The Daily Index — Thursday, January 16, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

OVER 660K RSYNC SERVERS EXPOSED TO CODE EXECUTION ATTACKS

Google Cloud and other independent security researchers discovered 6 new vulnerabilities in rsync, one of which is critical. When two of the vulnerabilities are chained together, attackers can achieve unauthenticated remote code execution on default installations of rsyncd. BleepingComputer detected 660K exposed rsync servers on Shodan but did not verify if they were vulnerable.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE GREAT GOOGLE ADS HEIST: CRIMINALS RANSACK ADVERTISER ACCOUNTS VIA FAKE GOOGLE ADS

Criminals are tricking Google Ads users with fake ads to steal their account credentials. The scheme involves impersonating Google Ads and leading victims to fraudulent login pages. This malicious operation impacts Google's business and affects numerous customers globally.

malwarebytes.com · 8 min

TLDR InfoSec

OWASP'S NEW LLM TOP 10 SHOWS EMERGING AI THREATS

The article discusses emerging security risks in AI-powered software development, highlighted by OWASP's Top 10 LLM vulnerabilities. Key concerns include prompt injection, supply chain vulnerabilities, sensitive data exposure, and RAG technology risks.

darkreading.com · 6 min

TLDR InfoSec

RELIABLE SYSTEM CALL INTERCEPTION

Traditionally, ptrace is used for system call monitoring, modifying, and faking but this mechanism suffers from being very slow as it requires two traps for each system call. The author presents an alternative mechanism that uses seccomp user notify and BPF filters to replace this functionality. The author notes that this technique suffers from time-of-check to time-of-use attacks and should not be used for security-critical decisions.

blog.mggross.com · 6 min

TLDR InfoSec

DON'T USE SESSION (SIGNAL FORK)

The author advises against using Session due to security vulnerabilities, such as the removal of forward secrecy and misuse of cryptographic keys. Session's encryption practices are criticized for reducing security measures to a mere show, making it less trustworthy compared to other messaging apps. In summary, the author strongly recommends avoiding Session due to significant security flaws.

soatok.blog · 8 min

TLDR InfoSec

ORCHID SECURITY (PRODUCT LAUNCH)

Orchid Security automatically discovers applications and evaluates authentication and authorization flows to pinpoint weak spots and suggest areas for remediation.

orchid.security

TLDR InfoSec

‘GOODBYE TO MY CHINESE SPY' MIGHT BE THE LAST GREAT TIKTOK TREND

The US faces a potential TikTok ban, prompting users to humorously say goodbye to their "personal Chinese spy" - a reference to data privacy concerns. Users are posting videos thanking their "spies" for curating content and monitoring them, preferring TikTok despite security concerns.

theverge.com · 2 min

TLDR InfoSec

2024 CVES IN REVIEW

Analysis of 2024's CVE trends shows decreasing severity scores, with average CVSS dropping from 7.09 to 6.9. Critical and High severity vulnerabilities declined, while total reserved CVEs fell 7%. WordPress-related vulnerabilities increased significantly, though this may indicate improved security maturity rather than declining security.

vulnerability.blog · 8 min

TLDR InfoSec

CISA DIRECTOR SAYS THREAT HUNTERS SPOTTED SALT TYPHOON ON FEDERAL NETWORKS BEFORE TELCO COMPROMISES

CISA's director Jen Easterly mentioned that threat hunters found suspicious activity from Salt Typhoon on federal networks before realizing it was part of a larger Chinese hacking campaign targeting U.S. telecommunications. By identifying and seizing virtual private servers leased by the hackers, CISA gained insight into the extent of the hacking campaign against telecommunications companies and provided assistance to potential victims. The incident highlights the ongoing challenge of defending critical infrastructure from foreign adversaries like China and the need for improved cybersecurity measures in vulnerable sectors like telecommunications.

cyberscoop.com · 3 min

TLDR InfoSec

LAZARUS GROUP TARGETS WEB3 DEVELOPERS WITH FAKE LINKEDIN PROFILES IN OPERATION 99

The Lazarus Group conducted cyber attacks through fake LinkedIn profiles targeting Web3 developers to distribute malware and victims were tricked into cloning malicious GitLab repositories, allowing the attackers to steal sensitive data.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

NICKEL TAPESTRY INFRASTRUCTURE ASSOCIATED WITH CROWDFUNDING SCHEME

CTU researchers found connections between North Korean IT worker schemes and a 2016 crowdfunding scam, linking them to the NICKEL TAPESTRY threat group.

secureworks.com · 3 min

TLDR InfoSec

LEGITIMATE CHROME EXTENSIONS ARE STEALING FACEBOOK PASSWORDS

A recent attack targeted popular Chrome extensions to steal Facebook passwords and other data.

kaspersky.com · 4 min