Dark mode: ON

Infosec Decoded Season 4 #41: Bye Bye QRadar

With Doug Spindler and @sambowne@infosec.exchange

Tue, May 21, 2024

Doug Spindler

Bitcoin Pizza Day is tomorrow. Here's what it's all about

You can now buy a 4-foot-tall humanoid robot for $16K

Sam Bowne

CISOs Grapple With IBM's Unexpected Cybersecurity Software Exit
IBM has agreed to sell the QRadar SaaS portfolio to Palo Alto Networks. IBM's QRadar is the third largest next-generation SIEM provider based on revenue, behind Microsoft and Splunk. "For IBM to then turn around and sell QRadar to Palo Alto Networks, seemingly with little to no warning for customers, is shocking and frankly not in line with the customer-centric ethos IBM is known for. I would imagine there are many confused and frustrated QRadar customers [now] looking for answers."

Nikesh Arora on Why Palo Alto Networks Is Buying IBM QRadar
QRadar SaaS SIEM Customers Will Be Migrated to XSIAM. The "much larger prize" is QRadar's on premise customer base, and IBM has incentive to encourage those customers to migrate to Palo Alto Networks' cloud-based offering.

Linguistic Lumberjack: Attacking Cloud Services via Logging Endpoints (Fluent Bit - CVE-2024-4323)
Fluent Bit is a logging utility heavily used by all major cloud providers. This heap buffer overflow allows DoS attacks and possibly RCE under some cirtumstances. A patched version is available.

New Windows 11 features strengthen security to address evolving cyberthreat landscape
Secured-core PCs provide advanced firmware safeguards and dynamic root-of-trust measurement to help protect from chip to cloud, using a Microsoft Pluton security processor. Pluton is a chip-to-cloud security technology. NTLM will be deprecated in the second half of 2024. Smart App Control uses AI to decide whether an app is safe.

New Windows AI feature records everything you’ve done on your PC
Recall uses AI features "to take images of your active screen every few seconds." It's currently in preview status, and will only be available on the new "Copilot Plus PCs" powered by Qualcomm's Snapdragon X Elite chips, which include the necessary neural processing unit (NPU).