The Daily Index — Thursday, January 9, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

TURBULENCE AT UN AVIATION AGENCY AS PROBE INTO POTENTIAL DATA THEFT BEGINS

The UN's International Civil Aviation Organization (ICAO) is investigating a potential data breach after cybercriminal "Natohub" claimed to have stolen 42,000 documents containing personal information. ICAO previously faced a 2016 cyberattack that they allegedly attempted to cover up.

theregister.com · 3 min

TLDR InfoSec

MISCONFIGURED LICENSE PLATE READERS ARE LEAKING DATA IN REAL TIME

Security Researcher Matt Brown purchased and reverse engineered the firmware of a Motorola automated license plate reader (ALPR) system. Brown used a unique error page to find 150 Internet exposed Motorola ALPR systems that did not implement any form of authentication. Wired journalists confirmed that these cameras are deployed by law enforcement and are leaking license plate number, car location, make and model, and other metadata from thousands of cars in just 20 minutes of sample time.

arstechnica.com · 3 min

TLDR InfoSec

USING THE MACH-O MODULE IN YARA-X

This post introduces some of the improvements that the new Yara-X Mach-O module makes over the original. The new Mach-O module parses many of the core structures that are used in Mach-O binaries including the symbol table, imports, exports, entitlements, remote paths, and dylibs. The module also allows for calculating binary similarities by hashing the above structures.

virustotal.github.io · 4 min

TLDR InfoSec

ATTACKING ENTRA METAVERSE: PART 1

Part 1 of a series of blog posts exploring the Entra metaverse and demonstrating attacks against it. It introduces the concept of the Entra metaverse and demonstrates how the compromise of an Entra user can be used to fully compromise an on-premise AD user. The following posts explore cross-domain attacks and argue that the Entra Tenant is your trust boundary when using Entra.

posts.specterops.io · 7 min

TLDR InfoSec

CROSS CACHE ATTACK CHEATSHEET

This article describes a technique called "cross-cache attack" in Linux kernel exploitation that allows transferring a Use-After-Free (UAF) vulnerability from one object to another, even if they're allocated from different slabs. The attack involves a five-step process: spraying object-A sharing a slab with object-V, allocating a victim object-V, freeing object-V, freeing specific objects to trigger slab recycling through the buddy system, and finally spraying object-B to overlap with the freed object-V's memory. The article provides detailed code examples and experimental results, including a timing-based technique called SLUBStick that helps determine the state of slab allocation in the kernel.

u1f383.github.io · 4 min

TLDR InfoSec

ELEMENT SECURITY (PRODUCT LAUNCH)

Element is designed to proactively identify and mitigate risks by continuously discovering and mapping assets, and feeding identified assets into a proprietary exploit engine to assess exploitability.

element.security

TLDR InfoSec

11 THOUGHTS ON “A DAY IN THE LIFE OF A PROLIFIC VOICE PHISHING CREW”

Brian Krebs has notes on a sophisticated voice phishing operation called "Crypto Chameleon" that is exploiting Apple and Google's legitimate services to scam cryptocurrency owners, using a coordinated team approach and phishing panels to steal millions from victims including billionaire Mark Cuban, while operating openly on messaging platforms like Discord and Telegram where the criminals frequently betray each other.

krebsonsecurity.com · 12 min

TLDR InfoSec

800+ “POTENTIAL VULNERABILITIES AND BIASES” MAY AFFLICT AI-INFUSED MEDICAL SERVICES

The Chief Digital and Artificial Intelligence Office (CDAO) led an effort in coordination with the Crowdsourced AI Red-Teaming Assurance Program and healthcare agencies to evaluate the usage of LLMs in military medical services. The over 200 participants evaluated three popular LLMs for a clinical note summarization and advisory Chatbot. The effort was concluded with over 800 potential vulnerabilities and biases identified with suggested improvements to reduce the number in future efforts.

defenseone.com · 2 min

TLDR InfoSec

BACKDOORING YOUR BACKDOORS - ANOTHER $20 DOMAIN, MORE GOVERNMENTS

WatchTowr Labs researchers discovered over 4,000 active web backdoors that were hijacked by registering expired domains. The backdoors allowed unauthorized access to high-profile targets like government and university systems. The domains are now managed by The Shadowserver Foundation to prevent misuse by cybercriminals.

labs.watchtowr.com · 13 min

TLDR InfoSec

MAGIC/TRAGIC EMAIL LINKS: DON'T MAKE THEM THE ONLY OPTION

While magic links in emails are being promoted for easier logins, they can be problematic for users with multiple devices and slower connections.

recyclebin.zip · 2 min

TLDR InfoSec

APPLE'S NEW AI FEATURE REWORDS SCAM MESSAGES TO MAKE THEM LOOK MORE LEGIT

Apple's new AI feature is rephrasing scam messages to look more legitimate on iPhones and Macs, potentially leading to more people falling for scams.

crikey.com.au · 3 min

TLDR InfoSec

HOW WE CRACKED A 512-BIT DKIM KEY FOR LESS THAN $8 IN THE CLOUD

Researchers successfully cracked a 512-bit RSA key in the cloud for less than $8, demonstrating the importance of using secure key lengths in email security measures.

dmarcchecker.app · 4 min