The Daily Index — Friday, July 26, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

KNOWBE4 DISCOVERS REMOTE WORKER IS REALLY A NORTH KOREAN HACKER

KnowBe4 recently disclosed that a remote software engineer that it hired was a North Korean hacker who was able to make it through the interview process and pass a background check. KnowBe4 detected that the hacker's Mac immediately started loading malware. The employee refused to take a call with the team and then became unresponsive, which led KnowBe4 to contact the FBI and Mandiant.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

PKFAIL: UNTRUSTED PLATFORM KEYS UNDERMINE SECURE BOOT ON UEFI ECOSYSTEM

The Binarly team has published research on how leaked private keys like the ones from Intel Boot Guard and American Megatrends International were exposed. Hardware containing these keys is still being deployed. The PKfail issue exposes poor cryptographic management practices that put devices at risk of being bypassed during the boot process. To mitigate PKfail, device vendors should follow best practices for key management and users should stay informed about security patches.

binarly.io · 6 min

TLDR InfoSec

HOW WE SECURELY GENERATE SENSITIVE SECRETS

Monzo wanted a secret generation process that no entity could compromise or manipulate. Password managers with passkeys grant this assurance but don't scale to services that need to run in cloud environments. To achieve its goal, Monzo built a repeatable, deterministic build process that utilized AWS Nitro Enclaves to securely generate secrets. This was used to cryptographically verify the integrity of environments.

monzo.com · 8 min

TLDR InfoSec

A HARD LOOK AT GUARDDUTY SHORTCOMINGS

This article evaluates Amazon GuardDuty's coverage, efficacy, and cost. Coverage was limited to core attacks on core services, with few finding types across a few services. Foundational features are worth enabling, but others can be costly. GuardDuty failed to detect many tested attacks and had a best-case latency of 5:08 for an S3 ransomware simulation.

tracebit.com · 7 min

TLDR InfoSec

UNFASHIONABLY SECURE: WHY WE USE ISOLATED VMS

This blog post discusses the use of isolated virtual machines (VMs) to provide complete customer data separation in the architecture of Thinkst Canary. Each customer has their own VM, ensuring strong boundaries between services and data. This approach offers benefits like improved security, performance monitoring, regulatory compliance, and hardware fault isolation.

blog.thinkst.com · 12 min

TLDR InfoSec

LAKERA (PRODUCT LAUNCH)

Lakera is a low-latency AI application firewall that secures traffic into and out of generative AI applications

lakera.ai

TLDR InfoSec

FORGET SECURITY – GOOGLE'S RECAPTCHA V2 IS EXPLOITING USERS FOR PROFIT

Google's reCAPTCHA service, while promoted as a security mechanism, is actually harvesting user information and labor worth billions. reCAPTCHA is disliked by users, costly in time and resources, and vulnerable to bots.

theregister.com · 7 min

TLDR InfoSec

INVISIBLE GHOST: ALARMING VULNERABILITY IN GITHUB COPILOT

The "Invisible ghost" vulnerability in GitHub Copilot allows hidden instructions to be embedded using invisible Unicode characters. It can be used to manipulate code suggestions without developer awareness and potentially inject harmful code.

apexhq.ai · 8 min

TLDR InfoSec

CLOUDFLARE REPORTS THAT NEARLY 7% OF INTERNET TRAFFIC IS MALICIOUS

Cloudflare's State of Application Security Report revealed that 6.8% of all Internet traffic is malicious, with wars and elections theorized to be driving the uptick. It also noted that DDoS attacks are also on the rise, having blocked 4.5M DDoS attacks in the first quarter of 2024. About 38% of all HTTP requests processed by Cloudflare are classified as bot traffic.

zdnet.com · 4 min

TLDR InfoSec

DOUBLE DIPPING CHEAT DEVELOPER GETS CAUGHT RED-HANDED

The developer of the EvolvedAim cheat for Escape From Tarkov was caught selling the cheat with an information stealer embedded, putting users at risk.

cyberark.com · 7 min

TLDR InfoSec

ANYONE CAN ACCESS DELETED AND PRIVATE REPOSITORY DATA ON GITHUB

GitHub's repository design allows access to data from deleted and private repositories indefinitely, creating a significant security vulnerability known as Cross Fork Object Reference (CFOR).

trufflesecurity.com · 6 min

TLDR InfoSec

MOVING TO A MORE PRIVACY-RESPECTING AND EFFICIENT METHOD OF CHECKING CERTIFICATE REVOCATION

Let's Encrypt will stop supporting OCSP in favor of CRLs for better privacy and efficiency.

letsencrypt.org · 2 min