TL;DR
- 38TB Microsoft Data Leak Included Teams Messages, Employee Backups, and Private Keys
- Cisco Acquires Splunk: A Leap in AI-Driven Cybersecurity or a Potential Overreach?
- Apple Zero-Days Are A Triple Threat Exploited in the Wild
- LastPass's 12-Character Master Password Requirement and Crypto Heists
- OpenAI Launches Red Teaming Network Amid Regulatory Concern
38TB Microsoft Data Leak Included Teams Messages, Employee Backups, and Private Keys
- Misconfigured SAS Token: Microsoft's AI research team exposed 38TB of private data, including internal Microsoft Teams messages and disk backups of employees. The culprit was a misconfigured Shared Access Signature (SAS) token in Azure, which granted access to the entire storage account instead of specific files.
- Risks in AI Development: The incident highlights the new security challenges as organizations increasingly rely on AI. Engineers and data scientists working with massive training data sets need to implement additional security checks and safeguards.
- Arbitrary Code Execution: The exposed data was linked to a GitHub repository that provides AI models. These models use Python's pickle formatter, which is prone to arbitrary code execution. An attacker could have injected malicious code into the AI models.
- Lack of Monitoring and Control: The SAS token mechanism lacks effective monitoring and control features. Once a highly permissive, non-expiring token is created, it's difficult for administrators to know it exists or to revoke it.
Cisco Acquires Splunk: A Leap in AI-Driven Cybersecurity or a Potential Overreach?
- Strategic Move for AI-Enabled Security: Cisco's acquisition of Splunk aims to capitalize on AI-driven security and observability, marking a major shift towards software and services.
- Financial and Operational Synergies: The deal is set to boost Cisco's revenue and gross margins. Splunk's CEO Gary Steele will join Cisco's executive team, adding valuable expertise in data analysis and security.
- Regulatory and Market Response: While Cisco's shares dropped by 4%, Splunk's surged by 21%. The deal has raised some eyebrows regarding potential antitrust issues, but both companies are optimistic about clearing regulatory hurdles.
- Recent Acquisitions and Future Outlook: This acquisition follows Cisco's recent purchases in the cybersecurity space, including Valtix and ArmorBlox. The deal is expected to close by Q3 2024, adding $4 billion in annual recurring revenue to Cisco.
Apple Zero-Days Are A Triple Threat Exploited in the Wild
- CVE Details: Three zero-days were patched—CVE-2023-41991 affecting certificate validation, CVE-2023-41992 in the kernel for privilege escalation, and CVE-2023-41993 in WebKit for arbitrary code execution. These flaws were exploited in iOS, macOS, and Safari.
- Attack Vector: The Predator spyware was delivered through network injection. When the target visited specific non-HTTPS websites, a device at the border of Vodafone Egypt's network redirected him to a malicious site, exploiting the zero-days.
- Spyware Capabilities: Predator, made by Cytrox, is similar to NSO's Pegasus. It can surveil targets and harvest sensitive data. It was delivered via a sophisticated "adversary-in-the-middle" (AITM) attack, exploiting both SMS and WhatsApp.
- Security Gaps: Despite Apple's patches, the telecom sector remains a weak link. The attack used Sandvine's PacketLogic middlebox for network injection, highlighting the need for stronger security measures in telecom infrastructure.