Brief #80: Cloudflare Data Loss, Godot Malware, Claude AI Vulnerability

Happy Sunday!

I hope this Brief finds you well and ready to tackle the week ahead.

In this edition, I am covering:

• Cloudflare's major logging incident resulting in 55% data loss
• A concerning vulnerability in Claude's Computer Use feature enabling malware execution
• Practical insights on macOS lateral movement techniques

And much more.

INDUSTRY NEWS

Cloudflare Logs Service Disruption Results in 55% Data Loss During 3.5-Hour Incident

• A misconfiguration in Logfwdr service caused a cascade failure, resulting in approximately 55% of customer logs being lost during a 3.5-hour disruption on November 14, 2024, affecting the majority of Cloudflare Logs customers.

• The incident began when a blank configuration triggered a "fail open" failsafe mechanism, causing a 40x increase in buffer creation (from 1 million to 40 million buffers) that overwhelmed the Buftee storage system.

• Root cause analysis revealed that while protective mechanisms existed in the Buftee system to prevent such cascading failures, they were not properly configured, leading Cloudflare to implement new alerts and regular "overload tests" to prevent future incidents.

Gaming Engine Godot Exploited as Undetected Malware Loader Platform

• New malware loader "GodLoader" leverages Godot gaming engine to execute malicious GDScript code, remaining undetected by most antivirus solutions while infecting over 17,000 machines since June 2024.

• Distributed through the Stargazers Ghost Network via GitHub, the malware uses sophisticated anti-sandbox techniques and targets multiple platforms including Windows, Linux, and macOS by exploiting Godot's cross-platform capabilities.

• The technique poses potential risks to over 1.2 million users of Godot-developed games through possible infection scenarios involving legitimate game modifications or downloadable content.

Malicious SSH Backdoor Campaign Targets Popular npm Libraries Through Typosquatting

• Threat actor "sanchezjosephine180" published six typosquatted packages mimicking popular npm libraries (babel-cli, chokidar, streamsearch, ssh2, npm-run-all, node-pty), accumulating over 700 downloads before detection.

• The packages execute malicious code via postinstall scripts to create SSH backdoors on Linux systems, adding attacker's public key to authorized_keys while exfiltrating victim's username and IP address through webhook-test[.]com.

• Campaign includes a seventh dormant package targeting Python's paramiko library, suggesting potential for future malicious updates, highlighting risks of supply chain attacks through package manager confusion and version control exploitation.