The Daily Index — Friday, October 4, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NEW LINUX MALWARE ‘PERFCTL' TARGETS MILLIONS BY MIMICKING SYSTEM FILES

A new Linux malware called Perfctl is targeting millions worldwide by mimicking system files to avoid detection. This sophisticated malware compromises Linux servers for cryptomining and resource hijacking, using rootkit and evasion techniques to hide its presence. To protect your Linux systems, update regularly, conduct vulnerability assessments, and use security tools like firewalls.

hackread.com · 3 min

TLDR InfoSec

THOUSANDS OF ADOBE COMMERCE E-STORES HACKED BY EXPLOITING THE COSMICSTING BUG

Over 4,000 Adobe Commerce and Magento e-stores were hacked due to a critical vulnerability, CosmicSting (CVE-2024-34102), which allows attackers to execute arbitrary code. The attacks have impacted major organizations and resulted in the installation of payment skimmers on victim stores. Merchants are urged to update their systems immediately to protect against these exploits.

securityaffairs.com · 3 min

TLDR InfoSec

OPAQUE PREDICATES AND HOW TO HUNT THEM

Opaque predicates are a conditional expression that the programmer knows the answer to but chooses to check anyway. They can be utilized to obscure the control flow for anti-reversing. This post utilizes the MIASM Python library to create an IDA Pro plugin to detect and patch unreachable blocks. The plugin utilizes the Symbolic Execution engine to detect opaque predicates and then patches them with NOPs.

blog.midi12.re · 8 min

TLDR InfoSec

HACKING MISCONFIGURED CLOUDFLARE R2 BUCKETS: A COMPLETE GUIDE

This blog post discusses how to hack Cloudflare R2 buckets to discover sensitive files. Begin by utilizing Google dorking and examining HTTP requests to discover R2 buckets. Exploitation can then be done via abusing missing or improper authorization checks or finding exposed R2.dev buckets.

blog.intigriti.com · 6 min

TLDR InfoSec

HOW TO INTERCEPT DATA EXFILTRATED BY MALWARE VIA TELEGRAM AND DISCORD

This blog post explains how to gather information on threat actors, using Telegram API to identify them and attribute malware samples. It demonstrates steps to intercept data exfiltrated by malware through Telegram and Discord, including obtaining bot tokens, chat IDs, and forwarding messages for analysis. The post provides scripts and examples for interacting with Telegram bots and Discord webhooks to monitor and analyze malware activities in real time.

any.run · 9 min

TLDR InfoSec

ANDROID 14 ADDS NEW SECURITY FEATURES TO BLOCK 2G EXPLOITS AND BASEBAND ATTACKS

Google has added new security features to its latest Pixel devices to protect against baseband security attacks. These attacks exploit vulnerabilities in cellular baseband software to compromise device security. The new Android 14 update also includes measures to prevent unauthorized network connections and alert users to potential surveillance threats.

thehackernews.com · 3 min

TLDR InfoSec

YOU MIGHT WANT TO CHECK YOUR BANK OF AMERICA ACCOUNT: CLIENTS REPORTING $0 BALANCE

Bank of America customers nationwide faced an outage with $0 balances in their accounts, causing widespread concern. Over 19,000 people reported the issue, which mainly affected online and mobile banking services. Despite technical problems, Bank of America assures that the issues have been largely resolved.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

DIFFERENTIAL FUZZING FOR CRYPTOGRAPHY

Differential fuzzing uses multiple implementations to compare outputs for finding bugs like logic errors and incorrect computations, beyond just memory bugs and crashes. LibAFL is a tool that helps with custom input generation for differential fuzzing, allowing for more efficient bug discovery in cryptographic implementations. The quality of input generation and harness design is crucial for a successful fuzzing campaign, highlighting the importance of testing edge cases while restricting the test range to what the target can handle.

blog.quarkslab.com · 13 min

TLDR InfoSec

INTERPOL ARRESTS 8 IN MAJOR PHISHING AND ROMANCE FRAUD CRACKDOWN IN WEST AFRICA

INTERPOL arrested eight people in West Africa for phishing and romance fraud involving Swiss citizens that led to $1.4 million in losses.

thehackernews.com · 2 min

TLDR InfoSec

PIG BUTCHERING: FAKE TRADING APPS TARGET CRYPTO ON APPLE, GOOGLE PLAY STORES

Fake trading apps targeting crypto investors on Apple and Google Play Stores have been discovered.

hackread.com · 3 min