The Daily Index — Friday, May 31, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DATA BREACH EXPOSES DETAILS OF 25K CURRENT AND FORMER BBC EMPLOYEES

The BBC's pension scheme notified 25K current and former employees that their personal data had been exposed in a breach. The notification did not include details of how the breach occurred other than that the data had been copied from an online data storage service. Exposed information includes dates of birth, home addresses, and national insurance numbers, but does not include financial information.

theguardian.com · 3 min

TLDR InfoSec

COOLER MASTER HIT BY DATA BREACH EXPOSING 500K CUSTOMERS' INFORMATION

A threat actor called Ghostr claimed to have stolen 103 GB of data from Cooler Master including corporate, vendor, sales, warranty, inventory, and HR data as well as 500K fanzone members' information. The threat actor claims that the fanzone information includes names, addresses, dates of birth, phone numbers, emails, and unencrypted credit card information. Data samples did not confirm whether credit card information was stolen.

bleepingcomputer.com · 2 min

TLDR InfoSec

COVERAGE GUIDES FUZZING - EXTENDING INSTRUMENTATION TO HUNT DOWN BUGS FASTER

Coverage guided fuzzing is a technique used by some fuzzers to determine if a fuzzing input will discover a new edge. This article walks through the process of modifying the Fuzzli fuzzer to find a known vulnerability in JerryScript. The article also contains instructions to set up an environment to replicate the findings.

blog.includesecurity.com · 6 min

TLDR InfoSec

THE BEST WAY TO START WITH AWS SECURITY HUB

A lab from Rich Mogull's Cloud Security Lab A Week series on using AWS Security Hub. Security Hub is a unified view of various AWS security services across all regions and accounts in an organization. Mogull goes over the steps of setting up AWS Security Hub to act as a CSPM.

slaw.securosis.com · 11 min

TLDR InfoSec

HOW MALWARE AUTHORS PLAY WITH THE LNK FILE FORMAT

Malware authors are utilizing LNK files as a malware delivery mechanism now that Microsoft is deprecating Macros. This blog post goes into detail on various techniques that are used by the malware authors like running minimized, executing other binaries as well as icon smuggling. The post contains links for defenders to use for analyzing LNK files.

blog.quarkslab.com · 10 min

TLDR InfoSec

EURO COPS DISRUPT MALWARE DROPPERS, SEIZE THOUSANDS OF DOMAINS

An international law enforcement operation led by Europol named Operation Endgame resulted in multiple arrests, searches, seizures, and takedowns targeting malware droppers and their operators. The coordinated action across several countries, described as the largest-ever crackdown on botnets used for ransomware deployment, disrupted the operations of notorious droppers like IcedID, Bumblebee, SystemBC, Pikabot, Smokeloader, and Trickbot.

theregister.com · 3 min

TLDR InfoSec

MOONSTONE SLEET EMERGES AS NEW NORTH KOREAN THREAT ACTOR WITH NEW BAG OF TRICKS

Microsoft has identified a new North Korean threat group called Moonstone Sleet that employs a combination of traditional and unique attack methods. Notable techniques the group uses include creating fake companies and job postings, using trojanized tools, and developing a fully functional malicious game called DETANKWAR.

microsoft.com · 10 min

TLDR InfoSec

RESEARCHERS HELP RECOVER $3M IN LOST BITCOIN

Two hackers helped recover funds in a Trezor wallet that an owner had lost the password to. The owner had created the password using the RoboForm password manager in 2013. The hackers exploited a known vulnerability in RoboForm to recover the wallet. A video demonstrating the hack is included in the article.

cryptotimes.io · 2 min

TLDR InfoSec

NIST AWARDS ADDITIONAL FUNDING TO NATIONAL VULNERABILITY DATABASE

NIST has said that it will be receiving outside help to get the National Vulnerability Database (NVD) back on track within the next few months.

nist.gov · 3 min

TLDR InfoSec

OKTA WARNS USERS TO BE AWARE OF DAMAGING CYBERATTACKS TARGETING CUSTOMERS

Okta warned customers of an ongoing credential stuffing attack targeting its Customer Identity Cloud (CIC) tool, advising users to either disable the cross-origin authentication feature being abused or implement recommended mitigations.

techradar.com · 2 min

TLDR InfoSec

TICKETMASTER HIT WITH CLASS ACTION SUIT OVER MASSIVE DATA BREACH

A class action lawsuit has been filed against Ticketmaster for a massive data breach affecting millions of consumers.

links.tldrnewsletter.com · 4 min