The Daily Index — Monday, November 18, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

NORTH KOREAN-LINKED HACKERS WERE CAUGHT EXPERIMENTING WITH NEW MACOS MALWARE

Three variants of a new macOS malware have been detected. One variant was written in Python, one in Golang, and one using Flutter, which heavily obfuscates code by default. The malware was embedded in a clone of Minesweeper. No evidence of exploitation has been found - the callback domain returns a 404. The malware appeared to target cryptocurrency developers. It had several of the hallmarks of a Lazarus group attack.

cyberscoop.com · 2 min

TLDR InfoSec

UNPATCHED REMOTE CODE EXECUTION IN GOGS

The Gogs self-hosted Git service version 0.13.0 has a vulnerability (CVE-2024-44625) that allows remote code execution. Attackers can exploit this by gaining access to an account that can push to a repository and editing files from the web interface. The issue remains unaddressed by Gogs developers despite multiple reports, prompting users to take security measures and consider migrating to Gitea.

fysac.github.io · 4 min

TLDR InfoSec

SELINUX BYPASSES

This in-depth guide to bypassing SELinux on Android devices begins with an overview of how SELinux works and breaks down the relevant sections of the implementation code. It then discusses some bypasses that don't work either for hypervisor blocks or read only memory such as disabling SELinux by setting the enforcing mode to permissive, overwriting the permissive map, AV Cache poisoning, and SELinux initialization overwriting. Two bypasses that do eventually work involve overwriting the SELinux hooks and overwriting the allow_unknown field in the selinux_state.

klecko.github.io · 23 min

TLDR InfoSec

EXPLORING THE DOMPURIFY LIBRARY: BYPASSES AND FIXES (1/2)

This is the first out of two articles that cover DOMPurify security bypasses discovered in early 2024 by various researchers. Affecting versions 3.1.0-3.1.2, the vulnerabilities include exploits that use deep nesting and DOM clobbering techniques.

mizu.re · 20 min

TLDR InfoSec

PROMPT INJECTING YOUR WAY TO SHELL: OPENAI'S CONTAINERIZED CHATGPT ENVIRONMENT

A technical analysis that explores ChatGPT's sandbox environment. It covers how to gain file system access, command execution capabilities, and prompting techniques to extract system information. The author emphasizes responsible disclosure and educational goals and requests readers notify OpenAI of any issues prior to publication.

0din.ai · 8 min

TLDR InfoSec

SUREPATH AI (PRODUCT LAUNCH)

SurePath AI provides visibility and control over gen-AI use across public and private models, with role-based access controls that decide what data is allowed to leave the organization and what end-users have access to.

surepath.ai

TLDR InfoSec

NIST SAYS EXPLOITED BACKLOG CLEARED BUT END-OF-YEAR GOAL FOR FULL LIST UNLIKELY

This past February, NIST announced that it did not have enough resources to keep up with the CVE enrichment backlog and stated that changes would be made to keep up. Now, the NIST has announced that it is fully staffed, has partnered with other federal agencies and industry partners, and has provided enriched CVE data for all vulnerabilities in the KEV. However, NIST also stated that the format that it receives data from its Authorized Data Provider is difficult to import and enhance.

therecord.media · 2 min

TLDR InfoSec

ATTACK OF THE EVIL BARISTAS

A common cybersecurity trope is to never use unsecured, public WiFi without a VPN. The author of this article challenged this notion by monitoring the HTTPS and non-HTTPS connections made by their iPhone and Chromebook. They found that anyone monitoring their connection could only see 0.25% of requests from their Chromebook and that there were zero connections to HTTP websites and services from their iPhone.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

ATTESTATIONS: A NEW GENERATION OF SIGNATURES ON PYPI

PyPI has introduced digital attestations (PEP 740) to improve package security. Digital attestations offer better usability and verifiability than PGP signatures. Attestations are automatically enabled for publishers using Trusted Publishing with pypa/gh-action-pypi-publish v1.11.0+.

blog.trailofbits.com · 8 min

TLDR InfoSec

BITFINEX HACKER RECEIVES FIVE-YEAR SENTENCE FOR RECORD-BREAKING CRYPTO HEIST

Ilya Lichtenstein has received a 5-year sentence for the 2016 Bitfinex hack.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

PHISHING EMAILS INCREASINGLY USE SVG ATTACHMENTS TO EVADE DETECTION

Threat actors are using SVG attachments in phishing emails to avoid detection, with some of them displaying HTML and then executing JavaScript when the image is loaded.

bleepingcomputer.com · 2 min

TLDR InfoSec

MICROSOFT REVAMPS HOW IT WILL DISCLOSE VULNERABILITIES

Microsoft has announced that it will use the Common Security Advisory Framework, which helps organizations understand and fix security issues faster, for vulnerability disclosures.

cybersecuritydive.com · 2 min