The Daily Index — Friday, September 8, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

THE WILD

Two zero-day vulnerabilities fixed by Apple in emergency security updates were exploited to deploy Pegasus commercial spyware onto fully patched iPhones through iMessage. The attackers were able to infect iPhones without victim interaction by sending PassKit attachments containing malicious images. Apple and Citizen Lab are encouraging device updates and the activation of Lockdown Mode for those at risk of targeted attacks.

citizenlab.ca · 2 min

TLDR InfoSec

Untitled entry

Ticketing services agency See Tickets has notified more than 300,000 individuals that their payment card data was stolen in a new web skimmer attack. The ticketing services agency also notes that it has no evidence to suggest that the stolen personal information was fraudulently used. However, such data is typically shared between cybercriminals and used to perform various types of fraud.

securityweek.com · 3 min

TLDR InfoSec

Untitled entry

Security researcher Nea Paw has created a fully autonomous AI disinformation system called CounterCloud using existing AI tools. The CounterCloud AI system can scrape, generate, and distribute AI-generated disinformation tweets and articles. This research project has not been made publicly available and all tweets and articles have been kept private. Experienced journalists who received access to the generated content reported that it seemed very realistic.

thedebrief.org · 4 min

TLDR InfoSec

GETTING STARTED WITH ETHICAL HACKING SERIES

Ethical hacking refers to the process of identifying and exploiting vulnerabilities in computer systems, networks, and applications with the intention of improving their security. This series dives into how anyone can get into ethical hacking.

snyk.io · 8 min

TLDR InfoSec

ACCOUNTS

In a post-mortem report, Microsoft revealed how hackers stole a cryptographic consumer key and used it to forge tokens for Outlook.com and Outlook Web Access. The key was stolen from a software dump that was created when a Microsoft computer crashed. Microsoft has now fixed the bugs that allowed the breach to happen, but users should still be vigilant and take steps to protect their accounts.

hackread.com · 3 min

TLDR InfoSec

IT’S OFFICIAL: CARS ARE THE WORST CATEGORY WE HAVE EVER REVIEWED

The *Privacy Not Included team at Mozilla has released its review of privacy features of major car brands and concluded that every single one of the 25 car brands failed to meet their privacy standards. All of the brands collect too much data, 92% give little to no control over data collection to users, and 84% admit to selling that data. Tesla and Nissan scored the worst on the privacy tests and Renault and Dacia scored the best.

foundation.mozilla.org · 8 min

TLDR InfoSec

ROOT

Android 14 tightens control of trusted certificates, blocking modification even on rooted devices, continuing the shift from openness towards locked-down vendor control. This creates challenges for developers, testers, and reverse engineers by requiring direct certificate authority control.

httptoolkit.com · 10 min

TLDR InfoSec

STATE OF THE VIRTUAL CISO 2023 REPORT

The State of the Virtual CISO Survey Report provides insights on vCISO adoption trends and challenges among 200 MSP/MSSP security leaders. It reveals drivers and blockers for the growing vCISO model, helping MSPs/MSSPs evaluate and overcome hurdles to offering security leadership services.

go.cynomi.com · 9 min

TLDR InfoSec

DEFENSIVE SECURITY IS A GLACIER

A thought piece that compares defensive security to a glacier in the sense that it is a colossal, slow-moving machine. The article gives some examples of major milestones in security and argues that they were all done by large corporations/governments and could not have happened sooner no matter what individuals did. It concludes that in defensive security, individuals must focus on smaller changes and wins than on large scale change.

danielmiessler.com · 4 min

TLDR InfoSec

'FEASIBLE'

The UK dropped mandatory messaging scanning from its Online Safety Bill after tech industry backlash, but clauses remain, passing the issue to future governments when "technically feasible." A bare minimum concession, the core controversy continues unresolved.

theregister.com · 3 min

TLDR InfoSec

HOW CHINA GETS FREE INTEL ON TECH COMPANIES’ VULNERABILITIES

China's 2021 law mandates that tech companies operating in the country disclose hackable flaws in their products to the government. Some foreign firms with operations in China appear to be complying, potentially giving Chinese state-sponsored hackers an advantage in exploiting these vulnerabilities, raising cybersecurity concerns.

arstechnica.com · 5 min