The Daily Index — Monday, December 11, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW BLUETOOTH FLAWS LETS ATTACKERS TAKE OVER ANDROID, IOS, MACOS, AND LINUX DEVICES

Researchers have discovered a new flaw, tracked as CVE-2023-45866, that allows for remote code execution on Android, iOS, macOS, and Linux Devices. The attack deceives the target into thinking that it’s connected to a Bluetooth keyboard by taking advantage of an unauthenticated pairing mechanism that’s defined in the Bluetooth specification. No specialized hardware is needed for the attack, which allows attackers in Bluetooth proximity to inject keystrokes into a vulnerable device.

thehackernews.com · 2 min

TLDR InfoSec

STEALTHY LINUX ROOTKIT FOUND IN THE WILD AFTER GOING UNDETECTED FOR 2 YEARS

Krasue is a Linux Remote Access Trojan (RAT) that has been active since 2020, primarily targeting organizations in Thailand. The malware utilizes multiple embedded rootkits drawn from open-source code to support different Linux kernel versions, a common technique for Linux rootkits. Krasue leverages its rootkit capabilities to hook functions like kill() system calls, network operations, and file listing to hide malicious activity and evade detection.

arstechnica.com · 4 min

TLDR InfoSec

HUNTING MALICIOUS INFRASTRUCTURE - HEADERS AND STATIC STRINGS

This post breaks down a process for hunting malicious open-source infrastructure by identifying hardcoded headers or static strings that are included in the application. It includes two worked examples using Responder and Havoc C2. This is part of a series of posts on techniques to hunt malicious infrastructure.

michaelkoczwara.medium.com · 3 min

TLDR InfoSec

3 SYMFONY (RCE): A PEEK BEHIND THE CURTAIN

This post goes step by step on how the author identified three Symfony RCEs. Symfony is a free and open source PHP framework that makes web development faster and easier.

medium.com · 5 min

TLDR InfoSec

WANNACRY: ANALYSIS OF A CRYPTO WORM

This post analyzes the 2017 WannaCry ransomware attack which rapidly spread by exploiting Windows vulnerabilities, encrypting files, and demanding cryptocurrency payments to decrypt them. It reviews key indicators of WannaCry's behavior, a YARA rule to detect it, and discusses the malware's unorthodox "kill switch" domain check which ultimately halted its spread.

medium.com · 7 min

TLDR InfoSec

BAMBDAS

Bambdas is a new feature of Burp Suite that allows for customization of the Burp Suite UI from the GUI using Java snippets. Bambdas is meant to allow users to customize the functionality of Burp Suite and add in utility that is needed for them. Examples of Bambdas and helpful snippets are provided in the post.

portswigger.net · 4 min

TLDR InfoSec

STATE OF ASPM 2024

This report found that AppSec chaos reigns, with 78% of CISOs responding that today’s AppSec attack surfaces are unmanageable and 90% of responders confirming that relationships between their security and development teams need to improve. Surprisingly, 77% of CISOs believe software supply chain security is a bigger blind spot for AppSec than Gen AI or open source.

cycode.com · 10 min

TLDR InfoSec

+1500 HUGGINGFACE API TOKENS WERE EXPOSED, LEAVING MILLIONS OF META-LLAMA, BLOOM, AND PYTHIA USERS VULNERABLE

Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.

lasso.security · 7 min

TLDR InfoSec

2.6 BILLION PERSONAL RECORDS COMPROMISED BY DATA BREACHES IN PAST TWO YEARS — UNDERSCORING NEED FOR END‑TO‑END ENCRYPTION

The total number of data breaches more than tripled between 2013 and 2022 — exposing 2.6 billion personal records in the past two years alone — and has continued to get worse in 2023. Ransomware and vendor attacks contributed in a major way to the sharp increase in data breaches and resulting compromise of sensitive records. The number of ransomware attacks in the first nine months of 2023, for instance, was 70% higher than the same period in 2022.

apple.com · 3 min

TLDR InfoSec

NISSAN OCEANIA RESTORING SYSTEMS AFTER CYBERATTACK

The Australian and New Zealand Nissan Corporation and Financial Services has advised that its systems were subject to a cyber incident. Nissan is working to investigate the extent of the incident and whether any personal information has been accessed.

securityweek.com · 2 min

TLDR InfoSec

HACKTIVISTS HACKED AN IRISH WATER UTILITY AND INTERRUPTED THE WATER SUPPLY

Hacktivists hacked a small water utility in the Erris area of Ireland and interrupted the water supply for two days. The cyber attack impacted 180 homeowners and the Eurotronics water pumping system. The attackers defaced the user interface of the water-pumping system.

securityaffairs.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech