The Daily Index — Wednesday, May 29, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

INTERNET ARCHIVE AND THE WAYBACK MACHINE UNDER DDOS CYBER-ATTACK

The Internet Archive, a nonprofit digital library housing millions of historical documents and websites, has endured an intermittent Distributed Denial-of-Service (DDoS) cyber-attack for three days, limiting access to its vast collections including the Wayback Machine's web archive.

blog.archive.org · 2 min

TLDR InfoSec

TP-LINK FIXES CRITICAL RCE IN POPULAR GAMING ROUTER

An RCE vulnerability TP-Link Archer C5400X router was recently disclosed after identification by OneKey. The vulnerability is a command injection and buffer overflow in the rftest binary, which is responsible for network self assessments. A patch that implements input sanitization was released to address the vulnerability.

bleepingcomputer.com · 2 min

TLDR InfoSec

BEST PENETRATION TESTING TOOLS IN 2024

Penetration testing tools are essential for efficient hacking and security assessments. While hacking without tools is possible, it is time-consuming and repetitive. These tools streamline basic scanning and security processes, saving time and effort. This post dives into some of the best penetration testing tools.

medium.com · 8 min

TLDR InfoSec

STOP RECOMMENDING JWTS (WITH SYMMETRIC KEYS)

The Truffle Security team analyzed 10k JWTs found via Shodan and another 500 committed to public repos in GitHub. They used hashcat to attempt cracking the JWTs and found that 1.2% of symmetric keys used in production were guessable within seconds. This was caused by users implementing weak passwords (including the defaults used in documentation and examples) as their symmetric keys when setting up their authentication systems.

trufflesecurity.com · 5 min

TLDR InfoSec

A BASIC GUIDE TO DISCOVERING ATTACK SURFACE WITH GHIDRA AND GDB

This blog post provides a walkthrough on how to programmatically map the attack surface of an application using GDB and Ghidra. It begins with walking through the strategy for identifying functions after ASLR and then shows how it can be implemented using GDB Python. The post takes this one step further and shows how to write a Ghidra Python script to generate the GDB Python script for each function and ignore artificially generated blocks.

medium.com · 5 min

TLDR InfoSec

OPENAI'S NEW SAFETY COMMITTEE IS MADE UP OF ALL INSIDERS

OpenAI has formed an internal Safety and Security Committee headed by CEO Sam Altman and composed of company insiders. Its goal is to oversee critical security decisions related to OpenAI's AI projects over the next 90 days, raising concerns among ethicists about the lack of independent oversight.

techcrunch.com · 3 min

TLDR InfoSec

A ROOT SERVER AT THE INTERNET'S CORE LOST TOUCH WITH ITS PEERS. WE STILL DON'T KNOW WHY

For more than 4 days, the Cogent root name server fell out of sync with all 12 of its peers. Cogent has fixed the issue but has refused to comment on the cause of the disparity. This could have led to DNS Cache poisoning issues or issues in DNSSEC.

arstechnica.com · 3 min

TLDR InfoSec

AI RED TEAMING TOOLS HELPED X-FORCE BREAK INTO A TECH MANUFACTURER IN 8 HOURS

IBM reported that its X-Force red team was able to compromise a network that they had allocated 3 weeks for in just 8 hours with the help of AI red teaming tools. The team found a vulnerability in the company's HR portal with the aid of the tooling and then installed a rootkit after exploiting the vulnerability and eventually pivoted through the network. IBM believes that these AI tools can be essential in analyzing the large volume of data accumulated in a red team assessment.

theregister.com · 3 min

TLDR InfoSec

BREACHFORUMS RETURNS, JUST WEEKS AFTER FBI-LED TAKEDOWN

BreachForums is back not long after it was seized by law enforcement, bringing back ransomware leaks.

theregister.com · 3 min

TLDR InfoSec

CHRISTIE DISCLOSED A DATA BREACH AFTER A RANSOMHUB ATTACK

Auction house Christie disclosed a data breach following a RansomHub cyber attack that occurred this month.

securityaffairs.com · 2 min

TLDR InfoSec

TREASURY SANCTIONS CREATORS OF 911 S5 PROXY BOTNET

The U.S. Treasury sanctioned three Chinese nationals for running the 911 S5 proxy botnet, a service that allowed routing web traffic through malware-infected computers globally.

krebsonsecurity.com · 4 min