The Daily Index — Monday, September 16, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

FAKE PASSWORD MANAGER CODING TEST USED TO HACK PYTHON DEVELOPERS

The North Korean Lazarus hacking group launched a campaign where it approached Python developers with a coding interview challenge. The candidates were tasked with finding and fixing bugs in a password manager application that pulled in two malicious PyPi packages that executed an obfuscated C2 payload in their __init__.py. Candidates were rushed to complete the assignment due to tight deadlines listed in the README file that may have led to them skipping some security checks.

bleepingcomputer.com · 2 min

TLDR InfoSec

GAZEPLOIT COULD WORK OUT VISION PRO USER PASSWORDS FROM WATCHING THEIR AVATAR

Researchers have developed a new exploit, dubbed GAZEploit, that uses a neural network to detect Vision Pro users' passwords based on the eye movements reflected in their avatars' faces when the on-screen keyboard is pulled up. The researchers managed to achieve an 85.9% precision rate and 96.8% recall rate in their test of 30 users. Apple has fixed this vulnerability by disabling avatars while the virtual keyboard is pulled up.

9to5mac.com · 3 min

TLDR InfoSec

EVIL MSI. A STORY ABOUT VULNERABILITIES IN MSI FILES

This post provides a primer on finding vulnerabilities in MSI files. It begins with an overview of the MSI file format and details the tables that may be relevant. It then covers ways to enumerate MSI files and common attack vectors such as abandoned credentials, custom actions, and GUI escapes. The post also provides examples of utilizing tools to automate the procedure as well as a tool that they wrote.

links.tldrnewsletter.com · 9 min

TLDR InfoSec

OFFENSIVE AI AGENTS: A TIMELINE OF MY RESEARCH

Jeff Sims, a frontier AI/ML cyber researcher, shares a timeline of his research on offensive AI agents, including BlackMamba, EyeSpy, and Red Reaper. These AI systems demonstrate the potential for adversarial use of AI technology and the need for awareness in the field. Sims' research focuses on developing advanced offensive AI agents capable of self-training and targeting other AI systems.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

SSH KEYSTROKE OBFUSCATION BYPASS

OpenSSH 9.5 added keystroke timing obfuscation to prevent traffic analysis attacks. The feature hides keystroke timings and floods chaff packets to obscure real keystrokes. This blog post walks through how analyzing packet sizes can reveal keystrokes and their types, aiding in traffic analysis.

crzphil.github.io · 11 min

TLDR InfoSec

INTRODUCING SIGMALITE. RUNREVEAL'S OPEN SOURCE SIGMA RULE EVALUATOR FOR DETECTION

RunReveal has released Sigmalite, an open-source sigma rule evaluator for detection, under the Apache 2.0 license for stream processing. Sigmalite allows security teams to use sigma rules for detections outside of their SIEM, providing flexibility in log processing and detection. By integrating Sigmalite into its pipeline, RunReveal aims to offer customers the ability to easily create, validate, and run sigma detections for better log management and correlation.

blog.runreveal.com · 6 min

TLDR InfoSec

SIMPLIFY SBOM MANAGEMENT FOR DEVELOPERS: INTRODUCING BOMCTL

Bomctl is a new tool within OpenSSF that helps manage Software Bill of Materials (SBOMs) for developers. It aims to simplify handling SBOM documents by providing a command-line interface for retrieving, storing, and manipulating component information. Bomctl supports complex SBOM operations and aims to facilitate integration with existing SBOM tooling ecosystems.

openssf.org · 3 min

TLDR InfoSec

PORT OF SEATTLE HIT BY RHYSIDA RANSOMWARE IN AUGUST ATTACK

The Port of Seattle was attacked by Rhysida ransomware, causing disruptions to critical systems like reservation check-in and flight delays. The ransomware gang demanded payment, but the Port refused, choosing to restore affected systems instead. Rhysida is known for targeting various industries and has been linked to attacks on healthcare organizations and other high-profile targets.

bleepingcomputer.com · 2 min

TLDR InfoSec

A NEW PATH FOR KYBER ON THE WEB

Google is making changes to Chrome to switch from supporting the Kyber algorithm to the new ML-KEM algorithm for post-quantum key exchange. The switch is necessary due to the standardization of ML-KEM and incompatibility with the previous version of Kyber. Server operators can temporarily support both algorithms to maintain post-quantum security while clients update their implementations.

security.googleblog.com · 2 min

TLDR InfoSec

ACQUIRING MALICIOUS BROWSER EXTENSION SAMPLES ON A SHOESTRING BUDGET

The blog post explains how to acquire and decrypt samples of a malicious browser extension using free resources and simple cryptanalysis techniques. By leveraging services like urlscan, the author was able to identify potentially malicious domains and scripts used by the malware. The analysis revealed active and potentially harmful domains, highlighting the importance of monitoring and detecting malicious activities online.

pberba.github.io · 10 min

TLDR InfoSec

23ANDME TO PAY $30 MILLION IN GENETICS DATA BREACH SETTLEMENT

23andMe will pay $30 million in cash to settle a lawsuit over a data breach that affected 6.4 million customers in 2023.

bleepingcomputer.com · 2 min

TLDR InfoSec

21 THOUGHTS ON “THE DARK NEXUS BETWEEN HARM GROUPS AND ‘THE COM'”

This article dives into the shadowy world of how the overlap between harm communities and cybercriminals is causing real-world violence and extortion schemes.

krebsonsecurity.com · 13 min

TLDR InfoSec

FBI TELLS PUBLIC TO IGNORE FALSE CLAIMS OF HACKED VOTER DATA

The FBI and CISA warn against false claims of hacked voter data to manipulate public opinion and undermine confidence in U.S. democratic institutions.

bleepingcomputer.com · 2 min