The Daily Index — Wednesday, September 11, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

BUG LETS ANYONE BYPASS WHATSAPP'S “VIEW ONCE” PRIVACY FEATURE

WhatsApp introduced “View Once” pictures as a way to prevent other users from sharing private pictures. Security researchers have found ways to bypass these protections on WhatsApp web. WhatsApp has stated that it is aware of the issue and is rolling out a fix.

techcrunch.com · 3 min

TLDR InfoSec

SPYAGENT ANDROID MALWARE STEALS YOUR CRYPTO RECOVERY PHRASES FROM IMAGES

McAfee detected a new Android malware campaign that uses OCR to steal crypto recovery phrases. The malware also contains the capability to spread via SMS and capture OTPs sent via SMS. McAfee was able to trace back the malware and managed to access the admin panel of the malware operators.

bleepingcomputer.com · 3 min

TLDR InfoSec

RED REAPER: BUILDING AN AI ESPIONAGE AGENT

Inspired by the I-Soon leaks, these authors decided to build an AI espionage agent called Red Reaper. Red Reaper consists of 3 data science layers and a basic Flask UI. The first layer seeks to identify entities that deal with LAW in the sample email dataset and assign a confidence score to each one. The next layer builds a Neo4j graph and performs some analysis on the graph to identify key communication clusters and individuals. Generative AI is introduced in the last layer to refine the analysis and identify information that could be relevant for espionage, extortion, blackmail, or other criminal activity.

cybermongol.ca · 10 min

TLDR InfoSec

SANITIZE YOUR C++ CONTAINERS: ASAN ANNOTATIONS STEP-BY-STEP

This post discusses how to use AddressSanitizer(ASan) to detect memory errors in C++ code. Adding ASan annotations to libc++ containers like std::string and std::deque aids in bug detection. The post walks through various examples and code snippets that use ASan to aid in finding memory bugs in C++ code.

blog.trailofbits.com · 15 min

TLDR InfoSec

DEPLOYING RUST IN EXISTING FIRMWARE CODEBASES

This blog post explains how to gradually introduce Rust into existing firmware codebases for improved security. Drop-in Rust replacements for C code can enhance security with minimal effort. By following an incremental approach and addressing specific challenges, you can seamlessly integrate Rust into your firmware development process.

security.googleblog.com · 10 min

TLDR InfoSec

KUBERNETES TESTING ENVIRONMENT: AN OPEN SOURCE RESILIENCE PLATFORM FOR EKS, GKE, AND AKS

Orca has released a new tool for testing managed Kubernetes environments. The Kubernetes Testing Environment uses Terraform to deploy a configurable staging environment and runs a configurable set of scans against it. It provides dashboards to visualize the scan results.

orca.security · 8 min

TLDR InfoSec

FRIDA 16.5.0 RELEASED

Frida 16.5.0 contains new features like hardware breakpoints and watchpoints to help locate code accessing specific memory data more easily. The release also brings support for Windows on ARM and other improvements, making Frida even more versatile for developers. This article presents a demo using these new APIs in a game like DOOM, showing how to find and monitor memory locations dynamically.

frida.re · 4 min

TLDR InfoSec

MAKING SENSE OF THE APPLICATION SECURITY PRODUCT MARKET

The AppSec product market is undergoing rapid change as new tooling such as CSPMs and API security tools shift the way teams interact with traditional tools like WAFs and DASTs. ASPMs are arriving to bridge the UI/UX and contextual gaps that exist in AppSec tools across the SDLC but struggle with requiring more integration points than CSPMs. GenAI is emerging as a useful tool that aids in triaging alerts, but it is still lacking in maturity.

links.tldrnewsletter.com · 17 min

TLDR InfoSec

BUG LEFT SOME WINDOWS PCS DANGEROUSLY UNPATCHED

Microsoft has released updates to fix 79 security vulnerabilities in Windows, including an unpatched bug affecting some Windows 10 PCs. One critical bug, CVE-2024-43491, caused the rollback of fixes for certain Windows 10 systems. Two zero-day flaws affecting Microsoft Publisher and Office, CVE-2024-38226 and CVE-2024-38217, were disclosed.

krebsonsecurity.com · 3 min

TLDR InfoSec

CRIMSON PALACE RETURNS: NEW TOOLS, TACTICS, AND TARGETS

The Crimson Palace cyber threat operation has resumed with new tools and tactics to target governments and organizations in South East Asia. This blog post presents various diagrams and timelines showing the details of Crimson Palace's operations. It also discusses the evolution of the malware, as well as efforts to evade detection.

news.sophos.com · 20 min

TLDR InfoSec

AUSTRALIA'S PM WANTS SOCIAL MEDIA AGE RESTRICTIONS SO KIDS CAN GET OFFLINE AND HAVE 'REAL EXPERIENCES'

Australia's Prime Minister wants to introduce age restrictions for social media to protect children from harmful content.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

FLIPPER ZERO RELEASES FIRMWARE 1.0 AFTER THREE YEARS OF DEVELOPMENT

Flipper Zero releases Firmware 1.0 after three years of development, introducing enhanced features like dynamic app loading and improved NFC performance.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE SECURITY CANARY MATURITY MODEL

Canaries are now essential for mature security programs.

tracebit.com · 5 min