The Daily Index — Wednesday, September 25, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

RESEARCHERS REVEAL CATASTROPHIC SECURITY FLAW IN THE ARC BROWSER

A security researcher has discovered a vulnerability in the Arc browser that could lead to RCE on other users. The Arc browser has a feature called Boosts that allows arbitrary CSS and JavaScript to run and modify websites in users' browsers. The vulnerability arises from improper ACLs on The Browser Company's Firebase data store, which allows attackers to apply Boosts to different users' browsers by changing the user ID that they are attached to. An update has been pushed and The Browser Company has committed to improving its security posture.

theverge.com · 3 min

TLDR InfoSec

HOW THE NECRO TROJAN INFILTRATED GOOGLE PLAY, AGAIN

A new version of the Necro Trojan has infected popular apps on Google Play and unofficial sources, impacting over 100 million devices worldwide. The malware used obfuscation to evade detection and had the ability to display ads, download files, and execute JavaScript code. Google Play removed the malicious loader from affected apps following reports of the issue.

securelist.com · 15 min

TLDR InfoSec

DETECTING SCRIPTBLOCK SMUGGLING

PowerShell Script Block Logging is one of the types of PowerShell logs that records the content of all script blocks executed within PowerShell. ScriptBlock Smuggling is a technique whereby an attacker can hide a malicious script block within a benign script block. This post tests detections for this attack in a lab environment using a test script from AtomicRedTeam. The author notes that the full script, which contains the malicious command, can still be seen in the details pane and questions the usefulness of this attack.

dfir.ch · 5 min

TLDR InfoSec

6 TECHNIQUES I USE TO CREATE A GREAT USER EXPERIENCE FOR SHELL SCRIPTS

This author wrote a script that was praised for its UX to automate the evaluation steps in a competition. They argue for comprehensive error handling and input validation with detailed and actionable error messages, clear and colorful output, detailed progress reporting without overwhelming the user by using set -x, using set -x and set +x for fine grained and strategic error handling, making use of platform specific functionality, and using time stamped file outputs to make multiple runs easier to compare. Examples of each of these principles are included in the post.

nochlin.com · 6 min

TLDR InfoSec

OPEN TO EXPLOITATION: THE SECURITY RISKS OF UNAUTHENTICATED PAGER NETWORKS

Many critical sectors still use vulnerable pager networks like POCSAG, which are easily exploited for message injection attacks via radio frequencies, for emergency communication. These networks lack encryption, allowing anyone with basic equipment to intercept and manipulate messages, posing serious security risks in sensitive environments. This blog post highlights the urgent need for stronger security measures in these outdated communication systems by demonstrating how easy it is to spoof messages.

telescope.ac · 5 min

TLDR InfoSec

A SAFER INTERNET WITH CLOUDFLARE: FREE THREAT INTELLIGENCE, ANALYTICS, AND NEW THREAT DETECTIONS

Cloudflare has launched new free security features for website owners and network protection, including threat intelligence, analytics, and account takeover attack detection. Users can now access Security Analytics, API schema validation, and Page Shield script monitor to enhance their security. Cloudflare has also introduced new authentication options, such as signing up and logging in with Google, to simplify account access and reduce the risk of compromise.

blog.cloudflare.com · 10 min

TLDR InfoSec

GOOGLE ROLLS OUT AUTOMATIC PASSWORD SYNCING VIA PASSWORD MANAGER

Google has announced the ability for users to save passkeys to Password Manager, the password manager built into Chrome. Passkeys will automatically sync across computers and Android devices running the Password Manager app. Support for ChromeOS is in beta and support for iOS is planned.

techcrunch.com · 3 min

TLDR InfoSec

TCM SECURITY ACADEMY ANNOUNCES FREE TIER

TCM Security has announced that it will be launching a free tier to its academy. The initial offering will contain four courses: Practical Help Desk, Programming 100: Fundamentals, Linux 100: Fundamentals, and Soft Skills for the Job Market. The free tier launches today and users can access the content by signing up with only an email address.

linkedin.com · 3 min

TLDR InfoSec

CROWDSTRIKE OVERHAULS TESTING AND ROLLOUT PROCEDURES TO AVOID SYSTEM CRASHES

CrowdStrike has improved testing and rollout procedures to prevent system crashes like the one in July. It now deploys software updates gradually and has added new validation checks to prevent errors. Microsoft is also making changes to enhance security in Windows 11 following the global IT outage caused by a faulty CrowdStrike update.

securityweek.com · 2 min

TLDR InfoSec

STAYING A STEP AHEAD: MITIGATING THE DPRK IT WORKER THREAT

This post shares how organizations can detect and disrupt these threats by implementing detection strategies and maintaining vigilance.

cloud.google.com · 10 min

TLDR InfoSec

AI ADOPTION SET TO UNRAVEL YEARS OF CYBER RESILIENCE

A study by e2e-assure revealed a stark contrast between cyber risk owners' confidence in AI policies (85%) and employee awareness of such guidance (34%), indicating potential vulnerabilities in organizational cyber resilience despite increased adoption of AI technologies.

itsecurityguru.org · 2 min

TLDR InfoSec

KANSAS WATER PLANT CYBERATTACK FORCES SWITCH TO MANUAL OPERATIONS

A cyberattack on a Kansas water treatment facility led to manual operations being implemented to ensure water safety.

bleepingcomputer.com · 2 min