The Daily Index — Friday, October 11, 2024 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

THE INTERNET ARCHIVE SLAMMED BY DDOS ATTACK AND DATA BREACH

The Internet Archive suffered a security breach that exposed 31 million email addresses and usernames. It also suffered a separate DDoS attack. The organization has addressed these issues and plans to share more information as it becomes available.

techcrunch.com · 1 min

TLDR InfoSec

INDIA'S STAR HEALTH CONFIRMS DATA BREACH AFTER CYBERCRIMINALS POST CUSTOMERS' HEALTH DATA ONLINE

Star Health, one of India's largest insurance companies, has confirmed a data breach after hackers created Telegram chatbots that leaked personal data belonging to 31M customers. The leaked data included full names, phone numbers, addresses, tax details, claims information, and customer ID cards. Star Health has not confirmed whether customer data was leaked and is suing Telegram and Cloudflare due to the hackers making use of their products.

techcrunch.com · 2 min

TLDR InfoSec

A FEW NOTES ON AWS NITRO ENCLAVES: ATTACK SURFACE

Summary unavailable

blog.trailofbits.com · 7 min

TLDR InfoSec

AWS LETSENCRYPT LAMBDA OR WHY I WROTE A CUSTOM TLS PROVIDER FOR AWS USING OPENTOFU AND GO

This developer wrote a Lambda function that utilizes LetsEncrypt to create and renew TLS certificates that are more portable without relying on AWS Certificate Manager. The function takes in an event from a manual run or Event Bridge, requests a certificate from LetsEncrypt, creates a new TXT record in Route53 if needed for verification, and then optionally stores it in AWS Secrets Manager. The source code for the Lambda function and OpenTofu/Terraform module is provided.

dzone.com · 10 min

TLDR InfoSec

USING CHROME'S ACCESSIBILITY APIS TO FIND SECURITY BUGS

Chrome is using accessibility APIs to find security bugs in its user interface code. By fuzzing the accessibility tree of UI controls, the Chrome team hopes to automatically discover and fix potential vulnerabilities. This approach aims to improve Chrome's overall security and stability for all users.

security.googleblog.com · 5 min

TLDR InfoSec

SMART TVS ARE SPYING ON EVERYONE

Smart TVs and streaming services are collecting extensive viewer data using advanced surveillance techniques. This includes personalized ads, content recognition, and AI-based targeting. A report by the Center for Digital Democracy criticizes these practices as undermining privacy and forcing unfair terms on consumers to access video content.

theregister.com · 3 min

TLDR InfoSec

AUSTRALIA INTROS ITS FIRST NATIONAL CYBER LEGISLATION

Australia has introduced the Cyber Security Bill 2024, aiming to establish security standards for smart devices, ransomware reporting, and cybersecurity incident coordination. It proposes a Cyber Incident Review Board, reforms to the SOCI Act, and information-sharing protocols.

darkreading.com · 1 min

TLDR InfoSec

TOP 5 SOC ANALYST CERTIFICATIONS FOR 2024

The post compares the CompTIA CySA+, TCM Security PJSA, Security Blue Team BTL1, HackTheBox CDSA, and the OffSec OSDA. Summaries are provided for each section, with an infographic presented at the end.

tcm-sec.com · 4 min

TLDR InfoSec

THE STATE OF ATTACKS ON GENAI

This report, based on real-world analysis of more than 2,000 AI applications, found that 90% of successful attacks resulted in the leakage of sensitive data.

45700826.fs1.hubspotusercontent-na1.net · 25 min

TLDR InfoSec

CISA OFFICIAL: AI TOOLS ‘NEED TO HAVE A HUMAN IN THE LOOP'

CISA's Chief AI Officer emphasizes the importance of having humans involved in AI tools for cybersecurity.

fedscoop.com · 3 min

TLDR InfoSec

LAMBORGHINI CARJACKERS LURED BY $243M CYBERHEIST

Summary unavailable

krebsonsecurity.com · 8 min