The Daily Index — Monday, September 9, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

LOWE'S EMPLOYEES PHISHED VIA GOOGLE ADS

Malwarebytes detected a phishing campaign targeting Lowe's employees by masquerading as the Lowe's benefits portal. The attackers registered domains to common typos of MyLowesLife and bought Google Ads to have them show up in search results for MyLowesLife. The bogus domains were then used to steal login credentials from employees.

malwarebytes.com · 3 min

TLDR InfoSec

CAR RENTAL COMPANY AVIS DISCLOSES A DATA BREACH

Avis, a car rental company, experienced a data breach in August that compromised customers' personal information. The breach occurred between August 3 and August 6 but was discovered on August 14. Avis is advising impacted customers to monitor their accounts for fraudulent activities and is offering free credit monitoring services.

securityaffairs.com · 2 min

TLDR InfoSec

WHAT YOU SHOULD KNOW ABOUT PHP CODE SECURITY

This blog dives into PHP security. Due to its popularity and wide usage, PHP is often a target for hackers and malicious entities. Security vulnerabilities can creep in due to various reasons, such as poor coding practices, lack of sanitization of user inputs, and outdated versions.

snyk.io · 8 min

TLDR InfoSec

LEARNING RUST FOR FUN AND BACKDOO-RS

Rust, a modern systems programming language that offers C/C++ performance without their pitfalls, is growing in popularity. This author shares their journey of learning Rust in 2024, highlighting the abundance of learning resources available and his personal recommendations.

security.humanativaspa.it · 10 min

TLDR InfoSec

“UNSTRIPPING” BINARIES: RESTORING DEBUGGING INFORMATION IN GDB WITH PWNDBG

Jason An from Trail Of Bits discusses how analyzing stripped binaries can be tough. He has enhanced Pwndbg to restore debugging information in GDB for stripped binaries using Binary Ninja integration. He also introduced the go-dump command for easier debugging of Go values. These improvements are available on the Pwndbg dev branch and its latest release.

blog.trailofbits.com · 6 min

TLDR InfoSec

REDFLAGS (PRODUCT LAUNCH)

Redflags is a platform designed to increase secure behavior through the concept of ‘nudging'. By nudging users, they practice ‘good' behavior beyond simply acknowledging poor behavior and bad intent.

thinkcyber.co.uk

TLDR InfoSec

YEAR-LONG CAMPAIGN OF MALICIOUS NPM PACKAGES TARGETING ROBLOX USERS

A long-running malware campaign is targeting Roblox developers through fake NPM packages mimicking "noblox.js". Attackers are using brandjacking and starjacking to appear legitimate and install malware that steals data, persists in systems, and deploys additional payloads to continue siphoning future data.

checkmarx.com · 8 min

TLDR InfoSec

HARD TRUTHS YOUR CISO WON'T TELL YOU

Slides from Travis McPeak's off the record BlackHat campfire talk. McPeak shares some unfortunate realities of security in a business context, security organizations, and security practices. He closes with a set of good news such as the community being strong, the industry maturing, and that developers are looking to work with security.

slideshare.net · 6 min

TLDR InfoSec

WHAT'S THE WORST PLACE TO LEAVE YOUR SECRETS?

A researcher deployed canary tokens to a variety of different locations to measure how quickly attackers would find them and attempt to use them on AWS. Tokens deployed to package managers (npm and PyPi) and GitHub were accessed within minutes whereas Pastebin, a web server, and a Docker container took longer. Tokens deployed to GitLab, BitBucket, S3, GCP Cloud Storage, and a (weak) password-protected Pastebin were never accessed, suggesting that attackers are not actively monitoring these resources.

cybenari.com · 10 min

TLDR InfoSec

THE STATE OF THE VIRTUAL CISO 2024

The State of the Virtual CISO Survey Report examines vCISO adoption, opportunities, and challenges for MSPs/MSSPs, based on insights from 200 security leaders.

19508596.fs1.hubspotusercontent-na1.net · 15 min

TLDR InfoSec

GITHUB ACTIONS VULNERABLE TO TYPOSQUATTING, EXPOSING DEVELOPERS TO HIDDEN MALICIOUS CODE

Threat actors are exploiting typos in GitHub Actions to run malicious code by creating similar-sounding actions, compromising projects, and stealing sensitive information.

thehackernews.com · 3 min

TLDR InfoSec

A GLOBAL ASSESSMENT OF THIRD-PARTY CONNECTION TAMPERING

CloudFlare discussed at SIGCOMM how it was able to analyze anomalous internet connections so that various signature patterns of tampering can be identified.

blog.cloudflare.com · 19 min