, write, and execute actions, and system call rules are the powerhouse of auditd and specify which syscalls to monitor and log. The second part focuses on how to use the Auditd Manager Elastic integration to install and configure auditd at scale and presents Elastic alerts for various scenarios.

This post explains how to use AWS Vault to securely store AWS credentials leveraging the AWS Session Token Service to provide temporary, limited-privilege access to AWS resources in typical AWS account patterns, reducing credential exposure risk.

The rapid adoption of M365 Copilot and other enterprise LLMs requires new security approaches. Prompt Security inspects each prompt and model response to prevent sensitive data leaks, block harmful content, and secure against GenAI-specific attacks. Today the company has announced comprehensive protection for M365 Copilot. Read more or join the webinar.

SentryPeer is a fraud detection tool. It lets bad actors try to make phone calls and saves the IP address they came from and the number they tried to call.

Traceeshark allows users to do Linux runtime security monitoring and advanced system tracing using Wireshark. It also has the ability to capture events using Tracee directly from Wireshark and have them stream in like a network capture. This can be done either locally on a Linux machine running Wireshark, semi-locally using Docker Desktop's VM on Windows and Mac, or even remotely over SSH.

A comprehensive reference of Windows API functions divided by use case.

A 57-year-old former core infrastructure engineer from Missouri was arrested for attempting to extort his ex-employer. He allegedly sent emails threatening network lockouts, data deletion, and server shutdowns unless paid 20 bitcoin ($750,000). He faces charges of extortion, computer damage, and wire fraud.

Offsec has announced changes to the exam format of the OSCP exam including the elimination of bonus points and an assumed breach model for the Active Directory portion. It has also introduced the OSCP+ designation, which will require recipients to renew their certification via CPEs, retake the exam, or earn a higher level cert every 3 years to maintain the + distinction. The community is split on reactions to the announcement, with some feeling that the OSCP+ is a cash grab and that the AD changes are too easy, while others are celebrating that the certification will now fulfill DoD requirements.

This blog post discusses a vulnerability in Microsoft 365 Copilot that allowed personal information theft through prompt injection. The exploit chain involves techniques like prompt injection, automatic tool invocation, and ASCII smuggling to exfiltrate data without user consent. The author responsibly disclosed the exploit to Microsoft, leading to fixes implemented to prevent further exploitation.

Sextortion scams now include personalized threats with photos of recipients' homes to make the extortion more convincing and frightening.

Forrester advises CISOs to prioritize 2025 budgets on key areas including software supply chain, API security, and IoT/OT threat detection.

The FBI warns that North Korean hackers are targeting cryptocurrency companies using sophisticated social engineering tactics to steal crypto assets.