The Daily Index — Monday, October 21, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

REDBOX EASILY REVERSE-ENGINEERED TO REVEAL CUSTOMERS' NAMES, ZIP CODES, RENTALS

Redbox's bankruptcy raises concerns about data stored in its kiosks. A programmer accessed a Redbox hard drive image, retrieving 2,471 transaction records dating back to 2015. These included customer email addresses, zip codes, partial credit card numbers, and rental details. While only a small portion of transactions were likely stored locally, this highlights potential data privacy risks.

arstechnica.com · 4 min

TLDR InfoSec

NEW MACOS TCC VULNERABILITY DISCOVERED

Microsoft researchers discovered a new vulnerability that could allow attackers to bypass Transparency, Consent, and Control (TCC) protections for Safari. The vulnerability can be exploited by an attacker modifying specific configuration files in Safari and then forcing a user to browse to a malicious page. A patch is available and users are encouraged to update as Microsoft has determined that threat actors may be actively exploiting the vulnerability.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

SECRETS AND SHADOWS: LEVERAGING BIG DATA FOR VULNERABILITY DISCOVERY AT SCALE

Bill Demirkapi's long term project discovered over 66,000 unique TLDs with dangling records and more than 15,000 verified secrets. He used innovative methods including enumerating cloud IP pools, utilizing passive DNS sources, and employing VirusTotal's Retrohunt tool with custom YARA rules. In this post Demirkapi outlines the key principles for large-scale vulnerability discovery, emphasizing starting with the vulnerability itself and using creative data sources with relevant relationships.

billdemirkapi.me · 36 min

TLDR InfoSec

BUILD YOUR OWN AUTOFIX WITH PATCHWORK

This post describes a Patchflow to create an AI code autofixer. The Patchflow first scans the code using Semgrep. It then enriches the Sarif output with the source code file and uses an LLM to triage the report. The LLM is then prompted to create and test a patch. If successful, the LLM then opens a PR with the fix. Prompts for each of the LLM steps are included.

patched.codes · 6 min

TLDR InfoSec

CALL STACK SPOOFING EXPLAINED USING APT41 MALWARE

Call stack spoofing is a technique to hide suspicious activity from security software like EDR by mimicking a legitimate call stack. A malware called DodgeBox used by APT41 implemented this technique to trick antivirus software. By creating a fake call stack, the malware obscures the true origin of function calls, making detection more challenging.

cybergeeks.tech · 6 min

TLDR InfoSec

REALM.SECURITY (PRODUCT LAUNCH)

Realm.Security is a platform that integrates and manages cybersecurity data from various sources in various formats by leveraging artificial intelligence and data processing technology.

realm.security

TLDR InfoSec

TURNING AWS DOCUMENTATION INTO GOLD: AI-ASSISTED SECURITY RESEARCH

This researcher attempted to discover security vulnerabilities by scraping and querying the AWS documentation. Their post begins by briefly touching on the steps taken to scrape the AWS documentation and some brief exploration locally using ripgrep. The researcher uploaded the scraped and enriched docs to s3 and set up Amazon Bedrock to query the docs using Claude 3.5. They discovered over a hundred publicly accessible buckets with sensitive information, was able to takeover a bucket, and discovered that the amzn-s3-demo-* prefix is reserved.

securityrunners.io · 8 min

TLDR InfoSec

HOW TO LEVERAGE $200 MILLION FCC PROGRAM BOOSTING K-12 CYBERSECURITY

This post provides cybersecurity professionals with insights into how to leverage FCC's $200 million program to help K-12 schools improve cybersecurity defenses. Schools can apply for funding by demonstrating cybersecurity needs and developing improvement plans. Partnering with cybersecurity experts can enhance schools' chances of securing funding and maintaining long-term security.

bleepingcomputer.com · 3 min

TLDR InfoSec

OWASP SAYS SECRETS SECURITY IS THE MOST IMPORTANT ISSUE FOR MOBILE APPLICATIONS

OWASP updated its Top 10 Risks for Mobile Applications, highlighting "Improper Credential Usage" as a significant security concern due to hardcoded secrets in mobile apps. To enhance secrets security, developers should avoid hardcoding secrets, use secure storage APIs, move secrets to the backend, rotate keys regularly, and implement secrets detection tools like GitGuardian. Leaked secrets can lead to severe consequences, such as unauthorized access, financial losses, and legal repercussions, showing the importance of prioritizing secrets management in mobile app development.

blog.gitguardian.com · 5 min

TLDR InfoSec

INSIDE THE MIND OF A HACKER 2024

This report provides a comprehensive overview of the hacking community and its perspective on topics at the forefront of cybersecurity.

bugcrowd.com · 30 min

TLDR InfoSec

DEFCON 32 TALKS (YOUTUBE PLAYLIST)

DEFCON has uploaded all of the main stage talks from DEFCON 32 to its YouTube channel.

youtube.com

TLDR InfoSec

EU BRINGS PRODUCT LIABILITY RULES IN LINE WITH DIGITAL AGE AND CIRCULAR ECONOMY

The European Union has updated its product liability rules to cover software and associated risks.

links.tldrnewsletter.com · 2 min