The Daily Index — Monday, November 27, 2023 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NORTH KOREA-LINKED APT LAZARUS IS USING A MAGICLINE4NX ZERO-DAY FLAW IN SUPPLY CHAIN ATTACK

The National Cyber Security Centre (NCSC) and Korea’s National Intelligence Service (NIS) issued a joint warning that North Korea-linked Lazarus hacking group is exploiting a zero-day vulnerability in the MagicLine4NX certificate management and signing software to carry out supply-chain attacks.

securityaffairs.com · 3 min

TLDR InfoSec

NOVEL MIRAI-BASED DDOS BOTNET EXPLOITS 0-DAYS TO INFECT ROUTERS AND SECURITY CAMERAS

Researchers at Akamai's Security Intelligence Response Team (SIRT) discovered that threat actors are using zero-day vulnerabilities in certain routers and network video recorder devices to build a Mirai-based distributed denial-of-service (DDoS) botnet called InfectedSlurs. The vulnerabilities can be exploited if the device manufacturer's default admin credentials have not been changed. Patches are expected next month.

packetstormsecurity.com · 2 min

TLDR InfoSec

BUILDING YOUR FIRST METASPLOIT EXPLOIT

What is the process of writing an exploit and getting it published as a metasploit module? This post outlines the process for transforming an authenticated Remote Code Execution (RCE) vulnerability in PRTG into a Metasploit exploit. It focuses on the development of the exploit itself rather than the steps for exploiting the RCE.

baldur.dk · 20 min

TLDR InfoSec

ATTACKING GITLAB CI/CD VIA SHARED RUNNERS

A post from Pulse Security that examines ways that a compromised pipeline running on a GitLab shared runner can be used to escape from its isolation, compromise the shared runner, and then compromise any other jobs on that runner. The post specifically focuses on the docker-in-docker executor on GitLab, but many of the techniques described can be generalized.

pulsesecurity.co.nz · 12 min

TLDR InfoSec

BUILDING A FREE BURP COLLABORATOR WITH CLOUDFLARE WORKERS

Burp Collaborator is a paid feature in Burp Suite that can be used as a listener domain for attacks like exfiltrating data via XSS. This post provides a tutorial on how to create a free version of Burp Collaborator using Cloudflare Workers to run on the edge and Discord to receive the messages. The worker code is provided.

blog.gbrls.space · 5 min

TLDR InfoSec

THE TICKING SUPPLY CHAIN ATTACK BOMB OF EXPOSED KUBERNETES SECRETS

Aqua researchers found exposed Kubernetes secrets in public repos for hundreds of orgs/projects, including SAP & blockchain firms, posing severe supply chain attack potential. Secrets enable access to sensitive SDLC environments. This blog examines inherent Kubernetes secrets management risks, cases of critical data now exposed, and potential downstream impact enabling attacks.

blog.aquasec.com · 7 min

TLDR InfoSec

A TOUCH OF PWN - PART I

Researchers tested Windows Hello fingerprint sensors on Dell, Lenovo, and Surface laptops - all with Match-on-Chip. They achieved auth bypass on all of the laptops using software/hardware sensor attacks requiring physical access. This post is an interesting read into how the researchers thought of possible ways to attack and ended up managing to get through the laptops.

blackwinghq.com · 15 min

TLDR InfoSec

REVERSING AWS IAM UNIQUE IDS

This post presents a method to obtain the full ARN of an AWS IAM user or role from the AWS Unique ID. The method involves adding the Unique ID as a principal in an S3 bucket policy. If the IAM user or role still exists, AWS will provide the full ARN in the policy after saving it.

awsteele.com · 2 min

TLDR InfoSec

UNIVERSITY CTF 2023: BRAINS & BYTES

Hack The Box announced its 5th annual University CTF amidst a 4M cyber talent shortage, aiming to equip students with the latest skills and a $68K prize pool.

ctf.hackthebox.com · 3 min