The Daily Index — Monday, July 8, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ROLL20, AN ONLINE TABLETOP ROLE-PLAYING GAME PLATFORM, DISCLOSES DATA BREACH

Roll20 announced a data breach on June 29 where a hacker accessed its administrative website for an hour. The breach potentially exposed users' personal information including names, email addresses, partial credit card numbers, and IP addresses.

techcrunch.com · 3 min

TLDR InfoSec

APACHE FIXED A SOURCE CODE DISCLOSURE FLAW IN APACHE HTTP SERVER

The Apache Foundation fixed a critical vulnerability (CVE-2024-39884) in its Apache HTTP Server related to source code disclosure. The vulnerability could lead to unauthorized access and remote code execution issues. Users are advised to update to version 2.4.61 to address these security concerns.

securityaffairs.com · 1 min

TLDR InfoSec

JULY 2: POLYFILL.IO SUPPLY CHAIN ATTACK – DIGGING INTO THE WEB OF COMPROMISED DOMAINS

This post dives into a supply chain attack on the JavaScript library Polyfill.io that affected over 384,000 hosts, including major websites. While the immediate threat has been mitigated, experts advise removing all references to Polyfill.io.

censys.com · 10 min

TLDR InfoSec

CATCHING COMPROMISED COOKIES

This post details how Slack detects compromised session cookies to prevent session hijacking. Slack Initially attempted to build its system by looking at the last accessed timestamp of a particular cookie to determine session forking but quickly determined that this led to a lot of false positives and added more information such as the IP address. The post also examines how performance concerns were mitigated and the rollout procedure.

slack.engineering · 10 min

TLDR InfoSec

EXPLOITING CLIENT-SIDE PATH TRAVERSAL TO PERFORM CROSS-SITE REQUEST FORGERY

A group of researchers have discovered a method that utilizes Client-Side Path Traversal (CSPT) to achieve Cross-Site Request Forgery (CSRF). CSPT vulnerabilities have historically been viewed as low severity due to limited impact. This research shows that an attacker could utilize a CSPT vulnerability to chain a CSRF vulnerability and execute actions on behalf of an end user to a web application. The post includes examples of how CSPTs can be utilized to cause CSRF such as by using an open redirect to leak sensitive data associated with the source.

blog.doyensec.com · 5 min

TLDR InfoSec

MICROSOFT'S MIDNIGHT BLIZZARD SOURCE CODE BREACH ALSO IMPACTED FEDERAL AGENCIES

Microsoft notified the US Department of Veterans Affairs and other agencies about potential impacts from the "Midnight Blizzard" Russian hacking group's breach. The VA department reported a brief unauthorized access to a test environment. While some agencies' data may have been stolen, sensitive information was reportedly not compromised.

theverge.com · 3 min

TLDR InfoSec

HACKERS LEAK ALLEGED TAYLOR SWIFT TICKETS, AMP UP TICKETMASTER EXTORTION

Hackers have allegedly leaked Taylor Swift concert ticket data and demanded $2 million from Ticketmaster in an attack that seems to be attributable to the Snowflake breach. The data breach involved 166,000 barcode entries for upcoming concerts.

bleepingcomputer.com · 2 min

TLDR InfoSec

ROCKYOU2024: 10 BILLION PASSWORDS LEAKED IN THE LARGEST COMPILATION OF ALL TIME

A new password compilation that consists of nearly 10 billion passwords was discovered by security researchers. The compilation expands on RockYou2021 with an additional 1.5 billion passwords.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CHATGPT'S MUCH-HERALDED MAC APP WAS STORING CONVERSATIONS AS PLAIN TEXT

ChatGPT for Mac initially stored user chats in plain text that was accessible to any process on the machine.

arstechnica.com · 2 min

TLDR InfoSec

CLOUDFLARE 1.1.1.1 INCIDENT ON JUNE 27, 2024

This post details how a BGP hijack and route leak occurred on June 27 during the Cloudflare 1.1.1.1 incident, causing traffic disruptions.

blog.cloudflare.com · 14 min

TLDR InfoSec

CISA RELEASES GUIDE TO OPERATIONAL SECURITY FOR ELECTION OFFICIALS

The CISA released a guide to help election officials improve operational security during elections.

cisa.gov · 2 min