The Daily Index — Friday, December 8, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

EXPERTS WARN OF SNEAKY FAKE LOCKDOWN MODE ATTACK

Researchers from Jamf have discovered that an attacker could run a trojan on a compromised iPhone running iOS 16 to hook into Lockdown mode and bypass its security mechanisms. This post-exploitation technique could allow an attacker to continue persisting on a compromised device while providing users with a false sense of security. Jamf notes that Lockdown mode was moved to the kernel level in iOS 17 which would prevent their attack.

thehackernews.com · 3 min

TLDR InfoSec

ATLASSIAN ANNOUNCES FIXES FOR FOUR CRITICAL RCE VULNERABILITIES

Atlassian has released fixes for four different vulnerabilities in various products that each could be utilized to achieve RCE. The flaws include a vulnerability in a third-party deserialization library, a template injection flaw in Confluence, an Assets Discovery flaw that could allow RCE on any machines with the agent installed, and a flaw that could allow for RCE via WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper.

thehackernews.com · 2 min

TLDR InfoSec

DETECTING RUNTIME SECURITY THREATS IN ECS

Amazon GuardDuty has launched a new feature for runtime monitoring on ECS clusters. Runtime Monitoring for ECS checks hundreds of threat vectors to produce 30 different finding categories that can be sent to EventBridge, Security Hub, or Detective. Runtime Monitoring is supported on Fargate and on EC2-based clusters.

aws.amazon.com · 3 min

TLDR InfoSec

CUEING UP A CALCULATOR: AN INTRODUCTION TO EXPLOIT DEVELOPMENT ON LINUX

This blog post focuses on writing a one-click malicious webpage that exploits CVE-2023-43641, an out-of-bounds array access vulnerability in libcue that allows attackers to overwrite the memory of a process. It explains the challenges of bypassing mitigations such as no-execute memory, ASLR, and stack canaries. The post provides insights into ASLR, heap layout, and the development of an exploit targeting libcue in tracker-extract.

github.blog · 28 min

TLDR InfoSec

UNICODE XSS VIA COMBINING CHARACTERS

This gist demonstrates a variant of unicode XSS using character combinations. It also demonstrates how such an attack works and provides the root cause, as well as suggesting approaches for detecting unicode normalization, and flagging such occurrences to be manually inspected.

gist.github.com · 4 min

TLDR InfoSec

HOW THE FIRST GEN IPOD WAS REVERSE ENGINEERED TO RUN #ROCKBOX

This thread discusses how the original iPod was reverse engineered using a specially crafted HTML webpage to run Rockbox.

mastodon.social · 2 min

TLDR InfoSec

GMAIL’S AI POWERED SPAM DETECTION IS ITS BIGGEST UPDATE IN YEARS

Google announced that its new text classification system, RETVec, has been integrated into Gmail’s spam filters. RETVec is designed to combat adversarial text attacks such as those which utilize homoglyphs to bypass detection. It has been open sourced and can be run locally on lower-powered devices.

arstechnica.com · 2 min

TLDR InfoSec

ANALYSIS OF NORTH KOREAN HACKERS’ TARGETED PHISHING SCAMS ON TELEGRAM

Slowmist, a blockchain security company, conducted an analysis of the North Korean hacking group Lazarus' tactics in Telegram. They found that the hackers employ various tactics, such as convincing project teams to download malicious scripts or inserting malicious links on event pages. Users should take immediate action in case of malware infection and to protect accounts.

slowmist.medium.com · 4 min

TLDR InfoSec

APPLE CONFIRMS GOVERNMENTS USING PUSH NOTIFICATIONS TO SURVEIL USERS

Apple has confirmed that unidentified Governments have been using push notifications to surveil users.

macrumors.com · 1 min

TLDR InfoSec

23ANDME UPDATES USER AGREEMENT TO PREVENT DATA BREACH LAWSUITS

Genetic testing provider 23andMe has updated its Terms of Use to make it more difficult for customers to sue the company in response to multiple lawsuits following a data breach.

bleepingcomputer.com · 2 min

TLDR InfoSec

META BEGINS DEFAULT END-TO-END ENCRYPTION FOR MESSENGER ROLLOUT

After years of testing, Meta has announced that it will be rolling out default end-to-end encryption for all users on Messenger. Meta reports that the rollout took so long as many features of Messenger had to be completely rebuilt to work with end-to-end encryption.

techcrunch.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech