TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 13 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 13 stories
  8. Page 8: TLDR FoundersTLDR Founders · 12 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 10 stories
  10. Page 10: Resources & ToolsTLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 15 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR InfoSec, TLDR Founders, TLDR Marketing · 8 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

LASTPASS WARNS OF FAKE SUPPORT CENTERS TRYING TO STEAL CUSTOMER DATA

There is a new phishing campaign that targets users by posting reviews with a fake customer support number. When users call the number, a fake customer support agent instructs them to enter a code on a website that installs the ConnectWise SmartConnect software. The customer support agent then asks questions and attempts to troubleshoot the issue while an accomplice uses the SmartConnect software to steal data or install other malware. The same customer support number has been seen in attacks on Netflix, Amazon, iCloud, and others.

bleepingcomputer.com · 2 min

TLDR InfoSec

BREACHING THE DATA PERIMETER: CLOUDTRAIL AS A MECHANISM IN DATA EXFILTRATION

AWS CloudTrail's behavior with VPC Endpoints allowed data exfiltration through denied cross-account requests. Exploiting the vulnerability requires creating a DynamoDB table with specific resource policies and using custom user-agents to smuggle data through CloudTrail logs. While now patched, the vulnerability demonstrates how CloudTrail's inconsistent logging behavior across services can be exploited for data exfiltration.

tracebit.com · 5 min

TLDR InfoSec

HOW WE USE DATADOG FOR DETECTION AS CODE

This blog post outlines DataDog's Detection as Code (DaC) workflow, Terraform repository structure, and testing strategy. The DataDog team's process involves defining a query in the UI, exporting the detection to Terraform from the UI, committing it to source code with tests based on Stratus Red Team, and then deploying via a GitLab CI/CD pipeline. The post provides samples of rules, suppressions, tests, and Terraform configurations.

datadoghq.com · 8 min

TLDR InfoSec

LEVERAGING WAZUH FOR ZERO TRUST SECURITY

Organizations can utilize Wazuh to build a zero trust security system that protects against cyber threats and compliance limitations of traditional security models. Zero Trust security changes how organizations handle security by continuously analyzing access requests and monitoring every device and user. Companies adopt Zero Trust security to protect against cyber threats and compliance limitations of traditional security models.

thehackernews.com · 6 min

TLDR InfoSec

HOW TO BUILD A SECURITY GUARDIANS PROGRAM TO DISTRIBUTE SECURITY OWNERSHIP

AWS has developed a Security Guardians program that empowers builders to make security decisions to enable security efforts (threat modeling, security reviews, etc) at scale. AWS has defined five steps to creating a security guardians program: set the program vision, identify innovators with a passion for security, define the behaviors that guardians will be expected to perform, maintain guardians' interest by providing opportunities to learn new skills and potential for career advancement, and measure the success of the program by gathering feedback as well as other metrics.

aws.amazon.com · 7 min

TLDR IndexPage 5