The Daily Index — Wednesday, June 26, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CDK GLOBAL SAYS SOFTWARE OUTAGE WILL TAKE SEVERAL DAYS TO RESOLVE

CDK Global announced that it will likely take several days to restore service to nearly 15,000 car dealerships that rely on its software. It has been working with clients to find alternative ways to conduct business. Some dealerships report resorting to conducting business and keeping records by hand temporarily.

cnn.com · 3 min

TLDR InfoSec

POLYFILL.IO JAVASCRIPT SUPPLY CHAIN ATTACK IMPACTS OVER 100K SITES

Over 100,000 websites were affected by a supply chain attack on the Polyfill.io service where a script was modified to redirect users to malicious sites. Polyfill.io is a service that provides code that enables modern browser features on older browsers. It was compromised after being acquired by a Chinese company. Cloudflare and Fastly created their own mirrors of the service to mitigate risks.

bleepingcomputer.com · 3 min

TLDR InfoSec

PROJECT NAPTIME: EVALUATING OFFENSIVE SECURITY CAPABILITIES OF LARGE LANGUAGE MODELS

This project from Google's Project Zero explores how large language models (LLMs) can improve vulnerability discovery in cybersecurity testing by up to 20x in the CyberSecEval 2 benchmark. The researchers developed a framework called Naptime that significantly enhances LLM performance in identifying and analyzing vulnerabilities. Naptime automates variant analysis and closely mimics the approach of human security experts by incorporating specialized tools and principles.

googleprojectzero.blogspot.com · 21 min

TLDR InfoSec

AWS WITHOUT ACCESS KEYS

Fly.io operates a custom OIDC IdP that allows apps running in Fly Machines to access AWS services without a user needing to directly interact with AWS. Fly utilizes a custom init server that fly machines boot into, which exposes a Unix socket to access the Fly Machine API that contains the OIDC information. Fly then detects if an AWS_ROLE_ARN is set and if so, generates an OIDC token, saves it to a file, and sets the appropriate environment variables for the AWS SDK.

fly.io · 10 min

TLDR InfoSec

REVERSE ENGINEERING EBPF PROGRAMS

This blog post explains how to reverse engineer eBPF programs by examining their structure and using helper functions. The eBPF calling convention defines the return value and program flow. Understanding the verifier rules is crucial for writing effective eBPF programs.

armosec.io · 18 min

TLDR InfoSec

ANNOUNCING THE RONIN 2.1.0 OPEN BETA

Ronin is a free and open source Ruby toolkit for security research and development. Ronin 2.1.0 open beta testing phase is now live until July 19th, with the official release scheduled for July 22nd. Participants can install Ronin 2.1.0.rc1 using the provided script and are encouraged to test new commands and libraries and report any issues to the GitHub repository for a chance to receive a free sticker.

ronin-rb.dev · 6 min

TLDR InfoSec

8220 MINING GANG'S NEW TOOL: K4SPREADER

A new tool called "k4spreader" is being used by the "8220" mining gang to install malware like the Tsunami DDoS botnet and PwnRig mining program. The tool is still in development with three observed variants. It is designed to download and execute malicious files, primarily Tsunami and PwnRig.

blog.xlab.qianxin.com · 7 min

TLDR InfoSec

AWS IAM ACCESS ANALYZER NOW OFFERS RECOMMENDATIONS TO REFINE UNUSED ACCESS

AWS IAM Access Analyzer has launched a new update that allows for the detection of unused roles, access keys, and passwords. It provides a quick link to delete the credential when IAM Access Analyzer detects an unused credential.

aws.amazon.com · 2 min

TLDR InfoSec

LOCKBIT HOLDS ITS WORD, PUBLISHES ALLEGED US FEDERAL RESERVE DATA

The LockBit ransomware gang published alleged US Federal Reserve data after ransom negotiations broke down. It threatened to release 33 terabytes of banking information if a ransom demand wasn't met.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

WIKILEAKS FOUNDER JULIAN ASSANGE REACHES PLEA DEAL

Julian Assange has agreed to a plea deal that will release him from prison in the UK and ensure no further jail time.

apnews.com · 2 min

TLDR InfoSec

FOUR MEMBERS OF NOTORIOUS CYBERCRIME GROUP ‘FIN9' CHARGED FOR ROLES IN ATTACKING U.S. COMPANIES

Four Vietnamese nationals, allegedly part of the cybercrime group 'FIN9,' were charged with hacking into U.S. companies and causing over $71 million in losses.

justice.gov · 4 min

TLDR InfoSec

INDONESIA WON'T PAY $8M RANSOM IN DATA CENTER ATTACK THAT DISRUPTED MAJOR PUBLIC SERVICES

Indonesia refuses to pay an $8 million ransom after a ransomware attack disrupted public services.

zdnet.com · 2 min