The Daily Index — Monday, September 25, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SPYWARE CAN INFECT YOUR DEVICES FROM THE ADS YOU SEE ONLINE

Israeli tech firm Insanet has developed spyware capable of being delivered through online ad networks and infecting Windows-based computers and Android phones as well as iPhones. The "Sherlock'' spyware's deployment has raised concerns due to its ability to clandestinely infiltrate devices, monitor activities, and collect sensitive information. The Israeli government has approved its sale, which potentially puts many at risk.

theconversation.com · 3 min

TLDR InfoSec

EVASIVE GELSEMIUM HACKERS SPOTTED IN ATTACK AGAINST ASIAN GOVT

The Gelsemium cyberespionage group, which has been operational since 2014, has been spotted in attacks targeting a Southeast Asian government. The group is known for its technical capacity and programming knowledge, which has helped them fly under the radar for many years.

bleepingcomputer.com · 2 min

TLDR InfoSec

Untitled entry

Helpdesk operators are prime targets for exploitation. Recent breaches have highlighted the need for better defense against attacks on these targets. This post says helpdesk vulnerabilities are mostly tech and process gaps, not people. It covers attacker tactics and recommends processes and tech fixes to protect against helpdesk attacks.

praetorian.com · 10 min

TLDR InfoSec

PEELING BACK THE CURTAINS WITH CALL STACKS

This blog post from Elastic Security on leveraging call stacks to reduce false positives, reduce false negatives, and increase visibility. The post begins with an overview of what call stacks are, then discusses how to leverage them for event explainability and walks through examples of other detection use cases.

elastic.co · 13 min

TLDR InfoSec

BLOCKING VS CODE EMBEDDED REVERSE SHELL BEFORE IT’S TOO LATE

Microsoft added a tunnel feature to VS Code in July 2023 that allows users to share their Visual Studio desktop via the web. This is a prime utility for attackers to establish persistence. This article provides some methods to disable the usage of VS Code tunnel as well as some methods to detect its usage.

ipfyx.fr · 10 min

TLDR InfoSec

THE 2023 IDA PLUGINS CONTEST

Hex-Rays runs a contest every year to develop novel and interesting plug-ins for IDA. This year, 9 plug-ins were selected from the submissions, including tools to query ChatGPT, analyze functions, and generate unique URIs from disassembled code.

hex-rays.com · 5 min

TLDR InfoSec

SOURCE PROJECTS

The GitHub Security Lab has reached the milestone of disclosing over 500 CVEs (records of security vulnerabilities) in open source projects. The Security Lab is a team of security experts who audit open source projects and help their maintainers fix vulnerabilities for free. They have reported and helped fix over 1,000 vulnerabilities with a fix rate of 96%.

github.blog · 7 min

TLDR InfoSec

COMBINED

The FBI claims that Beijing has a cyber espionage program that is larger than all of its major competitors combined. Even if every FBI cyber agent and intelligence analyst focused on China exclusively, Chinese hackers would still outnumber them by at least 50 to 1.

reuters.com · 1 min

TLDR InfoSec

WHY SCALPERS CAN GET OLIVIA RODRIGO TICKETS AND YOU CAN'T

This post talks about how the "Verified Fan" sale that Ticketmaster is doing for the most recent Olivia Rodrigo tour tickets isn't working because scalpers have many accounts and credit cards to quickly buy tickets for resale whereas non-scalpers do not.

404media.co · 7 min

TLDR InfoSec

OPERATIONS

APT29, a Russian state-sponsored hacking group, has increased its phishing operations in Ukraine, particularly targeting foreign embassies in Kyiv. This follows an uptick in the group's routine espionage operations against global diplomatic entities, with a focus on European Ministries of Foreign Affairs and embassies, as well as governments in Turkey, India, and Africa.

mandiant.com · 17 min

TLDR InfoSec

THE SCATTERED SPIDERS BELIEVED TO BE BEHIND LAS VEGAS ATTACKS

The hackers who are believed to be behind a major cyberattack that disrupted several casinos and hotels in Las Vegas are part of a small but prolific cybercrime clique whose members have also hit other major U.S. companies in the past year by talking their way into access to computer networks.

nbcnews.com · 3 min