The Daily Index — Wednesday, June 12, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

UPDATES FOR SECURITY ISSUE AFFECTING INTELLIJ-BASED IDES 2023.1+ AND JETBRAINS GITHUB PLUGIN

JetBrains has disclosed security issues affecting IntelliJ-based IDEs and the JetBrains GitHub Plugin leading to an access tokens leak. The issue has been fixed in the latest IDE versions. Users are urged to update and revoke any affected GitHub tokens. JetBrains has provided instructions on how to revoke tokens and set up the plugin again if needed.

blog.jetbrains.com · 2 min

TLDR InfoSec

A GUIDE TO KUBERNETES LOGS THAT ISN'T A VENDOR PITCH

This post explains logging in Kubernetes clusters using the 4Cs of cloud-native security framework. Code level logging can be achieved with sidecar pods. Cloud level logging relies on the specific cloud's services (for example CloudTrail on AWS). Container level logging isn't generally helpful for security. The post contains a deep dive into using and enabling AuditPolicy to collect logs at the cluster level.

grahamhelton.com · 6 min

TLDR InfoSec

WHAT HAPPENED TO RASP?

A blog post looking at the decline of RASP and the rise of ADR. The post outlines various nontechnical and technical critiques that stymied RASP's implementation such as unclear time-to-value and added complexity. It concludes by looking at how ADR might address some of these concerns but concludes that it's too early to tell if it will succeed.

ramimac.me · 5 min

TLDR InfoSec

TECHNICAL ANALYSIS OF THE LATEST VARIANT OF VALLEYRAT

The ValleyRAT malware uses a multi-stage process involving DLL sideloading, process injection, and shellcode execution to establish connections with a command-and-control server for downloading further malicious payloads. The malware utilizes encryption, decryption, and hashing algorithms to dynamically load and execute embedded DLLs, collect system information, and carry out specific actions based on the victim host's configuration. ValleyRAT conducts device fingerprinting to gather detailed information about the infected system, such as IP address, system uptime, hardware details, and user privileges, aiding in its malicious activities.

zscaler.com · 10 min

TLDR InfoSec

GEMINI YOUTUBE RESEARCHER (PYTHON NOTEBOOK)

This Python Notebook demonstrates searching for YouTube videos, takes 5 results, "listens" to their audio tracks, summarizes them, and then assembles a report from those summaries. It could be helpful for catching up on conference talks, extracting summaries, and understanding TTPs for researchers.

github.com

TLDR InfoSec

SNOWFLAKE BREACH EXPOSES 165 CUSTOMERS' DATA IN ONGOING EXTORTION CAMPAIGN

Mandiant, which is working with Snowflake on incident response, has identified that 165 customers' data has been breached. It stated that the attackers are using the Snowflake access to deploy an info-stealer malware dubbed FROSTBITE. Mandiant had previously denied responsibility and stated that the breaches were caused by a lack of MFA by customers.

thehackernews.com · 2 min

TLDR InfoSec

CITY OF CLEVELAND SHUTS DOWN IT SYSTEMS AFTER CYBERATTACK

The City of Cleveland's IT systems have been shut down due to a cyberattack that forced essential services offline. Investigations are ongoing with third-party experts. Key services like emergency response and utilities remain unaffected. Authorities are working to provide updates as the situation unfolds.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ANTI-CHEAT EXPERT: ALL YOUR PIXELS ARE BELONG TO US

ACE is an anti-cheat software made by Tencent, a Chinese tech giant. It has raised privacy concerns as it takes screenshots of users' entire display. ACE has components with screenshot-taking capabilities, sparking worries about data privacy and potential misuse.

invlpg.dev · 5 min

TLDR InfoSec

AI HELPS CATCH CSRF VULNERABILITY BEING INTRODUCED INTO 100,000+ INSTALL WORDPRESS PLUGIN MODULA

An AI system detected a CSRF vulnerability in the popular WordPress plugin Modula.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

CHINESE HACKERS BREACHED 20,000 FORTIGATE SYSTEMS WORLDWIDE

Chinese hackers breached 20,000 FortiGate systems globally by exploiting a critical vulnerability.

bleepingcomputer.com · 2 min

TLDR InfoSec

16-YEAR-OLD ARRESTED IN FRANCE IN CONNECTION WITH HIGH-PROFILE EPSILON HACKING GROUP ATTACKS

A 16-year-old in France was arrested for links to the Epsilon hacking group attacks.

bitdefender.com · 1 min