Brief #77: PAN-OS Vulnerability, Google's AI Finds SQLite Bug, AWS Cert Tops Pay List

Happy Sunday!

I hope this Brief finds you well and ready to tackle the week ahead.

In this edition, I am covering:

• Google's AI agent discovers a significant SQLite vulnerability, marking a milestone in AI-powered security research
• AWS Security Specialty certification leads the pack with average salaries reaching $203,597
• Palo Alto Networks alerts users about a potential RCE vulnerability in PAN-OS management interface

And much more.

INDUSTRY NEWS

Palo Alto Networks Warns of Potential RCE Vulnerability in PAN-OS Management Interface

• Palo Alto Networks has issued an informational advisory about a potential remote code execution vulnerability in the PAN-OS management interface, although specifics are currently unknown.

• The company recommends customers properly configure the management interface per best practices, such as isolating it on a dedicated VLAN, using jump servers, limiting inbound IPs, and only allowing secure protocols like SSH and HTTPS.

• This follows the addition of a now-patched critical authentication bypass flaw (CVE-2024-5910) in Palo Alto Networks Expedition to CISA's Known Exploited Vulnerabilities catalog, which could lead to admin account takeover.

Cybercriminals Exploit DocuSign APIs to Send Authentic-Looking Fake Invoices

• Wallarm security researchers report that cybercriminals are using legitimate, paid DocuSign accounts and templates to send fake invoices that appear authentic, bypassing email and anti-spam filters.

• The fake invoices, often impersonating well-known software companies like Norton, contain accurate pricing and additional charges, tricking users into e-signing and authorizing payments to attackers' bank accounts.

• Attackers are automating the process using DocuSign's APIs, such as the Envelopes: create API, allowing them to send large volumes of fraudulent invoices with minimal manual intervention, abusing the platform's API-friendly environment.

AWS CDK Vulnerability Allowed Account Takeover via Missing S3 Bucket

• Security researchers Ofek Itach and Yakir Kadkoda discovered a security issue in the AWS Cloud Development Kit (CDK) that could allow an attacker to gain administrative access to a target AWS account, resulting in a full account takeover.

• The researchers found that approximately 1% of AWS CDK users were susceptible to this attack vector due to the manual deletion of their deployment artifact S3 bucket(s) created during the CDK bootstrapping process.

• AWS addressed the issue in CDK version v2.149.0 by adding a condition to the bootstrap file-publish role, ensuring it only trusts buckets within the user's account. However, user action is required if CDK version v2.148.1 or earlier was used.

LEADERSHIP INSIGHTS

Alert Fatigue Persists in Cybersecurity Despite Decades of Efforts

• Anton Chuvakin, the author, discusses how alert fatigue has been a persistent problem in cybersecurity SOCs since the 1970s, despite the industry changing rapidly.

• Several factors contribute to the endurance of alert fatigue, including increasing data volumes, environment complexity, number of security tools, and threat activity.

• Surveys reveal SOC teams are overwhelmed by the sheer volume of alerts, with 62% of an average 3,832 daily alerts being ignored, and over 80% being false positives.