The Daily Index — Tuesday, January 7, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

WALLET DRAINER MALWARE USED TO STEAL $500 MILLION IN CRYPTOCURRENCY IN 2024

Wallet drainer malware stole nearly $500 million in cryptocurrency from over 332,000 victims in 2024, a 67% increase from 2023. The highest activity was in Q1 with $187.2 million stolen, though the largest single theft ($55.48 million) occurred in August.

securityweek.com · 2 min

TLDR InfoSec

ATOS REJECTS SPACE BEARS' BREACH ALLEGATIONS, POINTS TO THIRD-PARTY INFRASTRUCTURE LINK

French IT firm Atos has denied the Space Bears ransomware group's claims of a system breach from December 28. It initially rejected all compromise allegations, but later clarified that the incident involved compromised external third-party infrastructure containing Atos-related data, not its own systems.

techmonitor.ai · 3 min

TLDR InfoSec

HOW ATTACKERS ABUSE SERVERLESS SERVICES TO HARVEST SENSITIVE DATA FROM ENVIRONMENT VARIABLES

This post provides an overview of how attackers exploit environment variables from serverless devices post-exploitation. When secrets are stored directly in environment variables, they can be leaked by an attacker that can achieve code execution on the function. As permissions are generally provided to the serverless execution environment via environment variables, they can also be acquired by the attacker to pivot to other services in the account that the function can access. To mitigate these issues, utilize Secrets Manager services, audit functions, scope roles to least privilege, and alert on abuse.

permiso.io · 10 min

TLDR InfoSec

HOW TO BUILD AN OFFENSIVE AI SECURITY AGENT

This post walks through the process of building a POC for an offensive AI security agent that was able to analyze a JavaScript file to discover API endpoints and detect a vulnerability. The author provided the AI agent with 4 “tools” to find endpoints, format an API request, execute the test, and analyze the results. The post also provides some lessons learned, such as the importance of effective prompting, the power of agentic workflows, and the strengths of Claude 3.5 Sonnet for code writing.

anshumanbhartiya.com · 7 min

TLDR InfoSec

OPENAI'S RED TEAMING INNOVATIONS DEFINE NEW ESSENTIALS FOR SECURITY LEADERS IN THE AI ERA

OpenAI has released two papers showcasing its advanced approach to AI security through red teaming. The company employs external teams to find vulnerabilities and use automated reinforcement learning for attack simulation. Its human-in-the-middle approach combines human expertise with AI techniques, setting new standards for AI model safety.

links.tldrnewsletter.com · 7 min

TLDR InfoSec

FROM REMEDIATION TO MITIGATION: ADDRESSING INSECURE-BY-DESIGN FLAWS

Insecure-by-Design flaws are vulnerabilities inherent to the design of a system. They require a full redesign of the system remediate. These vulnerabilities should first be mitigated by implementing guardrails and monitoring tools. Once mitigations are in place, a slow sunsetting process can be started to reduce downstream impacts.

vectra.ai · 6 min

TLDR InfoSec

AMIT YORAN, CHAIR AND CEO OF CYBERSECURITY FIRM TENABLE, DIES UNEXPECTEDLY AFTER CANCER BATTLE

Amit Yoran, CEO of cybersecurity company Tenable and former U.S. National Cybersecurity Director, died unexpectedly at 54 while on medical leave for cancer treatment. Tenable went public successfully in 2016 under his leadership. The company's COO and CFO are serving as interim co-CEOs.

cnbc.com · 3 min

TLDR InfoSec

NESSUS SCANNER AGENTS WENT OFFLINE DUE TO A FAULTY PLUGIN UPDATE

Tenable disabled two Nessus scanner agent versions due to a faulty plugin update that caused agents to go offline. The company released Nessus Agent v10.8.2 to address the issue and has advised customers to upgrade to this version or downgrade to 10.7.3 to resolve offline agent problems. Plugin feed updates were temporarily paused to prevent further issues.

securityaffairs.com · 2 min

TLDR InfoSec

CISA SAYS RECENT GOVERNMENT HACK LIMITED TO US TREASURY

CISA confirmed that a recent hack attributed to the Chinese state-sponsored hackers at the US Treasury did not affect other federal agencies.

cisa.gov · 1 min

TLDR InfoSec

MICROSOFT BING SHOWS MISLEADING GOOGLE-LIKE PAGE FOR 'GOOGLE' SEARCHES

Microsoft Bing displays a misleading Google-like search page when users search for 'Google'.

bleepingcomputer.com · 2 min

TLDR InfoSec

MALICIOUS NPM PACKAGES TARGET ETHEREUM DEVELOPERS

Malicious npm packages are targeting Ethereum developers by impersonating Hardhat plugins to steal private keys and sensitive data.

securityaffairs.com · 2 min