TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 10 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 11 stories
  8. Page 8: TLDR FoundersTLDR Founders · 10 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 16 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders · 10 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

LINUX LKM PERSISTENCE

This post discusses different methods to establish persistence with a Linux loadable kernel module type rootkit. Two simple methods that are briefly touched upon are to use a user space persistence mechanism that runs with root privileges to load the module or add the module to /etc/modules. Instead, this author explores using a systemd-modules-load file with the Diamorphine LKM rootkit which will hide any file that contains a given magic string from the kernel to hide the configuration file. The author then describes how timestamps or checking for a tainted kernel can be used to detect this attack.

righteousit.com · 6 min

TLDR InfoSec

SUPPLY-CHAIN ATTACK ANALYSIS: ULTRALYTICS

The Ultralytics Python project was recently targeted in a supply-chain attack through compromised GitHub Actions workflows and PyPI API tokens. PyPI experts were able to analyze the attack and emphasize the importance of securing software forges and building workflows for open source projects. To improve PyPI security, developers are advised to use trusted publishers, audit workflows for security vulnerabilities, and follow best practices like using 2FA and rotating secrets.

blog.pypi.org · 5 min

TLDR InfoSec

DETECTING WIFI DUMPING VIA DIRECT WINAPI CALLS AND INTRODUCTION TO IMMUTABLE ARTIFACTS

Many detection rules rely on artifacts that are mutable by the attacker. This author sought to investigate detections that relied on immutable artifacts with the example of an attacker that enumerated WiFi networks and dumped passwords directly via the WinAPI as opposed to using tools such as netsh. The author initially ran into issues as the program they wrote to enumerate networks did not cause any obvious registry calls, spawn netsh, or read the Wlansvc\Profiles\Interfaces file. The only method that the author found to detect the attack was by enabling the noisy Sysmon Event ID 7 where a rule can be created by searching for an event where the ImageLoaded is wlanapi.dll and the Image contains an unfamiliar .exe.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

CONFIDENTIAL COMPUTING AT 1PASSWORD

To ensure the security of its customers' secrets, 1Password utilizes end-to-end encryption to ensure that the data is not accessible by anyone, even at 1Password. To achieve this goal, 1Password utilizes AWS Nitro Enclaves to create a cryptographically verifiably, isolated confidential compute environment. 1Password publishes each enclave release to a public transparency log and then verifies the attestation when the client opens an encrypted channel. This ensures that no 1Password or AWS employees can access the code or communications running in the enclaves.

links.tldrnewsletter.com · 6 min

TLDR IndexPage 5