The Daily Index — Monday, September 4, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SOURCEGRAPH DISCLOSES DATA BREACH FOLLOWING ACCESS TOKEN LEAK

Code search and navigation platform Sourcegraph on Thursday announced that it has experienced a data breach after an engineer accidentally leaked an admin access token. Sourcegraph account email addresses for community members and license owners were obtained. No other customer info, including private code, passwords, usernames, or other PII, was accessible.

about.sourcegraph.com · 4 min

TLDR InfoSec

ANDROID GOES ALL-IN ON FUZZING

The blog post details the Android team’s massive investment into fuzzing and the fuzzing pipeline that they’ve built. It highlights how the Android team writes and detects fuzzers, how those bugs get routed and examined for vulnerabilities, and examples of CVEs that were detected by fuzzing.

security.googleblog.com · 5 min

TLDR InfoSec

CAMPAIGN

The Classiscam scam-as-a-service program has reaped criminal actors $64.5 million in illicit earnings since its emergence in 2019. This blog includes a detailed analysis of how Classiscam campaigns have changed over the past four years. Would-be cybercriminals can now leverage a range of automated tools to create new Classiscam schemes – including phishing sites — in a handful of minutes.

group-ib.com · 15 min

TLDR InfoSec

AND SYSTEMD

Using the vulnerability described in this blog, an attacker may take control of an encrypted Linux computer during the early boot process, manually unlock TPM-based disk encryption, and either modify or read sensitive information stored on the computer’s disk. This blog post runs through how the vulnerability was identified and exploited - no tiny soldering required.

pulsesecurity.co.nz · 8 min

TLDR InfoSec

UNMASKING TRICKBOT

Trickbot was formed in 2016 and rose to become one of the world’s top cybercrime gangs. An investigation into the leaked internal messages, known as Trickfiles, from this group reveals the identities of key players, ties to the Kremlin, and insights into their internal organization.

wired.com · 15 min

TLDR InfoSec

REVEALING THE TARGETS AND RULES FOR THE FIRST PWN2OWN AUTOMOTIVE

The Zero Day Initiative (ZDI) this week announced that it will be offering more than $1 million in cash and prizes at Pwn2Own Automotive, the first Pwn2Own hacking contest focused on car systems.

zerodayinitiative.com · 8 min

TLDR InfoSec

NETWRIX HYBRID SECURITY TRENDS REPORT 2023 - EDUCATION SPECIAL

Netwrix survey shows 69% of education organizations suffered a cyberattack in the past year, higher than other sectors. Phishing and compromised on-prem user/admin accounts were top attack vectors, unlike others. Highlights increased threats and account risks facing the education sector.

netwrix.com · 6 min

TLDR InfoSec

REPAIR

The Church of Scientology's Author Services filed a letter with the US regarding the triennial review of the DMCA. In this letter, Author Services contests the changes that Right to Repair advocates are seeking. Representatives from iFixit speculate that the Church is concerned with the hacking community digging into the Church’s E-meter devices.

theregister.com · 5 min

TLDR InfoSec

RUST MALWARE STAGED ON CRATES.IO

Yet another supply chain attack campaign on Rust programmers. Libraries that were named similar to popular libraries like postgress, if-cfg, xrvrv, serd, oncecell, lazystatic, and envlogger were malware uploaded to get the developer’s operating system information and transmit the data to a hard-coded Telegram channel.

blog.phylum.io · 5 min

TLDR InfoSec

CRIME GANG

The Key Group ransomware family was first revealed on January 6, 2023. It is a financially motivated threat group using Telegram channel keygroup777Tg for the negotiation of ransoms. Cyber intelligence firm EclecticIQ on Thursday announced the release of a free decryption tool to help victims of the Key Group ransomware recover their data without having to pay a ransom.

blog.eclecticiq.com · 8 min