TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 13 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR ProductTLDR Product · 12 stories
  8. Page 8: TLDR DesignTLDR Design · 12 stories
  9. Page 9: TLDR FoundersTLDR Founders · 13 stories
  10. Page 10: TLDR MarketingTLDR Marketing · 11 stories
  11. Page 11: Resources & ToolsTLDR, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 15 stories
  12. Page 12: SponsoredTLDR, TLDR AI, TLDR InfoSec, TLDR Founders · 6 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

GENERAL

TLDR InfoSec

TLDR InfoSec

HARNESSING LLMS FOR AUTOMATING BOLA DETECTIONS

Broken Object Level Authorization (BOLA) vulnerabilities are notoriously difficult to automatically detect as they do not follow set patterns and often require an understanding of the application logic and interdependencies. To address this problem, Unit 42 developed BOLABuster, which leverages LLMs for detecting BOLAs. BOLABuster takes an OpenAPI specification and then identifies all potentially vulnerable endpoints. It then establishes which endpoints are producers and which are consumers to map dependencies. The LLM determines the execution path to the potential BOLA and generates a test script. Unit 42 was able to find new vulnerabilities in Grafana, Harbor, and Easy!Appointments using BOLABuster.

unit42.paloaltonetworks.com · 9 min

TLDR InfoSec

STATE-BACKED ATTACKERS AND COMMERCIAL SURVEILLANCE VENDORS REPEATEDLY USE THE SAME EXPLOITS

Google's Threat Analysis Group discovered exploit campaigns targeting Mongolian government websites using iOS and Chrome vulnerabilities previously seen in commercial surveillance vendor exploits. The attackers utilized watering hole attacks to deploy sophisticated exploits and steal browser data, prompting notifications to Apple and Android partners to address the vulnerabilities. The reuse of exploits highlights the risk of dangerous threat actors acquiring tools developed by the commercial surveillance industry, emphasizing the ongoing threat of watering hole attacks on mobile devices.

blog.google · 8 min

TLDR IndexPage 5