The Daily Index — Monday, January 22, 2024

GENERAL

TLDR InfoSec

THURSDAY, FEBRUARY 8, 11 AM // SAVE YOUR SPOT

Summary unavailable

bh-digital.blackhat.com

TLDR InfoSec

CYBERATTACK TARGETING UK COUNCILS CAUSES ONLINE DISRUPTION

Three UK councils - Canterbury, Dover, and Thanet - have taken some public systems offline due to a cybersecurity incident under investigation. The authorities are working with the National Cyber Security Centre to understand the impact, which has disrupted online services for hundreds of thousands of residents.

techcrunch.com · 3 min

TLDR InfoSec

VANS, SUPREME OWNER VF CORP SAYS HACKERS STOLE 35 MILLION CUSTOMERS’ PERSONAL DATA

VF Corp, the owner of Vans, Supreme, and The North Face, has reported to the SEC that hackers stole the data of 35.5 million customers. VF Corp says that it doesn't retain consumer social security numbers, bank account info, or payment card information and does not have any evidence that attackers stole customers’ passwords. VF Corp has not disclosed what data has been stolen.

techcrunch.com · 2 min

TLDR InfoSec

THE FIVE ERAS OF CYBERSECURITY

This post navigates what the author calls the five eras of cybersecurity. From early ciphers that were secure against manual attacks but vulnerable to computers to the latest era which will see us dismantle much of what we've built over decades to create a more secure, resilient, privacy-focused digital future.

medium.com · 6 min

TLDR InfoSec

SOCIAL ENGINEERING: GOING ON THE ATTACK

This post aims to set up a hypothetical phishing page for educational purposes to raise cybersecurity awareness. It is not a super sophisticated effort, but it shows the dangers of phishing pages and the social engineering behind them.

rtolstosheyev.medium.com · 7 min

TLDR InfoSec

AMAZON ECS IS THE NEW EC2 FOR CRYPTO MINING

A post from DataDog that walks through two different attack scenarios that it has observed. In the first scenario, an attacker enumerated their credentials, established persistence, attempted to move laterally, and finally attempted to run a large EC2 instance in an unused region before being blocked. In the second scenario, the attacker immediately launched crypto mining tasks on ECS Fargate with 25 tasks in 17 regions, showing that this method can be much more effective.

securitylabs.datadoghq.com · 5 min

TLDR InfoSec

NIGHTSHADE, THE FREE TOOL THAT ‘POISONS’ AI MODELS, IS NOW AVAILABLE FOR ARTISTS TO USE

Nightshade is a free tool that lets artists "poison" AI models from training on their work. It is now publicly available after months of development. It subtly alters images to trick AI into misidentifying them, weaponizing machine learning against itself to protect artists' creations.

venturebeat.com · 4 min

TLDR InfoSec

CRITICAL VULNERABILITIES FOUND IN OPEN SOURCE AI/ML PLATFORMS

Huntr researchers recently discovered multiple high-severity vulnerabilities in popular AI/ML solutions like MLflow, ClearML, and Hugging Face. The most critical issues are in MLflow, including a path traversal bug allowing file deletion (CVE-2023-6831) and a data module flaw enabling path manipulation to overwrite files and achieve RCE

securityweek.com · 4 min

TLDR InfoSec

TOP OFFICIAL SAYS KANSAS COURTS NEED AT LEAST $2.6 MILLION TO RECOVER FROM CYBERATTACK

The Kansas court system requires at least $2.6 million in additional funds to recover from an October cyberattack that disrupted electronic filings and online records access for weeks.

independent.co.uk · 3 min

TLDR InfoSec

HOW A 27-YEAR-OLD CODEBREAKER BUSTED THE MYTH OF BITCOIN’S ANONYMITY

This excerpt from 'Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency' tells the story of how Sarah Meiklejohn discovered that Bitcoin could be deanonymized. While Meiklejohn was a PhD student at UCSD, she became fascinated by the privacy claims made by users, developers, and even the creator of Bitcoin. Slowly via experimentation, she discovered methods to link together disparate transactions and form chains of payments that are critical to modern-day crypto tracking operations.

wired.com · 13 min

TLDR InfoSec

SSH HAS SECRETS (X THREAD)

In this X thread, a user shares tricks for navigating the SSH Shell, like how to find out how many layers of SSH you're in and how to pass port forwarding connection requests after establishing a connection.

twitter.com

TLDR InfoSec

THE STATE OF SOFTWARE SUPPLY CHAIN SECURITY 2024

ReversingLabs tracks the landscape of software supply chain security and reports on trends that it has observed. Some key trends in 2023 were the proliferation of protestware, more malicious packages being hosted on repositories, and PyPi overtaking npm for the most malicious packages.

reversinglabs.com · 12 min

TLDR InfoSec

FTC BANS ONE MORE DATA BROKER FROM SELLING YOUR LOCATION INFO

The US Federal Trade Commission (FTC) has reached a settlement with Texas-based data aggregation company InMarket Media, banning it from selling Americans' precise location data.

bleepingcomputer.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech