The Daily Index — Monday, January 29, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

AKIRA RANSOMWARE INFILTRATES UK-BASED LUSH

Akira ransomware group claims it breached Lush and secured 110GB of data. It is threatening to publish the data since negotiations have apparently failed. Passport scans were likely accessed, as well as financial, accounting, tax, project, and client docs. This incident demonstrates that Akira is a dangerous and flexible new threat that is able to hit major corporations.

privacyaffairs.com · 2 min

TLDR InfoSec

NEW CHERRYLOADER MALWARE MIMICS CHERRYTREE TO DEPLOY PRIVESC EXPLOITS

Security researchers have discovered a new Golang-based malware loader called CherryLoader that mimics the icon and name of the CherryTree note-taking app to deceive users into installing it. Once installed, it drops either the JuicyPotatoNG or PrintSpoofer exploit and then runs a batch script to establish persistence. This article contains indicators of compromise.

thehackernews.com · 2 min

TLDR InfoSec

I’M NOT A PENTESTER (AND YOU MIGHT NOT WANT TO BE ONE EITHER)

This post dives into how the author went from wanting to work in infosec to deciding to pause and rethink what they actually wanted to do. You don't need to be an expert to enjoy learning about security. Working in security full-time isn't as exciting as it sounds. You can still explore security concepts without making a career out of it.

assume-breach.medium.com · 11 min

TLDR InfoSec

CYBERSECURITY AS RELATABLE AS POSSIBLE (#4)— HACKERS

Hackers blur the lines between heroes and villains in the digital landscape. Though some are outlaws, others pioneer new possibilities. This post looks at the various types of hackers and their motives. Famous hackers have shaped the digital world through both ethical and illegal means. Hackers fundamentally think differently and use tools in unintended ways that can build up or tear down.

medium.com · 6 min

TLDR InfoSec

HOW WE DISCOVERED OVER 18,000 API SECRET TOKENS

The Escape team underwent a project to spider 189.5M URLs to search for API keys and discovered 18,000 secrets, which included $20M in vulnerable Stripe tokens. This post covers how the team built a custom web spider using Golang and fasthttp along with the data analysis and verification pipeline. The process was deployed on a k8s cluster that could scale to 150 concurrent worker instances. The data collection took over 69 hours.

escape.tech · 6 min

TLDR InfoSec

Take back control of your DNS with Control D — from $2/mo

Summary unavailable

controld.com

TLDR InfoSec

HACKERS EARN $1.3M FOR TESLA, EV CHARGER, INFOTAINMENT EXPLOITS AT PWN2OWN AUTOMOTIVE

Researchers earned over $1.3 million hacking Teslas, EV chargers, and infotainment systems at Pwn2Own Automotive. Synacktiv won $450K for Tesla hacks. Day 1 saw $700K awarded, including $60K EV charger and $40K infotainment bounties. The 3-day event revealed 49 new auto vulnerabilities.

securityweek.com · 3 min

TLDR InfoSec

HOW LEAST PRIVILEGE LEADS TO A FALSE SENSE OF SECURITY

A post that provides a deep dive into the concept of Least Privilege as applied to AWS IAM. After providing some background and worked examples on how to determine the effective policy of an AWS principal, the post elaborates on why striving for Least Privilege may not be sufficient or productive in all cases.

robertdemeyer.com · 12 min

TLDR InfoSec

A RECIPE FOR SCALING SECURITY

A post from the Google Security team on creating large-scale security changes. It begins by detailing some scalability issues in the team’s attempt to roll out Strict CSPs. The post then delves into the tooling and metrics that were required to collect data and implement changes that scale better to the immense number of services that Google operates.

bughunters.google.com · 5 min

TLDR InfoSec

JENKINS SECURITY ADVISORY 2024-01-24

A critical vulnerability in Jenkins' built-in command line interface (CLI) allows attackers to obtain cryptographic keys that can be used to execute arbitrary code remotely. Update ASAP.

jenkins.io · 10 min

TLDR InfoSec

CLOUD THREAT LANDSCAPE (WEBAPP)

Cloud Threat Landscape is a comprehensive threat intel database of cloud security incidents, threat actors, tools, and techniques.

wiz.io

TLDR InfoSec

THOUSANDS OF GITLAB INSTANCES UNPATCHED AGAINST CRITICAL PASSWORD RESET BUG

More than 5,000 GitLab servers have not been patched for a critical vulnerability that allows attackers to hijack the password reset process.

securityweek.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech