TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 12 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 11 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 14 stories
  8. Page 8: TLDR FoundersTLDR Founders · 13 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 10 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 13 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

GOOGLE WILL UPDATE PIXEL PHONES TO REMOVE VERIZON'S UNSAFE DEMO APP

Security researchers discovered a vulnerable app called Showcase.apk that was included in numerous Pixels' firmware without any way to remove it. Google has clarified that this app is used in Verizon demo phones and has committed to removing it in a future update. There is no evidence that the app has been exploited as an attacker would first require physical access and a user's password to install the app, which provides numerous other attack vectors.

androidauthority.com · 2 min

TLDR InfoSec

REUSABLE WORKFLOW IS GOOD… UNTIL YOU REALIZE YOUR IDENTITY IS ALSO REUSABLE BY ANYONE

Keyless signing is used in conjunction with sigstore by organizations to sign artifacts to enable artifact attestation. A novel attack method shows that if a repository publishes a reusable workflow to sign artifacts using sigstore, an attacker can use that workflow to sign artifacts with a SAN of the reusable workflow's repository. The researcher does not believe that this is a worrisome threat as they could only find two repositories that the attack would actually work against and even then the impact would depend on how the potential victim verified the signature.

blog.richardfan.xyz · 10 min

TLDR InfoSec

BUCKET MONOPOLY: BREACHING AWS ACCOUNTS THROUGH SHADOW RESOURCES

Researchers have discovered a novel attack technique in AWS whereby an attacker can create S3 buckets that utilize the naming system of AWS services to in some cases even achieve RCE. When certain features in Cloudformation, Glue, EMR, Sagemaker, ServiceCatalog, or Codestar are first used, AWS creates an S3 bucket with a scheme such as cf-templates-- (for Cloudformation templates). If an attacker were to create a bucket with a guessed hash that matches the one that AWS would create for an account, the attacker would control the bucket and its contents. AWS has fixed the vulnerabilities in all services other than Codestar, which is not accepting new customers.

aquasec.com · 12 min

TLDR InfoSec

INTRODUCING AUTOMATIC SSL/TLS: SECURING AND SIMPLIFYING ORIGIN CONNECTIVITY

Cloudflare offers various options to control encryption between Cloudflare and origin servers that range from never encrypting to following the client request's encryption mode to always using TLS. To simplify the decision process for Cloudflare customers, Cloudflare introduced the SSL/TLS Recommender which would scan origin pages to suggest the best encryption settings. However, Cloudflare found that only 30% of customers were enabling the chosen setting in the UI. To increase adoption, Cloudflare is introducing Automatic SSL/TLS, which will automatically enable the SSL/TLS Recommender's recommended setting.

blog.cloudflare.com · 11 min

TLDR InfoSec

EXPLOITING HUGGING FACE'S ASSISTANTS TO EXTRACT USERS' DATA

This article demonstrates how Hugging Face's Chat is vulnerable to techniques like Sleepy Agent and Image Markdown Rendering, which can be exploited to extract users' data. These vulnerabilities allow attackers to manipulate the AI model to extract sensitive information like email addresses without the user's knowledge. Users should be cautious when using AI assistants and read the system prompts to avoid falling victim to data extraction attacks.

lasso.security · 5 min

TLDR IndexPage 5