The Daily Index — Monday, March 18, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

THREAT ACTORS LEAKED 70,000,000+ RECORDS ALLEGEDLY STOLEN FROM AT&T

More than 70 million records from an unspecified division of AT&T were leaked on the Breached hacking forum. The legitimacy of the stolen data has been verified, though its source remains uncertain, possibly linked to a third-party organization.

securityaffairs.com · 2 min

TLDR InfoSec

GHOSTRACE – NEW DATA LEAK VULNERABILITY AFFECTS MODERN CPUS

Researchers have identified a new data leakage vulnerability called GhostRace which affects modern CPUs that support speculative execution. This vulnerability allows attackers to extract data from the processor through speculative executable code paths, posing a significant security risk.

thehackernews.com · 3 min

TLDR InfoSec

OPENING PANDORA’S BOX - SUPPLY CHAIN INSIDER THREATS IN OPEN SOURCE PROJECTS

This article is about the risks of insider threats in open-source projects that use GitHub Actions. Users with write access to a repository can push and immediately delete malicious Git tags. This vulnerability can be mitigated by enabling Tag protection so that these commits don’t trigger malicious actions.

boostsecurity.io · 7 min

TLDR InfoSec

MASTERING CYBER THREAT INTELLIGENCE WITH OBSIDIAN

Obsidian can be used for performing live correlations and statistics at scale using private Cyber Threat Intelligence datasets. Due to the local nature of Obsidian, this setup can provide privacy and security. Additional features like plugins can help extend the tool with features like diagrams, mind maps, statistics, and charts.

bank-security.medium.com · 11 min

TLDR InfoSec

ANDROID MALWARE DISGUISED AS WEDDING INVITATION SENT TO SENIOR CITIZENS

Android malware targeting the elderly was sent out as fabricated wedding invitations. The victims, believing the APK to contain more details about a free wedding, installed the malware and ended up having their SMS data stolen. The malware used a Telegram bot as its command and control server.

blog.f-secure.com · 7 min

TLDR InfoSec

DEATH KNELL OF THE NVD?

As the publishers of CVEs, the NVD is a core part of many security systems. The NVD recently posted an announcement that it is establishing a consortium to address challenges within the organization. This has led to 90% of proposed CVEs going unassigned and the association of CPEs, CVSS, and CWEs to CVEs to be severely halted. This author proposes a few alternatives to the NVD.

resilientcyber.substack.com · 5 min

TLDR InfoSec

NEW ACOUSTIC ATTACK DETERMINES KEYSTROKES FROM TYPING PATTERNS

Researchers from Augusta University have developed a new acoustic side-channel attack that can deduce user input based on typing patterns. The attack leverages the distinctive sound emissions of different keystrokes and users' typing patterns. The method can reach a typing prediction accuracy of 43% on average, even in poor conditions such as environments with noise, and does not require controlled recording conditions.

bleepingcomputer.com · 3 min

TLDR InfoSec

NSA RELEASES TOP TEN CLOUD SECURITY MITIGATION STRATEGIES

The NSA has released a collection of ten guides for improving Cloud Security posture.

nsa.gov · 2 min

TLDR InfoSec

US MOVES TO RECOVER $2.3 MILLION FROM "PIG BUTCHERS" ON BINANCE

The US Department of Justice is recovering $2.3 million in cryptocurrency from a "pig butchering" fraud scheme that targeted at least 37 people across the United States.

bleepingcomputer.com · 2 min

TLDR InfoSec

INTERNATIONAL MONETARY FUND EMAIL ACCOUNTS HACKED IN CYBERATTACK

The International Monetary Fund (IMF) disclosed a cyber incident detected in February after unknown attackers breached 11 IMF email accounts hosted on Microsoft's Office 365 platform.

bleepingcomputer.com · 2 min