Sécurité info - Page 75

Brunni (./2222) :
Moi je n'activerai pas ce truc (pour le moment), j'ai pas d'iPhone pour en profiter vraiment et j'ai peur que ça va ralentir mon ordi.

. 🐧🐧

Reused AWS S3 buckets a weak link in supply chain securitywww.theregister.comWhen cloud customers don't clean up after themselves, part 97

Abandoned AWS S3 buckets could be reused to hijack the global software supply chain in an attack that would make Russia's "SolarWinds adventures look amateurish and insignificant," watchTowr Labs security researchers have claimed.

The researchers, in a report due out this morning, say they identified about 150 Amazon-hosted cloud storage buckets that were long gone yet applications and websites were still trying to pull software updates and other code from them. If someone were to take over those buckets, they could use them to feed malicious software into people's devices.

These S3 buckets had previously been owned or used by governments, Fortune 500 firms, technology and cybersecurity companies, and major open source projects.

The watchTowr team said it spent $420.85 to re-register these S3 buckets with the same names and enabled logging for all of them to track which files were being requested still and by what. They told us they spent two months watching the HTTP requests roll in.

During this time, the S3 buckets received more than eight million requests for resources including Windows, Linux, and macOS executables; virtual machine images; JavaScript files; CloudFormation templates; and SSL VPN server configurations, the watchTowr crew said.

Large enterprises scramble after supply-chain attack spills their secretsArs Technicatj-actions/changed-files, corrupted to run credential-stealing memory scraper.

Open-source software used by more than 23,000 organizations, some of them in large enterprises, was compromised with credential-stealing code after attackers gained unauthorized access to a maintainer account, in the latest open-source supply-chain attack to roil the Internet.

The corrupted package, tj-actions/changed-files, is part of tj-actions, a collection of files that's used by more than 23,000 organizations. Tj-actions is one of many Github Actions, a form of platform for streamlining software available on the open-source developer platform. Actions are a core means of implementing what's known as CI/CD, short for Continuous Integration and Continuous Deployment (or Continuous Delivery).

On Friday or earlier, the source code for all versions of tj-actions/changed-files received unauthorized updates that changed the "tags" developers use to reference specific code versions. The tags pointed to a publicly available file that copies the internal memory of severs running it, searches for credentials, and writes them to a log. In the aftermath, many publicly accessible repositories running tj-actions ended up displaying their most sensitive credentials in logs anyone could view.

https://www.tomshardware.com/tech-industry/cyber-security/akira-ransomware-cracked-with-rtx-4090-new-exploit-to-brute-force-encryption-attack
The dreaded Akira ransomware attack has had another hole blown through its hull. Blogger Tinyhack has discovered a new exploit to brute-force the virus's encryption and has reportedly already used it to restore the data of an attacked company. Akira, a well-known ransomware cyberattack, may now be escapable by affected companies thanks to a GPU-based brute-force counterattack. With an RTX 4090, the Tinyhack found they could crack the encrypted ransomware'd files in seven days, and with 16 GPUs, the process would take just over ten hours.

Akira is a ransomware attack aimed at high-profile targets, first discovered in 2023 and known for ludicrously high ransom requests (sometimes reaching tens of millions of dollars). In 2023, Avast's Threat Research Team found the method Akira used to encrypt victim files, and published a free encryption breaker tool to free computers from the dreaded attack. Akira then patched this high-profile crack, adding some bespoke details to its originally publicly-available encryption methods.

At least one Akira variant uses an encryption method that can be decrypted via the new GPU-based brute-force method over a period of days or weeks. The Akira attack uses the chacha8 and Kcipher2 encryption methods to generate per-file encryption keys, using four distinct timestamps, in nanoseconds, as seeds. These timestamps can be deduced to a tight range of on average 5 million nanoseconds (0.005 seconds), and then precisely found with brute-force, a process which requires the use of top-end GPUs such as Nvidia's RTX 3090 or 4090.

Zerosquare (./2245) :
Si tu as connaissance d'un cas spécifique, oui, bien sûr. Mais c'est une goutte dans l'océan : je doute que la majorité des petites (voire moyennes) entreprises pensent à contacter l'ANSSI quand elle se fait avoir par un ransomware, sans même parler des particuliers. Proposer une solution que n'importe qui peut trouver via une simple recherche Google me semble largement plus efficace.