ZeroFox Daily Intelligence Brief - May 1, 2023

ZeroFox Daily Intelligence Brief - May 1, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Numerous Vulnerabilities Spotted in Intel TDX
• New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks
• ChatGPT is Back in Italy After Addressing Data Privacy Concerns

Numerous Vulnerabilities Spotted in Intel TDX

Google's recent security audit found 10 vulnerabilities in Intel Trust Domain Extensions (TDX), which could result in remote code execution or denial of service. The vulnerabilities were found in TDX's major components, such as SEAM, Shared bit in GPA, PAMT, Secure EPT, Intel TME-MK engine, and Remote attestation. Intel has since patched these issues in the 4th generation Intel Xeon Scalable CPUs.

Recommendations:

• ZeroFox recommends continued audits of potentially vulnerable applications.
• Users should stay informed about any security issues related to their hardware and follow best practices to minimize the risk of exploitation.

New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks

A new malware toolkit called Decoy Dog has been discovered targeting enterprise networks. The toolkit is evasive and uses techniques such as strategic domain aging and DNS query dribbling to avoid detection. Decoy Dog includes Pupy RAT, an open-source trojan delivered via DNS tunneling, and it appears to have been set up at least a year prior to its discovery. The use of Decoy Dog in the wild is rare, matching less than 0.0000027 percent of the 370 million active domains on the internet. The discovery of the Decoy Dog malware toolkit targeting enterprise networks is significant, as it highlights the continued evolution of advanced and sophisticated malware used by threat actors and underscores the importance of implementing robust security measures.

Recommendations:

• Organizations should ensure their systems have the latest security patches and updates, use security software, and be cautious when downloading software from untrusted sources to reduce the risk of malware infection.
• Using multi-factor authentication can make it more difficult for threat actors to gain access to sensitive data or systems, even if they manage to bypass other security measures.

ChatGPT is Back in Italy After Addressing Data Privacy Concerns

OpenAI's ChatGPT service has returned to Italy after the company met the country's data protection authority's requirements before the April 30, 2023, deadline. Authorities had temporarily blocked access to the chatbot service in March over concerns that its practices violated data protection laws. OpenAI has published a new FAQ in which it emphasizes that it does not actively seek out personal information to train its models and filters and removes information such as hate speech, adult content, and spam. It also offers users the option to verify their age or obtain consent from parents or guardians before accessing the service.

Recommendations:

• Users can further exercise their right to correct, restrict, delete, or transfer their personal information contained within ChatGPT’s training dataset. It is recommended that users take advantage of these privacy settings and verify their age before accessing the service.
• Follow ZeroFox Intelligence to remain updated on emerging threats.