The Daily Index — Wednesday, January 17, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

SCHOOL SOFTWARE BREACH REVEALS PRIVATE DATA ON MILLIONS OF USERS

A security researcher discovered an unprotected database belonging to a school security company, Raptor Technologies. The 827GB database contains four million records that include student health information, court protection orders, school layouts, school security information, and background checks. Raptor Technologies has secured the database and reports that it has no evidence that the database was accessed by anyone else.

techradar.com · 3 min

TLDR InfoSec

WINDOWS SMARTSCREEN FLAW EXPLOITED TO DROP PHEMEDRONE MALWARE

Trend Micro reports that a Windows Defender SmartScreen vulnerability that was patched in the November 2023 Patch Tuesday is being actively exploited in a campaign to drop the Phemedrone malware. The campaign involves using a specially crafted internet shortcut file to bypass SmartScreen, download a control panel item file from the attacker’s C2, and execute the loader, which establishes persistence and runs the malware. The Phemedrone info-stealer targets browsers, crypto wallets, Discord credentials, files, FTP connection info, system info, Steam, and Telegram.

bleepingcomputer.com · 4 min

TLDR InfoSec

WEB LLM ATTACKS

This blog post goes through what LLM attacks are and shares examples of how to execute them. Web LLM attacks can retrieve protected data, trigger harmful actions via APIs like SQL injection, and attack systems querying the model. It resembles exploiting SSRF vulnerabilities - abusing a server-side system to attack components not directly accessible.

portswigger.net · 10 min

TLDR InfoSec

VBA: HAVING FUN WITH MACROS, OVERWRITTEN POINTERS & R/W/X MEMORY

This blog post walks through how to create a stealthy arbitrary code execution attack on macOS. The author does this by seeking execution from memory without documented functions using just RtlMoveMemory and DispCallFunc to minimize traces.

adepts.of0x.cc · 8 min

TLDR InfoSec

FUZZING AND BYPASSING THE AWS WAF

The Sysdig Threat Research Team discovered a payload that utilizes the onbeforetoggle HTML attribute to bypass the AWS WAF’s Managed Rules’ protection. This post details how they built a fuzzer to fuzz for XSS payloads against the AWS WAF and details the bypass that they discovered. The vulnerability was patched by AWS after it was reported.

sysdig.com · 5 min

TLDR InfoSec

BURNOUT: INFERNO DRAINER’S MULTIMILLION-DOLLAR SCAM SCHEME DETAILED

The now inactive Inferno Drainer scam created over 16,000 malicious domains from 2022-2023 to phish cryptocurrency wallet credentials using high-quality phishing pages spoofing Web3 protocols. It scammed over 137,000 victims and stole $87 million. Inferno Drainer offered its scam-as-a-service malware to affiliates for 20% of earnings. It spoofed 100+ crypto brands via phishing sites on the 16,000+ domains.

group-ib.com · 8 min

TLDR InfoSec

HUNDREDS OF THOUSANDS OF DOLLARS WORTH OF SOLANA CRYPTOCURRENCY ASSETS STOLEN IN RECENT CLINKSINK DRAINER CAMPAIGNS

Mandiant posts about the CLINKSINK Drainer Campaign that was executed after its X account was hacked. Mandiant notes that hundreds of thousands of dollars worth of Solana cryptocurrency assets have been stolen in recent CLINKSINK drainer campaigns. These campaigns involve the use of social media and chat applications to distribute cryptocurrency-themed phishing pages, which trick victims into connecting their wallets and approving fraudulent transactions.

mandiant.com · 7 min

TLDR InfoSec

ECB TO RUN FIRST CYBER RESILIENCE STRESS TESTS

The European Central Bank is planning to conduct its first cyber resilience stress tests on 109 supervised banks to assess their ability to respond to and recover from a cyber attack. The tests will simulate a scenario where a cyber attack disrupts the banks' daily operations, and the banks will be evaluated on their response and recovery measures.

finextra.com · 1 min

TLDR InfoSec

DDOS ATTACKS ON THE ENVIRONMENTAL SERVICES INDUSTRY SURGED IN 2023

Cloudflare published its DDoS Threat Report for Q4 2023, which observed a 61,839% increase in DDoS attacks targeting environmental services in 2023. The most targeted industries were cryptocurrency, gaming and gambling, and telecommunications.

thehackernews.com · 3 min

TLDR InfoSec

AWS ACCOUNTS DISCONTINUES THE USE OF SECURITY CHALLENGE QUESTIONS

AWS Accounts has announced that users will no longer be able to add security challenge questions to accounts that don’t already utilize them.

aws.amazon.com · 1 min

TLDR InfoSec

HELLOFRESH FINED £140,000 FOR 80 MILLION SPAM MESSAGES

HelloFresh, a recipe kit delivery service, has been fined £140,000 by the UK's Information Commissioner's Office (ICO) for sending 80 million spam messages to customers without proper consent.

hackread.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech