TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 13 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 14 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 9 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 15 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto, TLDR Founders, TLDR Marketing · 10 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

MICROSOFT UPDATE BREAKS DUAL-BOOT

Microsoft's GRUB patch to fix CVE-2022-2601 has led to errors when trying to boot Linux partitions in dual-boot systems due to incompatible EFI boot loaders. The workaround for users on affected distros is to either disable Secure Boot or delete the Microsoft SBAT. Microsoft maintains that the update should only be installed on systems without a Linux boot option and has stated that it's working with Linux partners to address the issue.

arstechnica.com · 4 min

TLDR InfoSec

ADDRESSED AWS DEFAULTS RISKS: OIDC, TERRAFORM, AND ANONYMOUS ACCESS TO ADMINISTRATORACCESS

This post introduces a novel AWS attack in which an attacker can utilize Terraform Cloud to gain AdministratorAccess on an AWS account by only knowing (or guessing) the Terraform OIDC role and AWS account ID of a victim. This attack is possible when an OIDC's role is created with a trust relationship that does not specify a subject key, which previously was the default when creating a Federated Identity using the GUI. AWS has addressed this vulnerability by adding a mandatory Organization field that becomes the subject field when creating a Federated Identity using the GUI. This post suggests a Lambda strategy that defenders can use to periodically scan for this vulnerability.

hacktodef.com · 11 min

TLDR InfoSec

CLOUD DFIR - AWS IAM PRIVESC LEADS TO EC2 RANSOMWARE

This post examines the AWS DFIR process in a fictional scenario where an organization suffered a ransomware attack that encrypted all files on all of its EC2 instances. The analyst first investigated Sysmon logs on a Windows EC2 instance and identified that the AWS SSM Run Command was used to download malicious scripts from a GitHub repo which were then executed as SYSTEM. They then analyzed CloudTrail logs to identify the role that was used to run the SSM commands, but since it was a commonly used role to execute SSM Commands, the analyst also needed to track down the user that assumed the role in the given timeframe. Upon identifying the compromised user, the analyst also identified that the attacker moved laterally from the initially compromised account by creating access keys for the account that had permissions to assume the SSM commands role.

links.tldrnewsletter.com · 13 min

TLDR InfoSec

MACOS X MALWARE DEVELOPMENT

The blog post, in which the author discusses designing malware for macOS, covering its architecture, security features, Mach API, kernel internals, and shellcode injection, was originally written in 2022 and updated for macOS X Catalina. It emphasizes the importance of understanding system calls, memory protection mechanisms, and code injection techniques using Mach APIs on macOS. The author recommends further reading on the topic and highlights the importance of understanding the environment, features, and security of macOS through practical examples.

0xf00sec.github.io · 36 min

TLDR InfoSec

HOW SOME LET'S ENCRYPT RENEWAL FAILURES POINTED TO AN AWS TRAFFIC HIJACKING ISSUE

An AWS customer began to notice connectivity issues with Let's Encrypt renewals in a VPS that they used that they were not able to resolve with support from the VPS provider. After debugging with AWS, they discovered that the traffic was being routed to a third party that was advertising a typoed BGP route through Direct Connect that unintentionally overlapped with the original AWS customer's IP range. AWS support confirmed that its BGP route verification process failed in this circumstance and has added process improvements to prevent possible malicious traffic hijacking through this vector in the future.

chair6.net · 10 min

TLDR IndexPage 5