The Daily Index — Monday, May 20, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CRITICAL FLAW IN AI PYTHON PACKAGE CAN LEAD TO SYSTEM AND DATA COMPROMISE

A critical vulnerability dubbed "Llama Drama" (CVE-2024-34359) has been discovered in the llama_cpp_python package used for integrating AI models with Python. The flaw, related to the improper use of the Jinja2 template rendering tool, enables template injection attacks and allows arbitrary code execution, putting AI application systems and data at risk.

securityweek.com · 3 min

TLDR InfoSec

SANTANDER REPORTS CUSTOMER AND EMPLOYEE DATA BREACH IN SPAIN, CHILE, AND URUGUAY

Santander Bank has reported that some customer data, as well as all data from all past and present employees which was stored in a third-party database, were accessed by an unauthorized party. No data on transactions or credentials were leaked.

bit.ly · 2 min

TLDR InfoSec

THREAT DETECTION ENGINEERING AND INCIDENT RESPONSE WITH AUDITD AND SENTINEL

This article explains how to use AuditD to detect threats by creating rules based on logs and analyzing them further. It provides a simple example rule to monitor executions in the /tmp directory, emphasizing the importance of monitoring to enhance security. The article offers insights into investigating AuditD events and conducting in-depth analysis for security monitoring.

bit.ly · 3 min

TLDR InfoSec

DISCOVER HOW ZERO TRUST ARCHITECTURE RESHAPES CYBERSECURITY WITH IN-DEPTH ANALYSIS AND FUTURE INSIGHTS

Zero Trust Architecture (ZTA) is a revolutionary cybersecurity approach that shifts from the outdated "trust but verify" model to a robust "never trust, always verify" principle, addressing weaknesses of traditional security measures. This post dives into the intricacies of Zero Trust.

bit.ly · 4 min

TLDR InfoSec

RELATIVE PATH FILE INJECTION: THE NEXT EVOLUTION IN RPO

This article introduces a new attack method for injecting rogue files and forcing victims to download them. The attack requires a page to have a path confusion vulnerability, a download link with an anchor tag that uses relative paths, and content that is injectable via a persistent XSS or XSS cache poisoning. The attack expands on RPO because it doesn't rely on deprecated technologies.

blog.ionatomics.org · 7 min

TLDR InfoSec

YARA IS DEAD, LONG LIVE YARA-X

YARA has been rewritten as YARA-X in Rust for better user experience, rule-level compatibility, performance, reliability, and developer-friendliness. The rewrite was necessary due to significant design changes and the limitations of the existing C codebase. YARA-X is currently stable but in beta. The project aims to surpass YARA in all aspects through ongoing enhancements.

virustotal.github.io · 3 min

TLDR InfoSec

CHINESE NATIONALS ARRESTED FOR LAUNDERING $73 MILLION IN PIG BUTCHERING CRYPTO SCAM

Chinese nationals Daren Li and Yicheng Zhang have been charged with laundering $73 million in a pig butchering crypto scam. Victims were tricked into transferring money to U.S. bank accounts opened by shell companies. Li and Zhang face up to 20 years in prison for money laundering charges.

thehackernews.com · 4 min

TLDR InfoSec

SLACK UNDER ATTACK OVER SNEAKY AI TRAINING POLICY

Slack is facing backlash from users over its approach to using customer data for training AI models. While many tech companies leverage user data for AI training, Slack's confusing and seemingly outdated privacy policy allows it to opt users in by default, requiring them to actively email the company to opt out.

techcrunch.com · 4 min

TLDR InfoSec

MICROSOFT TO START ENFORCING AZURE MULTI-FACTOR AUTHENTICATION IN JULY

Microsoft will enforce multi-factor authentication for Azure users starting in July to enhance security.

bleepingcomputer.com · 2 min

TLDR InfoSec

“UNPRECEDENTED” GOOGLE CLOUD EVENT WIPES OUT CUSTOMER ACCOUNT AND ITS BACKUPS

Due to a misconfiguration, Google Cloud accidentally deleted the entire account of Australian pension fund UniSuper, which manages $135 billion in funds for 647,000 members, including all backups stored on the service.

arstechnica.com · 5 min

TLDR InfoSec

AMERICAN RADIO RELAY LEAGUE CYBERATTACK TAKES LOGBOOK OF THE WORLD OFFLINE

The American Radio Relay League (ARRL) faced a cyberattack that affected its online services, including Logbook of the World.

bleepingcomputer.com · 1 min