The Daily Index — Wednesday, January 10, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

MAJOR FIRMS EXPOSED TO SUPPLY CHAIN ATTACKS VIA NEW CLASS OF CI/CD ATTACK

A new CI/CD attack that utilizes self-hosted GitHub runners to achieve arbitrary code execution has been reported. The default setup instructions for self-hosted GitHub runners features persistent runners and only requires approval for the attacker’s first request. Attackers can exploit the bug to poison images for major companies and even GitHub itself.

securityweek.com · 2 min

TLDR InfoSec

HACKERS CAN INFECT NETWORK-CONNECTED WRENCHES TO INSTALL RANSOMWARE

Researchers have discovered 23 vulnerabilities in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B, a network-connected wrench used in factories to assemble sensitive instruments and devices. Exploitation of these vulnerabilities could allow hackers to install malware that disables entire fleets of the devices or causes them to tighten fastenings too loosely or tightly.

packetstormsecurity.com · 3 min

TLDR InfoSec

ANALYSIS OF AN INFO STEALER — CHAPTER 1: THE PHISHING WEBSITE

This post is an analysis of the McAfee-reported iOS apps spreading via Korean phishing sites to steal user data. Unable to find the malicious iOS .ipa on malware sites, the author conducted his own investigation starting from the phishing links to download and analyze the apps.

medium.com · 6 min

TLDR InfoSec

USING HONEYTOKENS TO DETECT (AITN) PHISHING ATTACKS ON YOUR MICROSOFT 365 TENANT

Phishing attacks against Microsoft 365 are rising due to its wide use and MFA bypass techniques like AiTM phishing. This post explains how to detect AiTM phishing on Microsoft Login pages.

zolder.io · 5 min

TLDR InfoSec

HOW TO SECURELY LET FRONTEND APPS DIRECTLY ACCESS AWS SERVICES

This post presents a cost-minimization approach that utilizes Cognito Identity Pools to control authentication and authorization directly from a front-end app. The crux of the solution involves an IAM policy that utilizes DynamoDB Leading Keys to handle user separation. The post includes sample IAM roles and policies, a worked demo, and a list of advantages and disadvantages of this approach.

theburningmonk.com · 5 min

TLDR InfoSec

ADVERSARIAL MACHINE LEARNING: A TAXONOMY AND TERMINOLOGY OF ATTACKS AND MITIGATIONS

NIST has published a guidance describing the various types of attacks that can be used to target artificial intelligence systems, warning AI developers and users that there is currently no foolproof method for protecting such systems. The agency has encouraged the community to attempt to find better defenses. The report covers both predictive and generative AI.

csrc.nist.gov · 30 min

TLDR InfoSec

THE I IN LLM STANDS FOR INTELLIGENCE

A post on the curl project’s struggle with researchers’ use of LLMs in their bug bounty program. The curl team receives a myriad of submissions that are generated at least in part by LLMs. These are often high-quality reports with fictional vulnerabilities. The post includes a few examples that show why these reports take more time to triage even if there is no real finding.

daniel.haxx.se · 4 min

TLDR InfoSec

CHINESE FORENSIC FIRM CRACKS APPLE’S AIRDROP TO HELP BEIJING POLICE TRACK SENDERS

The Chinese Bureau of Justice has announced that it worked with a forensics firm to crack Apple’s anonymous AirDrops to track the use and spread of “inappropriate speech.” The firm reported that it was able to analyze iPhone logs for hashed values of senders' mobile numbers and emails, which it then cracked with a rainbow table.

scmp.com · 3 min

TLDR InfoSec

2023 CYBER SECURITY VENDOR FUNDING REPORT

The number of funding rounds increased from 303 in 2022 to 346 in 2023. Companies raised a total of $8.7 billion in 2023, compared to $14.5 billion in 2022, which represents a 40% drop.

pinpointsearchgroup.com · 6 min

TLDR InfoSec

X USERS FED UP WITH CONSTANT STREAM OF MALICIOUS CRYPTO ADS

X users who have shown interest in cryptocurrencies are reporting that their feeds are full of malicious crypto ads that lead to crypto drainers, fake airdrops, and other scams. MalwareHunterTeam and ScamSniffer have started tracking the volume of scams, and users have started leaving community notes on ads warning users about scams.

bleepingcomputer.com · 3 min

TLDR InfoSec

TOP 10 WEB HACKING TECHNIQUES OF 2023 NOMINATIONS OPEN

Portswigger has begun accepting nominations for its “Top 10 Web Hacking Techniques of 2023” roundup. The announcement includes a list of preliminary nominations that feature interesting web hacking techniques.

portswigger.net · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech