The Daily Index — Wednesday, September 6, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

4,500 OF THE TOP 1 MILLION WEBSITES LEAKED SOURCE CODE, SECRETS

Security researchers collaborated to scan the Alexa Top 1 Million Websites for leaked secrets and discovered that 4,500 of the most heavily visited websites in the world publicly exposed their git directory, which often contained the entire private source code for a given website. AWS and GitHub keys accounted for 45% of all leaked credentials and third-party email marketing services accounted for a large percentage of the leaked keys.

trufflesecurity.com · 7 min

TLDR InfoSec

ALL FREECYCLE USERS IMPACTED BY DATA BREACH

Freecycle.org, a platform that allows users to recycle their belongings, has prompted millions of users to reset their passwords after credentials were compromised in a data breach. The breach of data includes usernames, User IDs, email addresses, and passwords.

freecycle.helpscoutdocs.com · 2 min

TLDR InfoSec

HUNTING C2S WITH NUCLEI

This is a blog post detailing a method to repurpose Nuclei, a common DAST tool, for threat hunting. The author outlines the steps that they used through other tools and manually to threat hunt and then the high-level process for automating their process with Nuclei. The post also includes an example of hunting for Nimplant.

axelarator.github.io · 5 min

TLDR InfoSec

REVISTING BLISTER: NEW DEVELOPMENT OF THE BLISTER LOADER

BLISTER, a malware loader associated with financially-motivated intrusions has been growing over the last two years under the radar. It now integrates techniques to remove any process instrumentation hook. BLISTER has modified its configuration with multiple revisions, now encompassing additional fields and flags. This post dives into the advancements of BLISTER.

elastic.co · 15 min

TLDR InfoSec

USING OPEN-SOURCE SOFTWARE COMPOSITION ANALYSIS TOOL FROM GOOGLE

This article dives into how you can set up and configure osv-scanner, an open source SCA tool, to identify vulnerabilities in popular open source projects.

medium.com · 7 min

TLDR InfoSec

GETTING INTO AWS CLOUD RESEARCH

A comprehensive guide to beginning to research AWS cloud security. The guide suggests ways to gain more foundational knowledge, leaders in the field to follow, and different ways to dive deep. The guide concludes with reporting methods and assorted tips.

dagrz.com · 15 min

TLDR InfoSec

COST OF A DATA BREACH REPORT 2023

IBM's 2023 installment of their annual "Cost of a Breach" report has brought up some interesting trends such as the average cost of a breach rose once again to $4.45 million, increasing 15% over the last three years. It also has an industry-specific focus and breakdown of breaches.

ibm.com · 16 min

TLDR InfoSec

POP-UPS

A security researcher who asked to be referred to as only Anthony demonstrated an attack using a Flipper Zero where a small device can be programmed to perform wireless attacks on devices in its range, such as iPhones, as well as car keyfobs, contactless and RFID cards, and more.

techcrunch.com · 2 min

TLDR InfoSec

OKTA CROSS-TENANT IMPERSONATION: PREVENTION AND DETECTION

Threat actors are using social engineering to convince IT desk personnel to reset multifactor authentication (MFA) for highly privileged Okta enterprise accounts, gaining access to the cloud-based identity access management (IAM) service and moving laterally through targeted networks from there. Okta warns about how common this threat is and how to prevent it.

sec.okta.com · 4 min

TLDR InfoSec

MULTIPLE NOTEPAD++ FLAWS LET ATTACKERS EXECUTE ARBITRARY CODE

Several Buffer Overflow vulnerabilities have been discovered in Notepad++ that can be exploited by threat actors for malicious purposes.

cybersecuritynews.com · 3 min

TLDR InfoSec

CHROME EXTENSIONS CAN STEAL PLAINTEXT PASSWORDS FROM WEBSITES

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

bleepingcomputer.com · 4 min