The Daily Index — Friday, February 9, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CHINESE HACKING CAMPAIGN AIMED AT CRITICAL INFRASTRUCTURE GOES BACK FIVE YEARS

A CISA reveals that the Chinese threat actor Volt Typhoon has maintained footholds in critical infrastructure for at least five years. The report doesn’t mention any specific companies but mentions the rail, aviation, mass transit, highway, maritime, pipeline, water, and sewage industries.

reuters.com · 2 min

TLDR InfoSec

CRITICAL BOOT LOADER VULNERABILITY IN SHIM IMPACTS NEARLY ALL LINUX DISTROS

The maintainers of Shim have released a new version to fix 6 security vulnerabilities, including one critical flaw that could allow for remote code execution. Shim is used as a first-stage bootloader in many Linux distros for UEFI systems. The vulnerability stems from Shim’s HTTP boot support trusting attacker-controlled values when parsing an HTTP response.

thehackernews.com · 3 min

TLDR InfoSec

YARA THREAT DETECTION LAB

This article covers how to identify file IoCs and create YARA rules to detect malicious activity using tools like yarGen and Arya for generation and testing. Developing YARA skills is critical for security roles to detect and mitigate threats. YARA allows creating customized rules matching an organization's needs to classify malware based on signatures.

medium.com · 6 min

TLDR InfoSec

KMS KEY POLICY PRIVILEGE ESCALATION

This post presents an attack chain that could allow an AWS Administrator to override a KMS key policy that was restricted to only a specific identity. In this attack scenario, one admin can lock down a KMS key to their specific use, but another admin can bypass these restrictions by deleting the first admin’s IAM user, changing the contact on the AWS account, and then opening a ticket with AWS support to recover the key. As no identity will be able to access the key, AWS support will then contact the new phone number to verify the request and facilitate the reset. The post ends with some potential mitigations.

cloudonaut.io · 5 min

TLDR InfoSec

SHELLCODE EVASION USING WEBASSEMBLY AND RUST

Meterpreter and its helper PEs are easily detected by antivirus programs due to their age and widespread use. This can be overcome by leveraging WebAssembly, a low-level assembly-like language that can be run in web browsers and written in multiple backend languages. This article provides code examples in Rust and explains how to compile Rust to Wasm.

balwurk.com · 5 min

TLDR InfoSec

CYBERCRIME DUO ACCUSED OF PICKING $2.5M FROM APPLE'S ORCHARD

Apple was likely defrauded of a total of $2.6M in gift cards/hardware by hackers Noah Roskin-Frazee and Keith Latteri via an Apple contractor. Though unnamed in the case, the victim matches Apple's description and location. The duo allegedly stole and resold items, cashing in on the theft from Apple and its customer support contractor.

theregister.com · 4 min

TLDR InfoSec

US AGENCY DECLARES AI CLONED VOICE ROBOCALLS ILLEGAL

The FCC has officially banned robocalls using AI-generated voices, deeming them "artificial" and illegal under existing laws like the Telephone Consumer Protection Act. While fake AI celebrity calls will likely still plague phones, this makes it clear that such scams violate robocall prohibitions.

reuters.com · 3 min

TLDR InfoSec

SURGE IN DEEPFAKE “FACE SWAP” ATTACKS PUTS REMOTE IDENTITY VERIFICATION AT RISK

A new report by biometric firm iProov shows that deepfake "face swap" attacks have increased by 704% from the first to the second half of 2023. Fraudsters are using off-the-shelf tools to create manipulated images and videos, making it easier to create convincing deepfakes. These deepfakes can trick remote identity verification systems into believing that the subject's "liveness" is real.

tripwire.com · 2 min

TLDR InfoSec

CRITICAL SECURITY ISSUE AFFECTING TEAMCITY ON-PREMISES (CVE-2024-23917) – UPDATE TO 2023.11.3 NOW

The vulnerability (CVSS 9.8 out of 10) affects all TeamCity On-Premises versions from 2017.1 through 2023.11.2 and allows for unauthenticated attacks.

blog.jetbrains.com · 5 min

TLDR InfoSec

HACK TRICKS PLAGIARIZED CONTENT FROM CLOUD CREATORS (X THREAD)

HackTricks stole content from others and may have included stolen content in its course. This thread contains screenshots with examples of the stolen content.

twitter.com

TLDR InfoSec

RANSOMWARE PAYMENTS REACHED RECORD $1.1B IN 2023

Summary unavailable

bleepingcomputer.com · 3 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech