The Daily Index — Wednesday, February 7, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

VERIZON EMPLOYEE INADVERTENTLY LEAKS DATA OF 63K COLLEAGUES

Verizon filed a data breach notification after a company employee obtained a file of 63,206 employees’ personal data. The data includes social security numbers, gender, union affiliation, date of birth, and compensation information. Verizon stated that it has no evidence that the data was used maliciously or shared outside of Verizon.

cybernews.com · 2 min

TLDR InfoSec

FINANCE WORKER PAYS OUT $25 MILLION AFTER CALL WITH DEEPFAKE CFO

An employee at a multinational financial firm fell for a social engineer attack that led them to remit $200 million Hong Kong dollars. The employee was suspicious when they originally received the communication from the UK-based CFO but was convinced after a call with the CFO and several colleagues, who all turned out to be deepfakes.

cnn.com · 2 min

TLDR InfoSec

THE RISK OF A LEAKED STRIPE API KEY

This post evaluates the risks of a leaked Stripe API key. It proposes 5 attack paths: disclosing PII, generating promo codes, changing prices, defacing websites, and making unauthorized wire transfers. The post ends with some best practices for protecting Stripe API keys.

trufflesecurity.com · 5 min

TLDR InfoSec

UNLEASHING THE POWER OF SCAPY FOR NETWORK FUZZING

Summary unavailable

darkrelay.com · 3 min

TLDR InfoSec

ENRICHING THREAT INTELLIGENCE WITH MAPPINGS

This blog post talks about utilizing the control and security stack mappings created by the Center for Threat-Informed Defense (Center). These mappings, like NIST 800-53 Control Mappings and Security Stack Mappings for Google Cloud Platform and Amazon Web Services, enable defenders to connect threat information to actionable guidance, making it easier to detect and mitigate threats. Center is also working on expanding its collection of mappings and making them more accessible.

medium.com · 5 min

TLDR InfoSec

RESUMELOOTERS - NEW MALICIOUS GROUP

ResumeLooters have used SQL injection and XSS since early 2023 to hit Asia-Pacific recruitment/retail sites, stealing 500K+ user records from 65 sites. The group focuses on India, Taiwan, Thailand, and Vietnam, leveraging penetration testing tools like sqlmap. It injects XSS scripts into job sites to display phishing forms and steal admin creds.

group-ib.com · 18 min

TLDR InfoSec

GOOGLE CONTRIBUTES $1 MILLION TO RUST

Google announced a grant of $1 million to the Rust Foundation to improve interoperability between legacy C++ codebases and Rust. Google said that Rust has proactively prevented hundreds of vulnerabilities from affecting the Android operating system. Google will also begin to publish audits of some of the crates used in open source Google projects.

securityweek.com · 3 min

TLDR InfoSec

RUST WON’T SAVE US: AN ANALYSIS OF 2023’S KNOWN EXPLOITED VULNERABILITIES

This analysis of the vulnerabilities from CISA's Known Exploited Vulnerabilities (KEVs) attempts to analyze whether the current efforts in the information security industry match the current threat vectors being abused. The analysis provides recommendations for vendors, developers, defenders, and researchers to address these vulnerabilities.

horizon3.ai · 6 min

TLDR InfoSec

BRITAIN, FRANCE LEAD 35 NATION AGREEMENT ON CONTROLLING SPYWARE, MERCENARY HACKERS

Dozens of countries including France, the UK, and the US, along with tech giants such as Google, Meta, and Microsoft, have signed a joint agreement to combat the use of commercial spyware in ways that violate human rights.

reuters.com · 3 min

TLDR InfoSec

BUYING SPYING: INSIGHTS INTO COMMERCIAL SURVEILLANCE VENDORS REPORT

This report dives into how commercial surveillance vendors are enabling the proliferation of dangerous hacking tools.

blog.google · 10 min

TLDR InfoSec

DEFCON 32 WAS CANCELED, WE UN-CANCELED IT

Caesars canceled DEFCON 32’s contract, so DEFCON will be moving to the Las Vegas Convention Center.

forum.defcon.org · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech