TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 8 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 13 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR DesignTLDR Design · 14 stories
  8. Page 8: TLDR FoundersTLDR Founders · 13 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 12 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 10 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TOYOTA CONFIRMS BREACH AFTER 240GB OF STOLEN DATA LEAKS ON HACKING FORUMS

Toyota has confirmed a breach of 240GB of data but has not provided details on what the data contains or how many people are affected by it. The leaker claims that the data contains contacts, financials, customers, employees, photos, DBs, network infrastructure, emails, and more. The files were stolen or created on December 25, 2022, which suggests that the data may have been a backup.

bleepingcomputer.com · 2 min

TLDR InfoSec

EXECUTION GUARDRAILS: NO ONE LIKES UNINTENTIONAL EXPOSURE

A post from TrustedSec's Brandon McGrath which begins with a discussion of an engagement where his implant got caught by a member of the blue team. McGrath details how he uses a key ring consisting of host based checks, network checks, and external checks as an execution guardrail. In the example, the implant first checked the hostname of the system, then network shares, and finally a TXT record before downloading and launching the payload.

trustedsec.com · 8 min

TLDR InfoSec

ENABLING TRUSTED TYPES IN A COMPLEX WEB APPLICATION: A CASE STUDY OF APPSHEET

Trusted Types is a defense-in-depth mechanism that protects against DOM XSS by implementing type systems to ensure that only safely constructed values can reach injection sinks. To rollout Trusted Types in AppSheet, the Google team followed a five stage process: report-only mode, collect and triage violations, refactor blockers, repeat the previous two steps, and enforcement. When investigating a Trusted Types violation, a report contains the source file where the violation occurred, the document URI which is the URI where the violation occurred, and the script-sample which includes the underlying API call that caused the violation and a prefix of the input that caused the violation.

bughunters.google.com · 12 min

TLDR InfoSec

GITHUB ACTIONS EXPLOITATION: DEPENDABOT

Synacktiv discovered a novel GitHub Actions exploitation technique leveraging Dependabot to compromise repositories and push arbitrary code. The vulnerability stems from workflows using the 'pull_request_target' event with weak access controls based on the 'github.actor' context, which can be manipulated by triggering Dependabot actions on a forked repository. Synacktiv demonstrated successful exploits against the spring-security and trpc projects, highlighting the importance of careful workflow configuration and the use of tools like octoscan for detecting such vulnerabilities.

synacktiv.com · 6 min

TLDR InfoSec

POST-QUANTUM CRYPTOGRAPHY: WHAT COMES NEXT?

In the wake of NIST releasing the first set of post-quantum cryptography standards, the UK's NCSC has started a series of posts on how organizations should respond. Implementations and protocols like TLS still need to be updated to make use of post-quantum cryptography which will likely take years. NCSC advises that the key actions that organizations can take now are to inventory the use of cryptography in their own environments and in their supply chains.

ncsc.gov.uk · 5 min

TLDR IndexPage 5