The Daily Index — Monday, August 5, 2024 · TLDR Index

GENERAL

TLDR InfoSec

TLDR InfoSec

See Rippling IT in action →

Summary unavailable

rippling.com

TLDR InfoSec

STACKEXCHANGE ABUSED TO SPREAD MALICIOUS PYPI PACKAGES AS ANSWERS

Checkmarx researchers have discovered an infostealer campaign targeting users of the Raydium and Solana blockchains. The campaign published a set of PyPi packages purporting to be official packages and then posted high quality responses on StackExchange threads that promoted the malicious packages. The packages were downloaded over 2,000 times before being removed from PyPi.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW BLANKBOT ANDROID TROJAN CAN STEAL USER DATA

A new Android trojan called BlankBot, aimed at Turkish users, offers attackers extensive malicious capabilities. It poses as utility apps and tricks users into granting permissions. BlankBot can log device information, steal sensitive data, and perform custom injections.

securityweek.com · 3 min

TLDR InfoSec

WHERE TO STORE JWTS

This post breaks down the pros and cons of storing JWT tokens in cookies vs Session/Local Storage. Neither option is completely secure. Cookies used with HttpOnly are protected from JavaScript but they are vulnerable to CSRF and can be used in XSS attacks because the browser will send them on every request. Session and Local Storage are not vulnerable to CSRF but are designed to be accessed from JavaScript and are also vulnerable to XSS. Session Storage is per-tab, so users that open a link in a new tab will be logged out in that tab.

threadreaderapp.com · 1 min

TLDR InfoSec

AN OPINIONATED RAMP UP GUIDE TO AWS PENTESTING

This article begins with discussing some dark patterns in cloud pentesting before offering a 7 stage roadmap to ramp up in AWS pentesting. The first couple of stages begin with solving Red Team labs with official and community walkthroughs before beginning to do CTFs independently. The next couple of stages involve automating exploits for CTFs and learning to build a secure AWS environment with CloudSLAW. The final stages focus on filling in knowledge gaps, synthesizing knowledge, and continuous learning.

awssecuritydigest.com · 9 min

TLDR InfoSec

APPSEC GUIDES, NOT GATES: INTRODUCING SECURE GUARDRAILS WITH SEMGREP

Use secure guardrails instead of traditional “shift-left” gates. Secure guardrails integrate directly into developer workflow, should offer autofixes or advice that aligns with organization policies, and should empower developers to write more secure code and use secure-by-default libraries while also allowing developers to adjust or override guardrails when needed. Semgrep can be used to implement secure guardrails and provides a scorecard to grade your implementation of secure guardrails.

semgrep.dev · 5 min

TLDR InfoSec

PROMPT AIRLINES (WEBAPP)

Prompt Airlines is an AI Security CTF that contains 5 levels of increasingly difficult challenges. The ultimate goal is to manipulate an AI chatbot to get a free airline ticket.

promptairlines.com

TLDR InfoSec

LAW FIRMS HIT WITH AVERAGE RANSOM DEMAND OF $2.5 MILLION

Since 2018, 138 legal firms globally have confirmed ransomware attacks affecting 2.9 million records. 2023 saw the most attacks (45) and records impacted (1.6 million). Average ransom demands are $2.47 million, with $1.65 million typically paid.

comparitech.com · 8 min

TLDR InfoSec

PANAMORFI: A NEW DISCORD DDOS CAMPAIGN

Researchers have uncovered a new DDoS campaign called Panamorfi targeting misconfigured Jupyter Notebooks. It uses a Java-based tool, mineping, to launch TCP flood attacks. The attack exploits exposed Jupyter instances to download malicious files, which then connect to a Discord channel and execute the DDoS tool, overwhelming target servers.

aquasec.com · 7 min

TLDR InfoSec

YOU CAN'T SPELL WEBRTC WITHOUT RCE - PART 2

This post discusses leveraging vulnerabilities in iOS to achieve full Remote Code Execution (RCE) in WebRTC based protocols. It covers topics like breaking Address Space Layout Randomization (ASLR) and exploiting shared libraries like SignalServiceKit. By chaining together various leaks and utilizing ARM64 ROP chains, the researchers successfully achieved their goal of leaking Signal-iOS's database.

margin.re · 24 min

TLDR InfoSec

HACKERS BREACH ISP TO POISON SOFTWARE UPDATES WITH MALWARE

A Chinese hacking group named StormBamboo compromised an ISP to inject malware into software updates by exploiting insecure update mechanisms.

bleepingcomputer.com · 2 min

TLDR InfoSec

APT28 TARGETS DIPLOMATS WITH HEADLACE MALWARE VIA CAR SALE PHISHING LURE

A Russia-linked group used car-for-sale phishing lure to target diplomats with a Windows backdoor called HeadLace.

thehackernews.com · 2 min

TLDR InfoSec

CISA NAMES FIRST CHIEF ARTIFICIAL INTELLIGENCE OFFICER

CISA appointed Lisa Einstein as its first Chief Artificial Intelligence Officer to advance cybersecurity efforts in using AI responsibly.

cisa.gov · 2 min