The Daily Index — Monday, March 11, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

UNPATCHED SCEINER SMART LOCK VULNERABILITIES ALLOW HACKERS TO OPEN DOORS

Security researchers have revealed multiple vulnerabilities in Sceiner's smart lock firmware that allow attackers to manipulate its locks and open doors. The issues, which affect products sold by Sceiner and brands like Kontrol and Elock, include insecure cryptography, plaintext processing, and outdated protocols in the lock firmware and associated mobile app used for remote control.

securityweek.com · 3 min

TLDR InfoSec

SPOOFED GOOGLE MEET, ZOOM, AND SKYPE MEETING LINKS USED TO SPREAD MALWARE

A new social engineering campaign uses links resembling those generated by Skype, Zoom, and Google Meet to trick users into downloading RATs. The campaign targets Windows and Android users with specialized Trojan programs for each platform.

darkreading.com · 2 min

TLDR InfoSec

ON LOADED VS. EXECUTED LIBRARIES DURING RUNTIME – WHAT THIS MEANS FOR REACHABILITY

Applications have different mechanisms for importing dependencies. Executed libraries are dependencies that actually run. Library loading is when a dependency is imported and loaded into memory prior to usage. Runtime tracing can determine library usage.

oligo.security · 6 min

TLDR InfoSec

USING FORM HIJACKING TO BYPASS CSP

Form hijacking is where an attacker exploits an HTML injection vulnerability by utilizing the formaction attribute or injecting their own form, thereby bypassing CSP. This is possible because the form-action directive was added in CSP v2 and is not covered by default-src. This post lists options to fix this and presents an overview of different scans in Burp Suite related to CSPs.

portswigger.net · 5 min

TLDR InfoSec

EXPLORING THE GITHUB ADVISORY DATABASE FOR FUN AND (NO) PROFIT

This post looks at statistical trends of vulnerabilities in the GitHub Advisory Database. The most common CWE associated with vulnerabilities was cross-site scripting. Maven was the ecosystem associated with the greatest number of vulnerabilities.

blog.aquia.us · 7 min

TLDR InfoSec

FORMER GOOGLE ENGINEER CHARGED WITH STEALING AI TRADE SECRETS

The US charged ex-Google engineer Linwei Ding with stealing trade secrets related to AI and tensor processing units, including chip designs, GPU details, and cluster management software. Ding allegedly stole the data with the intent of using it at AI firms he was associated with in China. If convicted, he faces up to 10 years in prison per count.

techtarget.com · 5 min

TLDR InfoSec

BROKE CYBER PROS FLOCK TO CYBERCRIME SIDE HUSTLES

Cybersecurity professionals are increasingly tempted to earn extra income on the dark web by offering offensive cybercrime services like phishing, crypto theft, and malicious coding. This trend is driven by layoffs, stagnant salaries, and employers unwilling to raise compensation, pitting enterprises against insiders with intimate knowledge of their vulnerabilities.

darkreading.com · 6 min

TLDR InfoSec

I STOPPED USING PASSWORDS. IT’S GREAT - AND A TOTAL MESS

This article describes an experience with adopting passkeys. When the experience works properly, passkeys feel seamless and futuristic. There are still issues with websites adopting passkey support and interoperability between devices.

wired.com · 6 min

TLDR InfoSec

CISA PRINCIPLES FOR PACKAGE REPOSITORY SECURITY

The CISA has laid out key actions for securing open source software.

repos.openssf.org · 4 min

TLDR InfoSec

TIKTOK USERS FLOOD CONGRESS WITH CALLS AS POTENTIAL BAN ADVANCES IN THE HOUSE

TikTok sent a push notification that included a mechanism to search for representatives to its users to urge representatives to vote against an initiative to force ByteDance to divest from TikTok or face a ban.

theguardian.com · 2 min