The Daily Index — Wednesday, August 7, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

RANSOMWARE ATTACK COST KEYTRONIC OVER $17 MILLION

Summary unavailable

securityweek.com · 3 min

TLDR InfoSec

CROWDSTRIKE RELEASES ROOT CAUSE ANALYSIS OF FALCON SENSOR BSOD CRASH

CrowdStrike has released a report explaining the software update crash that affected Windows systems worldwide. The crash was caused by a mix of security vulnerabilities and process gaps, leading to a system crash. CrowdStrike is working with Microsoft to improve security measures and prevent future incidents.

securityweek.com · 2 min

TLDR InfoSec

CONFIGURE GITHUB ARTIFACT ATTESTATION FOR SECURE CLOUD-NATIVE DELIVERY

Now that Artifact Attestation is generally available, GitHub has published a walkthrough on how to use it. GitHub created the attest-build-provenance action, which can be added to a workflow to add an Attestation to a built artifact. GitHub also released a Kubernetes admission controller, which can be deployed in clusters to verify artifacts' attestations before deployment.

github.blog · 6 min

TLDR InfoSec

REDHUNT LABS INTRODUCES CUTTING-EDGE “INTERACTIVE ATTACK SURFACE GRAPH”; EMPOWERS ENHANCED REACHABILITY ANALYSIS

RedHunt Labs has introduced the Interactive Attack Surface Graph for cybersecurity management. The tool provides visual insights to identify threats and vulnerabilities efficiently. Similar graph-based tools can empower security teams to make informed decisions and protect digital assets effectively.

redhuntlabs.com · 3 min

TLDR InfoSec

FORMALLY VERIFYING SECURITY PROPERTIES OF CHERI PROCESSORS

Researchers used a new verification framework, VeriCHERI, to find and fix a vulnerability in a processor vulnerable to Meltdown-style attacks. VeriCHERI focuses on security properties rather than conforming to a specification, making it effective in detecting vulnerabilities like timing side channels. This approach enhances security verification for processors like CHERIoT Ibex, improving protection against attacks exploiting microarchitectural weaknesses.

cheriot.org · 4 min

TLDR InfoSec

AWS UNVEILS MITHRA TO IDENTIFY AND MITIGATE MALICIOUS DOMAINS ACROSS ITS MASSIVE SYSTEM

Amazon has revealed Mithra, an internal security platform that uses a massive graph database to defend its network. It processes vast amounts of data to identify threats, often automating responses without human intervention.

techcrunch.com · 3 min

TLDR InfoSec

U.S. SUES TIKTOK, ALLEGING MILLIONS OF CHILD PRIVACY VIOLATIONS

The U.S. Justice Department and FTC have sued TikTok and ByteDance for allegedly violating children's privacy laws. The lawsuit claims TikTok collected data from millions of under-13 users, allowed them to interact with adults, and ignored parental deletion requests. TikTok denies these allegations.

nbcnews.com · 3 min

TLDR InfoSec

OUR AUDIT OF HOMEBREW

Trail of Bits performed an audit of the popular macOS package manager, Homebrew. The audit found several issues in the brew CLI that could allow for unsandboxed, local code execution but this was in line with Homebrew's threat model of trusted formulae. The audit also uncovered misuse-prone patterns in the CI/CD process that could allow a lower-privileged insider to undermine the integrity and isolation assumptions made by the Homebrew CI/CD.

blog.trailofbits.com · 5 min

TLDR InfoSec

DARPA ANNOUNCE TRACTOR TO ELIMINATE MEMORY SAFETY VULNERABILITIES

DARPA has announced a new project known as TRACTOR to address memory safety vulnerabilities in legacy software. The goal of the program is to create a tool to automatically convert legacy C code to Rust. DARPA is holding a Proposers Day with applications due by August 19.

darpa.mil · 2 min

TLDR InfoSec

GOOGLE CHROME WILL LET YOU SEND MONEY TO YOUR FAVORITE WEBSITE

Google Chrome will soon support Web Monetization, allowing website owners to receive micro-payments for their content.

bleepingcomputer.com · 1 min

TLDR InfoSec

CISA RELEASES SECURE BY DEMAND GUIDE

CISA and FBI have released a guide to help organizations buying software understand the cybersecurity practices of vendors.

cisa.gov · 2 min

TLDR InfoSec

SAMSUNG BUG BOUNTY PROGRAM PAYOUTS REACH $5M, TOP REWARD INCREASED TO $1M

Samsung's bug bounty program has increased its maximum bug bounty reward to $1 million and introduced bonus rewards for high-quality vulnerability reports.

securityweek.com · 2 min