The Daily Index — Monday, February 26, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

APPLE SHORTCUTS VULNERABILITY EXPOSES SENSITIVE INFORMATION

A serious vulnerability (CVE-2024-23204) in Apple Shortcuts allows attackers to access sensitive data without user permission. Attackers exploiting the vulnerability can access and transmit sensitive data, posing a risk to user privacy and security. Apple has addressed the issue with updates to iOS and macOS. It is urging users to install the patches promptly to safeguard their information.

packetstormsecurity.com · 2 min

TLDR InfoSec

PRESCRIPTION ORDERS DELAYED AS US PHARMACIES GRAPPLE WITH “NATION-STATE” CYBER ATTACK

Prescription orders in the US are being delayed as pharmacies are experiencing a "nation-state" cyber attack. The attack is believed to coming from a foreign government. It is targeting major pharmacy chains, including Walgreens, Rite Aid, and CVS Health. The attack has disrupted the pharmacies' prescription-filling systems, causing delays across the country.

bitdefender.com · 1 min

TLDR InfoSec

GARTNER IDENTIFIES THE TOP CYBERSECURITY TRENDS FOR 2024

This list covers the top cybersecurity trends that Gartner sees coming in 2024. 2024 will be the year that gen AI-driven security products finally emerge. 2025 will see those tools delivering real risk-management outcomes.

gartner.com · 4 min

TLDR InfoSec

A FEW NOTES ON NITRO ENCLAVES: IMAGES AND ATTESTATION

AWS Nitro Enclaves are a Trusted Execution Environment that is offered for running sensitive workloads by AWS. It is somewhat lacking in documentation. This post offers a look at what Nitro Enclaves are and how images and attestation work. The post also includes a TL;DR checklist at the top.

blog.trailofbits.com · 8 min

TLDR InfoSec

TRUFFLEHOG NOW DETECTS AWS CANARIES WITHOUT SETTING THEM OFF

Truffle Security performed a scraping project to generate a list of Amazon Account IDs that are used by Thinkst to generate AWS canaries. The Truffle Security team identified about a half dozen Account IDs which can be used to identify if an AWS Key ID is a canary token. The capability has been added to the open-source TruffleHog tool.

trufflesecurity.com · 5 min

TLDR InfoSec

VENDING MACHINE ERROR REVEALS SECRET FACE IMAGE DATABASE OF COLLEGE STUDENTS

An M&M vending machine at a university was secretly using facial recognition-enabled collecting data without consent. The machines could estimate age/gender. The university has confirmed that it will disable the tech and that it plans to remove the machines, though the timeline is unclear.

arstechnica.com · 4 min

TLDR InfoSec

REDIS SERVERS TARGETED WITH NEW ‘MIGO’ MALWARE

Redis servers are under attack by new malware that deploys rootkits and cryptominers. The attackers are disabling Redis protections and loopback policies to open doors for the Migo malware payload and fetching XMRig miners from GitHub.

securityweek.com · 3 min

TLDR InfoSec

FTC TO BAN AVAST FROM SELLING BROWSING DATA FOR ADVERTISING PURPOSES

The FTC has ordered Avast to pay $16.5 million and banned it from selling users’ web browsing data or licensing it for advertising purposes. Avast collected a staggering amount of personal data amounting to more than 8 petabytes between the years of 2014 to 2020 while marketing its products as protecting users from browser tracking.

bleepingcomputer.com · 3 min

TLDR InfoSec

AI SECURITY OVERVIEW

An AI threat security diagram and guide from OWASP around AI security threats.

owaspai.org · 10 min

TLDR InfoSec

REDDIT STRIKES $60M DEAL ALLOWING GOOGLE TO TRAIN AI MODELS ON ITS POSTS

Reddit and Google have reached a deal to allow Google to scrape Reddit posts to train AI models. Google will also provide Reddit with tools to improve its internal search.

apnews.com · 2 min

TLDR InfoSec

CROOKS STOLE $10 MILLION FROM AXIE INFINITY CO-FOUNDER

Crooks stole almost $10 million from Jeff "Jihoz" Zirlin, co-founder of the video game Axie Infinity, and the Ronin Network.

securityaffairs.com · 2 min

TLDR InfoSec

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

Summary unavailable

tldr.tech