The Daily Index — Wednesday, January 22, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

7-ZIP FIXES BUG THAT BYPASSES WINDOWS MOTW SECURITY WARNINGS

7-Zip has released a patch for a vulnerability that could allow maliciously crafted archives to bypass Windows MotW protection. Mark of the Web (MotW) is a flag that alerts users and the operating system that a file may have come from an untrusted source and prompts for permission before running. In this vulnerability, 7-Zip failed to propagate the MotW from the archive to the extracted files.

bleepingcomputer.com · 2 min

TLDR InfoSec

WINDOWS BITLOCKER - SCREWED WITHOUT A SCREWDRIVER

This blog post discusses how to exploit a vulnerability in BitLocker-encrypted Windows systems through a bootloader downgrade and Secure Boot bypass. By downgrading the bootloader, attackers can gain full read/write access to the encrypted disk without changing the target system. The exploit highlights the importance of Secure Boot and the potential risks associated with default BitLocker configurations.

neodyme.io · 27 min

TLDR InfoSec

UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

Archive Path Traversal is a vulnerability that can occur when extracting an archive file if the implementation does not properly check that filename sequences don't exit the archive (ex: ../../evil). An intern at Doyensec created a project that provides Semgrep rules as well as a playground with various malicious archive files and vulnerable implementations to demonstrate this vulnerability. The post concludes by discussing path sanitization and path validation as possible mitigations.

blog.doyensec.com · 6 min

TLDR InfoSec

UNIQUE 0-CLICK DEANONYMIZATION ATTACK TARGETING SIGNAL, DISCORD, AND HUNDREDS OF PLATFORMS

An attacker discovered a method to find a person's location within a 250-mile radius through a unique 0-click deanonymization attack on platforms like Signal and Discord. By exploiting Cloudflare caching, the attacker could pinpoint a target's location by causing them to load a resource that gets cached in a local datacenter. While Cloudflare patched the bug, the attack shows how infrastructure designed for performance can be used for tracking, highlighting ongoing risks for users.

gist.github.com · 17 min

TLDR InfoSec

SUMMITING THE PYRAMID: BRING THE PAIN WITH ROBUST AND ACCURATE DETECTION

Summiting the Pyramid introduces a methodology to score analytics for robust detection against adversary behavior, aiming to make it harder for adversaries to hide. The framework helps defenders build accurate and resistant detections using a combination of specificity and exclusion criteria. It also provides guidance on creating robust detections for both host-based and network data.

medium.com · 5 min

TLDR InfoSec

CYBERBRO (WEB APP)

Cyberbro is a user-friendly application for checking the reputation of online observables like IP addresses and URLs. It integrates with multiple services like VirusTotal and Google Safe Browsing to provide detailed reports efficiently. Users can easily deploy Cyberbro using Docker and customize it with API keys from different services.

cyberbro.net

TLDR InfoSec

3 TAKEAWAYS FROM RED TEAMING 100 GENERATIVE AI PRODUCTS

Microsoft founded its AI red team in 2018 to address the growing landscape of AI security and threats. Generative AI systems can be vulnerable to both existing/traditional security vulnerabilities as well as novel ones. Humans will be necessary to augment Generative AI systems with subject matter expertise, emotional intelligence, and cultural context. Both technical and nontechnical, defense-in-depth approaches will be necessary to protect Generative AI systems.

microsoft.com · 6 min

TLDR InfoSec

PRODUCT SECURITY BAD PRACTICES

A list from CISA of product security bad practices for software manufacturers with recommendations on how to fix the issues. The first set of product practices focuses on using memory-unsafe languages, usage of default or hardcoded credentials, usage of dependencies with critical vulnerabilities, and unsafe cryptography. The second set focuses on security practices such as supporting MFA and providing access to logs that would enable intrusion detection. The last set focuses on organizational practices such as having a VDP and publishing CVEs and EoL timelines.

cisa.gov · 10 min

TLDR InfoSec

MALICIOUS EXTENSIONS CIRCUMVENT GOOGLE'S REMOTE CODE BAN

This blog post discusses how malicious extensions found ways to hide their harmful functions in Chrome Web Store, despite Google's restrictions. Several extensions, like Phoenix Invicta and Sweet VPN, were discovered using obfuscated code and accessing sensitive data. Domain names associated with these malicious extensions were identified, hinting at potential spying and fraud activities.

palant.info · 19 min

TLDR InfoSec

CLOUDFLARE MITIGATED A RECORD BREAKING 5.6 TBPS DDOS ATTACK

Last October, Cloudflare mitigated a 5.6Tbps UDP-based DDoS attack from a 13k Mirai botnet that lasted 80 seconds.

bleepingcomputer.com · 2 min

TLDR InfoSec

MICROSOFT TEAMS VISHING ATTACKS TRICK EMPLOYEES INTO HANDING OVER REMOTE ACCESS

Ransomware groups are conducting sophisticated social engineering attacks by bombarding employees with spam emails and then posing as IT support on Microsoft Teams to trick them into granting remote access to their computers.

csoonline.com · 1 min

TLDR InfoSec

REDLINE, VIDAR, AND RACCOON MALWARE STOLE 1 BILLION PASSWORDS IN 2024

Over 1 billion passwords were stolen by malware in the past year, including commonly used weak passwords like "123456."

hackread.com · 2 min