The Daily Index — Friday, May 17, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

NEW WIFI VULNERABILITY: THE SSID CONFUSION ATTACK

Researchers have uncovered a new vulnerability in the IEEE 802.11 WiFi standard that affects every WiFi client and operating system. The vulnerability occurs because the WiFi standard does not require authentication of the SSID during beaconing which could allow an attacker to trick a victim into connecting to a different network. This post provides more details of the vulnerability and threat models that apply.

top10vpn.com · 12 min

TLDR InfoSec

LINUX MAINTAINERS WERE INFECTED FOR 2 YEARS BY SSH-DWELLING BACKDOOR WITH HUGE REACH

Linux maintainers' infrastructure was infected with backdoor malware for two years, starting in 2009. The attackers accessed encrypted password data and compromised servers connected to kernel.org. The malware spread to thousands of servers, but there is no evidence of tampering with the Linux kernel source code.

arstechnica.com · 3 min

TLDR InfoSec

AWS APPLICATION LOAD BALANCER MTLS WITH OPEN-SOURCE SERVERLESS CA

A tutorial on deploying mutual TLS on an AWS application load balancer utilizing an open-source serverless CA. It includes an overview and explanation of the solution as well as Terraform code for deploying it.

medium.com · 5 min

TLDR InfoSec

UNMASKING ADVERSARY CLOUD DEFENSE EVASION STRATEGIES: MODIFY CLOUD COMPUTE INFRASTRUCTURE PART 1

This blog post discusses adversary tactics in cloud environments, focusing on techniques like modifying cloud compute infrastructure to evade defenses. Adversaries can manipulate cloud components, create snapshots, launch new instances, and modify configurations to bypass security measures and maintain stealthy access. Understanding these techniques can be crucial for defending against malicious activities in the cloud.

permiso.io · 18 min

TLDR InfoSec

TO THE MOON AND BACK(DOORS): LUNAR LANDING IN DIPLOMATIC MISSIONS

This article discusses in depth about malware found by ESET researchers in the European Ministry of Foreign Affairs' computers. These two backdoors, LunarWeb and LunarMail, have been associated with the Turla group. The backdoors use techniques like steganography and communicate via HTTP(S) or email.

welivesecurity.com · 30 min

TLDR InfoSec

DEEPKEEP (PRODUCT LAUNCH)

DeepKeep's AI-Native Trust, Risk, and Security Management (TRiSM) platform provides data scientists and security leaders a valuable understanding of the risks and challenges that AI systems face while also delivering protection and alerts

deepkeep.ai

TLDR InfoSec

FBI SEIZES HACKING FORUM BREACHFORUMS — AGAIN

The FBI, in collaboration with international law enforcement agencies, seized the notorious cybercrime forum BreachForums on Wednesday. BreachForums has been a popular platform for hackers and cybercriminals to advertise, sell, and trade stolen data.

techcrunch.com · 3 min

TLDR InfoSec

THREAT ACTORS MISUSING QUICK ASSIST IN SOCIAL ENGINEERING ATTACKS LEADING TO RANSOMWARE

Microsoft has observed a cybercriminal group called Storm-1811 abusing Quick Assist for social engineering attacks to deploy Black Basta ransomware. The group uses voice phishing to trick victims into installing remote management tools, followed by QakBot, Cobalt Strike, and ultimately the ransomware.

microsoft.com · 10 min

TLDR InfoSec

ASSUMPTIONS_MADE

When LLMs and AI agents respond to user inputs, they inherently make certain assumptions to provide context and accurate responses to a user. These assumptions should be explicitly stated in an assumptions_made metadata field. This would provide more insight into improving LLMs and AI agents.

josephthacker.com · 3 min

TLDR InfoSec

ANDROID'S AI ERA INCLUDES EAVESDROPPING ON PHONE CALLS, WARNING YOU ABOUT SCAMS

Google demoed a large variety of AI features for Android devices, including the capability for Gemini to notify users if a call seems to be from a scammer.

arstechnica.com · 2 min

TLDR InfoSec

FATIGUE AND SHORTAGES: CYBER TEAMS INTENTIONALLY UNDERREPORTING BREACHES

A new report by VikingCloud reveals that 40% of cyber teams are not reporting breaches due to fear of job loss, highlighting a significant underreporting issue globally.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

CISA PUBLISHES ENCRYPTED DNS IMPLEMENTATION GUIDANCE TO FEDERAL AGENCIES

CISA has published guidance for federal agencies on encrypting DNS traffic to enhance cybersecurity aligned with the zero trust strategy.

cisa.gov · 2 min