TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 10 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 15 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 14 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 12 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 14 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 12 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

FIDELITY SAYS DATA BREACH EXPOSED PERSONAL DATA OF 77K CUSTOMERS

Fidelity Investments has disclosed a data breach that resulted from a third party accessing information from its systems between August 17 and August 19 using two customer accounts that they created. According to data breach filings, the attacker was able to access customer data by making fraudulent requests against an internal database and retrieving images of documents pertaining to Fidelity customers. Fidelity disclosed that the breached data includes customers' social security numbers and driver's licenses.

techcrunch.com · 2 min

TLDR InfoSec

MITIGATING ATTACK VECTORS IN GITHUB WORKFLOWS

A comprehensive guide from OpenSSF on various GitHub Workflows vulnerabilities and their mitigations. The guide covers running untrusted code in privileged workflows, code injections, vulnerable actions, malicious releases, tag-renaming attacks, imposter commits, and unsafe use of caches. It concludes by introducing the OpenSSF scorecard CLI tool and GitHub Action, which can be used to check for these vulnerabilities in a GitHub Workflow.

openssf.org · 10 min

TLDR InfoSec

CAN YOU RUN AN AWS COMMAND FROM SLACK WITHOUT ANY AWS CREDENTIALS?

AWS ChatBot is an AWS service that's designed to be used with messaging services (Teams, Slack, etc) to monitor and respond to AWS events. The service can be configured using a Channel Role which will give all members of the channel the same permissions without requiring AWS credentials. If this is combined with a permissive Channel Guardrail policy, any user will be able to execute AWS CLI commands in the configured account without any permissions.

cloudsecuritypro.com · 5 min

TLDR IndexPage 5