Brief #48: PuTTY Zero-Day, LLMs as Pentesters, Securing Layoffs, High-Paying Cybersecurity Skills

---

Happy week 16!

This week's newsletter covers important topics for cybersecurity professionals and leaders, including a critical vulnerability in PuTTY, the use of LLMs for pentesting, guidance on securing mass layoffs, and insights on high-paying cybersecurity skills.

Let's dive into this week's topics.

PuTTY SSH Client Flaw Allows Recovery of ECDSA Private Keys

Researchers from Ruhr University Bochum discovered a critical vulnerability (CVE-2024-31497) in PuTTY versions 0.68 through 0.80 that could allow an attacker to recover NIST P-521 (ecdsa-sha2-nistp521) private keys. The flaw stems from the generation of biased ECDSA cryptographic nonces, with the first 9 bits of each nonce being zero. An attacker who compromises a server and obtains a few dozen signed messages along with the public key could recover the private key and forge signatures. The vulnerability also impacts other products incorporating the affected PuTTY versions, including FileZilla, WinSCP, TortoiseGit, and TortoiseSVN.

---

Attackers Exploit Critical OpenMetadata Vulnerabilities in Kubernetes Clusters

Microsoft Threat Intelligence reports that attackers are exploiting new critical vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254) in OpenMetadata, an open-source metadata management platform, to gain access to Kubernetes workloads for cryptomining. The attack involves exploiting the vulnerabilities in exposed OpenMetadata instances to execute code on the container, conduct reconnaissance, and download cryptomining malware. Microsoft recommends updating OpenMetadata to version 1.3.1 or later and provides guidance for detecting malicious activity using Microsoft Defender for Cloud.

---

Cisco Duo MFA Provider Breached via Social Engineering Attack

Cisco has warned customers that a third-party provider handling SMS and VOIP traffic for its Duo MFA service was breached on April 1 via a social engineering attack using compromised employee credentials. The threat actor downloaded SMS logs containing phone numbers and other metadata for certain Duo users between March 1 and March 31, 2024. Cisco advised notifying impacted users and remaining vigilant against phishing attacks. This follows a trend of attacks targeting identity security providers, underscoring the need for these companies to bolster their defenses and for enterprises to assess the impact of such breaches on their own security posture.