The Daily Index — Monday, January 20, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

PYTHON-BASED BOTS EXPLOITING PHP SERVERS FUEL GAMBLING PLATFORM PROLIFERATION

Cybersecurity researchers have uncovered a campaign targeting PHP servers to promote gambling sites in Indonesia using Python-based bots. The attacks involve the deployment of GSocket to exploit web shells on servers running popular platforms like Moodle. Site owners have been advised to update plugins, block rogue domains, and remove suspicious accounts to defend against the malware.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

MALICIOUS PYPI PACKAGE STEALS DISCORD AUTH TOKENS FROM DEVS

A malicious PyPi package is attempting to squat the official Discord Python library. The malicious package steals Discord auth tokens and relays them to an external server as well as setting up a backdoor on port 6969. The package is reportedly still available and was published by a verified publisher account.

bleepingcomputer.com · 3 min

TLDR InfoSec

FINDING SSRFS IN AZURE DEVOPS

Binary Security has identified three SSRF vulnerabilities in Azure DevOps: an endpoint proxy vulnerability, a DNS rebinding bypass, and a hooks SSRF with CRLF injection.

binarysecurity.no · 14 min

TLDR InfoSec

USING REKOR-MONITOR TO SCAN YOUR TRANSPARENCY LOGS

Sigstore's Rekor provides a signature transparency log and Fulcio provides a certificate transparency which can be used to enhance auditability and discoverability of artifact metadata and code signing. Rekor-monitor can be utilized for checking the consistency of transparency logs or monitoring for compromised accounts. A demo is included in the post.

blog.sigstore.dev · 5 min

TLDR InfoSec

BYPASSING DISK ENCRYPTION ON SYSTEMS WITH AUTOMATIC TPM2 UNLOCK

There is a significant security vulnerability in TPM2-based disk encryption systems where an attacker with brief physical access can bypass disk encryption on machines using systemd-cryptenroll or clevis without a PIN. The vulnerability exists because most TPM2 unlock setups fail to verify the LUKS identity of the decrypted partition, allowing attackers to create a malicious partition that can extract the original encryption key while maintaining the TPM state. This post demonstrates successful attacks on both Fedora and NixOS systems. It recommends either using a TPM PIN or implementing proper PCR 15 verification as mitigation strategies, though it notes that the latter is not easily available on most distributions.

oddlama.org · 23 min

TLDR InfoSec

BIDEN SIGNS SWEEPING CYBERSECURITY ORDER, JUST IN TIME FOR TRUMP TO GUT IT

President Biden issued a broad cybersecurity executive order in his final days that covers federal network security, software supply chain protection, and AI security measures. Though comprehensive, critics note that the timing, near Trump's presidency, makes implementation uncertain, as many deadlines extend into the new administration.

theregister.com · 6 min

TLDR InfoSec

SECURITY THROUGH TRANSPARENCY: RP2350 HACKING CHALLENGE RESULTS ARE IN

Raspberry Pi's RP2350 microcontroller was subjected to security testing for a $20,000 prize challenge. Four teams discovered vulnerabilities requiring physical access, including power glitching, laser injection, and antifuse memory extraction techniques. Raspberry Pi openly acknowledged these findings, planning fixes in future versions while maintaining its "security through transparency" approach.

links.tldrnewsletter.com · 10 min

TLDR InfoSec

TIKTOK, ALIEXPRESS, SHEIN & CO SURRENDER EUROPEANS' DATA TO AUTHORITARIAN CHINA

Privacy group noyb has filed GDPR complaints against six Chinese tech companies (TikTok, AliExpress, SHEIN, Temu, WeChat, and Xiaomi) for unlawfully transferring European users' data to China. Given China's surveillance practices, noyb argues these transfers violate EU data protection laws and requests immediate suspension and fines.

noyb.eu · 3 min

TLDR InfoSec

AWS LAUNCHES FREE COURSE: SECURING GENERATIVE AI ON AWS

AWS has added a new course on securing generative AI workloads to its Skill Builder catalog.

aws.amazon.com · 1 min

TLDR InfoSec

OSV: THE YEAR IN REVIEW

OSV saw significant growth in ecosystem support in 2024, especially with Linux distributions like Ubuntu and Red Hat adopting the OSV Schema.

osv.dev · 3 min

TLDR InfoSec

SECURING A CITY-SIZED EVENT: HOW AMAZON INTEGRATES PHYSICAL AND LOGICAL SECURITY AT RE:INVENT

Amazon discusses how it combines physical and logical security measures to protect attendees and data at events like re:Invent in Las Vegas.

aws.amazon.com · 4 min