The Daily Index — Monday, September 18, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

PASSWORD STEALING LINUX MALWARE EVADES NOTICE FOR 3 YEARS

From 2020 until 2022, a random sampling of users downloading the Free Download Manager software received a Trojan horse version of the app. The malicious software has a collector backdoor that collects secrets from systems and then utilizes another backdoor to download an uploaded script from a C2 and periodically upload the stolen secrets. IOCs are included in the article.

arstechnica.com · 3 min

TLDR InfoSec

A DEEP DIVE INTO TPM-BASED BITLOCKER DRIVE ENCRYPTION

This document provides an in-depth analysis of TPM-based BitLocker Drive Encryption, which is a feature in Windows that allows users to encrypt their hard drives. It explains how the BitLocker keys are stored and how they are accessed using the TPM. Additionally, the author describes a vulnerability in BitLocker that allows attackers to bypass the encryption and provides a detailed explanation of how the attack works.

blog.scrt.ch · 18 min

TLDR InfoSec

CROSS-WINDOW-MESSAGE ORIGIN VALIDATION

A vulnerability in Facebook/Meta's Canvas on the Comet platform could allow account takeover if a user plays a malicious Canvas game. The issue stems from Compat iframes used for OAuth dialogs. A malicious game could exploit cross-window messaging with the parent window to set up a rogue communication channel and take over the account. This blog post explains how the exploit works with examples.

ysamm.com · 13 min

TLDR InfoSec

THE HIDDEN DANGERS OF TERRAFORM’S REMOTE EXEC PROVISIONER

Terraform’s remote-exec provisioner is a powerful tool that allows for executing commands on a remote server to configure it. However, without proper guardrails, this can pose security risks such as data exfiltration. This article features an example and discusses some mitigations.

blog.cloudsecuritypartners.com · 2 min

TLDR InfoSec

API SECURITY STARTUP PYNT RAISES $6M

Pynt is a security testing solution that automates security testing for developers and testers, enabling effortless vulnerability discovery and mitigation throughout the SDLC. It has raised a $6 million seed funding round.

techcrunch.com · 3 min

TLDR InfoSec

THREATS

The National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) have released a Cybersecurity Information Sheet (CSI) on deepfake threats. The CSI provides an overview of synthetic media threats, techniques, and trends. It includes recommended steps and best practices for organizations to prepare, identify, defend against, and respond to these threats.

cisa.gov · 1 min

TLDR InfoSec

META QUEST 2: DEFENSE THROUGH OFFENSE

Meta's Native Assurance team found a vulnerability in the Meta Quest 2's Android OS that could have allowed arbitrary code execution with system privileges by exploiting memory corruption over IPC. Though it never reached production, the vulnerability highlighted improvements needed in Quest security. Meta shares its review process to demonstrate its commitment to secure product development.

engineering.fb.com · 18 min

TLDR InfoSec

UNDERSTANDING DDOS SIMULATION TESTING ON AWS

An article from AWS outlining some of the DDoS options offered by AWS as well as the options and processes for running DDoS simulations on AWS. Users have the option of running a simulated DDoS attack through an approved partner or a synthetic simulated DDoS attack with the AWS Shield Response Team.

aws.amazon.com · 3 min

TLDR InfoSec

ATTACKS

A new possibly North Korean group named Konni has entered the ransomware game. It recently started to employ new techniques using WinRAR vulnerabilities to exploit for cryptocurrency.

deform.co · 2 min

TLDR InfoSec

CISA OFFERS FREE VULNERABILITY SCANS FOR WATER FACILITIES

The CISA has announced a new program offering free vulnerability scans for public water utilities. The program will install scanners in the organizations and send weekly scan reports with vulnerabilities and recommendations.

bleepingcomputer.com · 3 min

TLDR InfoSec

RANSOMWARE

Scattered Spider, a cybercrime group known for social engineering attacks, has hit over 100 organizations and recently deployed ransomware in attacks. Mandiant reports they are expanding beyond telecom and outsourcing into hospitality, retail, media, and finance. Mitigations include monitoring for phishing links, credential theft, and ransomware.

theregister.com · 4 min