SANS Internet Storm Center StormCast: Traffic Light Protocol, Amazon Bedrock Vulnerability, NetScaler and Palo Alto Security Issues

This October 12th, 2020 SANS Internet Storm Center StormCast covers several cybersecurity topics. The Traffic Light Protocol, developed by FIRST, specifies who threat intelligence should be shared with (ranging from clear/public to red/no sharing) but does not specify how to safeguard the information during transmission. Researchers from Sanity Labs identified a server-side request forgery vulnerability in Amazon's AI Bedrock agents that allowed attackers to retrieve credentials from the metadata service by exploiting version one of the IMDS; Amazon has since fixed this issue. Multiple NetScaler vulnerabilities were disclosed during the week requiring patches. Rely Quest reports ransomware deployment via a Palo Alto vulnerability affecting PanOS GlobalProtect and Prisma Access, with VPN and SSL VPN endpoints being heavily targeted by ransomware actors because they must be exposed to the internet, making additional mitigating controls difficult to implement.