The Deep Purple Sec – February 2025

📝 Information Stealer masquerading as LDAPNightmare (CVE-2024-49113) Proof-of-Concept (PoC) exploit
In January 2025, researchers uncovered malware masquerading as a proof-of-concept (PoC) exploit for the LDAPNightmare vulnerability (CVE-2024-49113). This malware, disguised as a genuine tool, is an information stealer designed to steal sensitive data from infected systems.

Attackers exploited the interest in the LDAPNightmare vulnerability to trick users into downloading and running the fake exploit. Once run, the malware collects information such as login details, system data and other private information, and then sends it to the attackers’ servers.

This finding highlights the importance of verifying the authenticity of security tools before using them and exercising caution with proof-of-concept (PoC) exploits from unverified sources. Researchers strongly advise security professionals to use tools only from trusted sources and to put measures in place to detect and block malware that masquerades as security tools.

📌 Source: https://www.trendmicro.com/fr_fr/research/25/a/information-stealer-masquerades-as-ldapnightmare-poc-exploit.html

📝 Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel
In November 2024, security researchers Sam Curry and Shubham Shah discovered a serious security flaw in Subaru’s STARLINK service, which allowed unauthorised access to cars and customer accounts in the US, Canada and Japan.
They discovered a subdomain for an admin interface and used the password reset feature, bypassing two-factor authentication (2FA) by removing the client-side overlay.
With this vulnerability, an attacker who only has the victim’s name, postcode, email address, telephone number or number plate could:

• Start, stop, lock, unlock and locate any vehicle remotely.
• Get the vehicle’s full travel history for the past year, accurate to within 5 metres.
• Access customers’ personal information, including emergency contacts, authorised users, physical address, billing details and the vehicle’s PIN.

The researchers reported this issue to Subaru, which resolved it in under 24 hours. However, this raises concerns about the amount of personal data collected by modern cars and how accessible it is to car manufacturers’ staff.

📌 Source: https://samcurry.net/hacking-subaru

📝 CVE surge: Why the record rise in new vulnerabilities?
In 2024, a record 40,009 new vulnerabilities were discovered, representing a 38% increase on 2023.
This rise is mainly due to more code being written, software becoming more complex, and the widespread use of technologies such as cloud computing and the Internet of Things. The use of third-party components has also increased the risk of vulnerabilities, as seen in major incidents such as Log4Shell and the SolarWinds breach. Notably, five CVE Numbering Authorities (CNAs), including Kernel.org and GitHub, were responsible for nearly 44% of the CVEs published in 2024, highlighting the importance of reporting vulnerabilities in open-source projects.
BlackNoise’s view: These trends highlight the need for different strategies to improve overall security. Given these circumstances, it is impossible to completely fix all vulnerabilities, particularly over time. It is therefore important to anticipate that vulnerabilities may be exploited and to focus on improving detection and response to such attacks.

📌 Source: https://www.yeswehack.com/news/cve-surge-record-jump-vulnerabilities

🛠️ Happy YARA Christmas!
The Threat Detection and Research (TDR) team at Sekoia.io had published hundreds of YARA rules on a GitHub repository by the end of 2024 to help security analysts with tasks such as identifying threats, tracking changes to malware, and identifying suspicious files from unknown sources.
These rules are also used by other services such as VirusTotal, Triage and the YARAify project from Abuse.ch, improving threat detection and response for files uploaded to these platforms.
Congratulations on this outstanding work, and thank you to the TDR team at Sekoia.io for their valuable contributions to the community! 👏

📌 Source: https://blog.sekoia.io/happy-yara-christmas/

🛠️ AttackRuleMap
This tool maps Atomic Red Team attack simulations to open-source detection rules such as Sigma and Splunk ESCU.
The project links these simulations to detection rules, helping security experts to simulate attacks and test detection methods.

📌 Source: https://github.com/krdmnbrk/AttackRuleMap

📘 SANS 2024 Detection & Response Survey: Transforming Cybersecurity Operations: AI, Automation and Integration in Detection and Response
The SANS 2024 Detection & Response Survey is an important study for Blue Team experts, as it provides a comprehensive overview by gathering information from numerous organisations of various sizes and across different sectors.
It explores how these organisations manage key aspects of detection and response, as well as the integration of these crucial functions into their operations. The survey covers various topics, including the performance of tools such as Extended Detection and Response (XDR) and Network Detection and Response (NDR), the synergy between human expertise and technology, the application of artificial intelligence and machine learning (AI/ML), and the detection of threats in cloud environments.

📌 Source: https://www.sans.org/white-papers/sans-2024-detection-response-survey/