The Daily Index — Friday, December 22, 2023

ATTACKS & VULNERABILITIES

TLDR InfoSec

XFINITY DATA BREACH IMPACTS 36 MILLION INDIVIDUALS

The data breach disclosed recently by Comcast’s Xfinity impacted nearly 36 million individuals, the company told US authorities. Hackers gained access to customer usernames and hashed passwords as well as names, dates of birth, contact information, secret questions and answers, and the last four digits of social security numbers in some cases.

securityweek.com · 3 min

TLDR InfoSec

MICROSOFT: HACKERS TARGET DEFENSE FIRMS WITH NEW FALSEFONT MALWARE

Microsoft has warned that Iranian cyber-espionage group APT33 is using new backdoor malware called FalseFont to target defense contractors worldwide. FalseFont provides remote access to compromised systems and file transfer to its command-and-control (C2) servers. Microsoft has advised network defenders to reset credentials for accounts targeted in password spray attacks and reset any remote access options like RDP.

bleepingcomputer.com · 2 min

TLDR InfoSec

A DETAILED ANALYSIS OF THE MENORAH MALWARE USED BY APT34

In this blog post, the researchers describe a detailed analysis of the Menorah Malware, originally discovered by Trend Micro in August and used by APT34. The malware creates a mutex to ensure only one copy runs at a time and extracts the hostname and username to compute a hash that identifies the infected machine. It can perform commands such as creating new processes, listing files and subdirectories, exfiltrating files, and downloading files using a hard-coded C2 server.

securityscorecard.com · 3 min

TLDR InfoSec

ABUSING LIFTOFF ASSEMBLY AND EFFICIENTLY ESCAPING FROM SBX

Chrome has implemented new mitigations to make it more difficult to exploit the v8 JavaScript engine. The "V8 Sandbox" project was developed as a way to isolate and protect v8. This document discusses Liftoff, v8's WebAssembly compiler, and highlights some interesting opcodes generated by Liftoff.

retr0.zip · 9 min

TLDR InfoSec

HOW TO START REVIEWING CODE?

This blog post provides a pathway to getting started in code review. The post suggests starting out with small vulnerable code snippets before moving on to CVE patches and then finally full libraries. It was written in 2021 and therefore does not make any mention of AI assistants like ChatGPT or Copilot.

blog.pentesterlab.com · 4 min

TLDR InfoSec

WEB INJECTIONS ARE BACK ON THE RISE: 40+ BANKS AFFECTED BY NEW MALWARE CAMPAIGN

In this blog post, the researchers delve into an analysis of the web injection utilized in the recent malware campaign, its evasive techniques, code flow, targets, and the methods employed to achieve them.

securityintelligence.com · 10 min

TLDR InfoSec

BEHIND THE SCENES: JASKAGO’S COORDINATED STRIKE ON MACOS AND WINDOWS

This report uncovers a stealthy cross-platform Go malware stealer dubbed JaskaGO, which evades many antivirus solutions. JaskaGO poses a severe Windows & macOS threat as its extensive C2 command set enables advanced system persistence and data exfiltration. The focus of this stealer is sensitive user info like browser logins and crypto wallets.

cybersecurity.att.com · 10 min

TLDR InfoSec

CRYPTO SCAMMERS ABUSE X FEATURE TO IMPERSONATE HIGH PROFILE ACCOUNTS

Post URLs on X use the format https://twitter.com/[account_name]/status/[status_id]. The account_name is not validated. Security researchers have reported that crypto scammers have been making use of this “feature” to post crypto scams and fake giveaways while making the URL appear to be from legitimate accounts such as Binance.

bleepingcomputer.com · 2 min

TLDR InfoSec

GOOGLE CHROME SECURITY UPDATE

Google has released an update for Google Chrome, patching a new zero-day high vulnerability CVE-2023-7024 that has already been seen exploited in the wild. It is recommended to update ASAP.

chromereleases.googleblog.com · 1 min

TLDR InfoSec

TOP 15 SANS SUMMIT TALKS OF 2023

A collection of the top-rated talks from SANS Summits in 2023. The talks cover a broad range of topics in the industry.

sans.org · 1 min

TLDR InfoSec

RITE AID BANNED FROM USING AI FACIAL RECOGNITION AFTER FTC COMPLAINT

The FTC has banned Rite Aid from using AI facial recognition software in its stores for 5 years due to a lack of comprehensive safeguards. The FTC alleges that Rite Aid’s technology falsely tagged customers, with a bias against women and people of color.

ftc.gov · 3 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech