The Daily Index — Monday, March 4, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

A LEAKY DATABASE SPILLED 2FA CODES FOR THE WORLD’S TECH GIANTS

A database belonging to YX International, which routes millions of SMS messages daily, was left exposed online without a password. The database contained sensitive one-time passcodes that grant access to accounts on Facebook, Google, and TikTok. The company secured the database after being contacted by a security researcher.

techcrunch.com · 3 min

TLDR InfoSec

HACKERS STOLE ‘SENSITIVE’ DATA FROM TAIWAN TELECOM GIANT: MINISTRY

Taiwan's defense ministry has confirmed that hackers stole sensitive military and government documents from Chunghwa Telecom and sold them online. The breach, initially reported by TVBS, included 1.7TB of data that the hackers claim contains contracts and information from the armed forces, foreign ministry, and coast guard.

securityweek.com · 3 min

TLDR InfoSec

A KILLSWITCH FOR AI … DAISY, DAISY?

As AI advances, serious questions arise about its potential impacts on society. Could it destroy civilization, turn us into zombies, or view humans as we view dogs? While AI poses risks, thoughtful regulation and ethical development can help realize benefits and avoid pitfalls depicted in sci-fi like 2001: A Space Odyssey with HAL. This post dives into the current ways we are preparing against AI as a society.

medium.com · 5 min

TLDR InfoSec

HACKING TERRAFORM STATE FOR PRIVILEGE ESCALATION

Terraform can be configured to store state files in a remote backend. This post looks at how attackers can leverage compromised state files. It begins by demonstrating how an attacker could cause AWS resource deletion by confusing a Terraform user into applying a modified state file that results in resource deletion. It then goes on to demonstrate the process of writing and publishing a malicious Terraform provider that can execute code upon Terraform plan or apply and then demonstrates how this can be combined with state file modification to hijack CI/CD systems.

blog.plerion.com · 7 min

TLDR InfoSec

PASSKEYS: THREAT MODELING AND IMPLEMENTATION CONSIDERATIONS

This post begins with an overview of what passkeys are and how they work. The post then discusses threat models around phishing, stolen credentials, and MFA as they relate to passkeys. It concludes with a warning not to implement WebAuthn manually before providing some implementation considerations for passkeys.

slashid.com · 10 min

TLDR InfoSec

BIDEN EXECUTIVE ORDER ON SENSITIVE PERSONAL INFORMATION DOES LITTLE FOR NOW TO CURB DATA MARKET – BUT SPOTLIGHTS THE THREAT THE MARKET POSES

The Biden administration issued an executive order on February 28th identifying "countries of concern" that exploit Americans' personal data as a national emergency. The order aims to prevent these unspecified countries from accessing bulk sensitive data about Americans. It cites the vast commercial data market selling people's information as a crisis necessitating action.

theconversation.com · 5 min

TLDR InfoSec

PRODUCTS ON YOUR PERIMETER CONSIDERED HARMFUL

With security improvements to endpoints, cyber threats have shifted to the perimeter. Many perimeter devices are not built to be secure by design and therefore are ripe targets for exploitation.

ncsc.gov.uk · 4 min

TLDR InfoSec

THE STATE OF ABAC ON AWS IN 2024

Attribute-based access control can be implemented in AWS via tags that store attributes on both Principals and Resources. This post looks at improvements to ABAC since 2020 as well as issues that remain.

ramimac.me · 5 min

TLDR InfoSec

U.S. COURT ORDERS NSO GROUP TO HAND OVER PEGASUS SPYWARE CODE TO WHATSAPP

A U.S. judge has ordered NSO Group to hand over its source code for Pegasus and other products to Meta as part of the social media giant's ongoing litigation against the Israeli spyware vendor.

thehackernews.com · 2 min

TLDR InfoSec

SEMGREP CODE BRINGS MODERN STATIC ANALYSIS TO C/C++

Semgrep Code now supports static analysis for C and C++. Exclusive to the platform, static analysis parses source code before macro expansion, bypassing the complexities associated with C/C++ analysis.

semgrep.dev · 7 min