The Daily Index — Wednesday, January 15, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TELEFÓNICA CONFIRMS INTERNAL TICKETING SYSTEM BREACH AFTER DATA LEAK

Telefónica confirmed a security breach of its internal Jira ticketing system. Attackers using the aliases DNA, Grep, Pryx, and Rey accessed the system using compromised employee credentials and leaked approximately 2.3 GB of data on a hacking forum.

bleepingcomputer.com · 3 min

TLDR InfoSec

COMPOUND PROBABILITY: YOU DON'T NEED 100% COVERAGE TO WIN

Compound probability is a concept in which the probability of two independent events occurring is the product of the probability of each event occurring. It explains how increasing attack surface coverage can significantly reduce an attacker's probability of evading detection. The article acknowledges some oversimplifications, particularly around EDR.

medium.com · 6 min

TLDR InfoSec

PASSWORD SPRAYING WITH SELENIUM AND FIREPROX

Password spraying attempts can often be hindered by IP based rate limiting. To circumvent this issue, this post walks through the setup of a dynamic proxy using Fireprox as well as Burp Suite Bambdas to modify the request to bypass CSP headers and other rate limiting. The post then concludes by showcasing how Selenium can be combined with the created proxy and crafted request to automate login attempts to achieve a password spraying attack.

benkofman.com · 8 min

TLDR InfoSec

RANSOMWARE ON ESXI: THE MECHANIZATION OF VIRTUALIZED ATTACKS

Ransomware attacks on VMware ESXi servers surged in 2024, with demands reaching $5 million and exposure of 8,000 hosts to the internet. Attackers targeted ESXi architecture through vCenter to gain control and disrupt operations. Strategies like updates, MFA, detection tools, and network segmentation are crucial in mitigating ransomware risks on ESXi.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

SHIFT (PRODUCT LAUNCH)

Shift is a new paid Caido plugin that adds Copilot-like AI functionality to Caido.

josephthacker.com

TLDR InfoSec

CRACKING THE CODE: HOW BANSHEE STEALER TARGETS MACOS USERS

Banshee Stealer is a macOS malware that first gained attention as a stealer-as-a-service in mid-2024. Its source code leaked in November 2024. Banshee steals system data, utilizes convincing pop-ups to convince users into entering their passwords, employs advanced evasion techniques, and exfiltrates data. The Banshee Stealer is a testament to the sophistication of modern macOS malware.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

HOW BARCELONA BECAME AN UNLIKELY HUB FOR SPYWARE STARTUPS

Barcelona has emerged as a hub for spyware companies, including Palm Beach Networks (now Head and Tail), Paradigm Shift, and Epsilon. Companies are attracted by the city's lifestyle, lower costs, and easier spyware export regulations compared to Israel. Critics warn this development could fuel Europe's surveillance tech concerns.

techcrunch.com · 8 min

TLDR InfoSec

MINISTERS CONSIDER BAN ON ALL UK PUBLIC BODIES MAKING RANSOMWARE PAYMENTS

The UK government plans to ban schools, NHS, councils, and critical infrastructure operators from making ransomware payments. Private companies must report intended payouts, which could be blocked if going to sanctioned groups. The measure aims to deter hackers, who collected $1.1bn globally in 2023.

theguardian.com · 4 min

TLDR InfoSec

MILLIONS OF OPENSEA USER EMAILS LEAKED IN 2022 NOW FULLY PUBLIC

7M emails obtained in a breach at OpenSea in 2022 have now been published.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

JANUARY WINDOWS UPDATES MAY FAIL IF CITRIX SRA IS INSTALLED

Microsoft warns that January 2025 Windows updates may fail if Citrix SRA version 2411 is installed.

bleepingcomputer.com · 2 min

TLDR InfoSec

159-CVE JANUARY PATCH TUESDAY SMASHES SINGLE-MONTH RECORD

The January Patch Tuesday set a record with 159 CVEs, including 3 publicly disclosed and 3 exploited vulnerabilities, with critical impacts like Remote Code Execution.

news.sophos.com · 22 min