The Daily Index — Tuesday, February 4, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS USE FAKE WEDDING INVITATIONS TO SPREAD ANDROID MALWARE IN SOUTHEAST ASIA

A malware campaign was spotted targeting Android users in Malaysia and Brunei with fake wedding invitations that prompt users to download an app to view the invitation. The malware is an infostealer that harvests sensitive data from messaging apps, email, and call logs. It utilizes compromised WhatsApp and Telegram accounts to spread further.

therecord.media · 2 min

TLDR InfoSec

GOOGLE FIXES ANDROID KERNEL ZERO-DAY EXPLOITED IN ATTACKS

Google patched 48 vulnerabilities in February's Android security releases, including a new kernel zero-day under active exploitation. The kernel vulnerability was a privilege escalation vulnerability in the USB Video Class driver that could allow local, authenticated attackers to escalate privileges. The updates also include a fix for a critical vulnerability in Qualcomm's WLAN component.

bleepingcomputer.com · 2 min

TLDR InfoSec

STEALING SECONDS: WEB SKIMMER COMPROMISES CASIO UK AND GROWING NUMBER OF WEBSITES

This post dives into web skimmers and how they were used in a web skimming campaign affecting 17+ websites. The skimmer used a unique approach, operating on all pages except checkout and presenting a fake payment form when users clicked the checkout button from their cart.

jscrambler.com · 10 min

TLDR InfoSec

SAFEGUARDING YOUR DATA WHEN USING DEEPSEEK R1 IN RAG PIPELINES

This post describes the RAG process and where authorization fits in. SpiceDB can be used to apply Relationship-Based Access Control (ReBAC), which can be used to create pre or post query filters to the pipeline. The second part of the series contains a step-by-step guide for implementing this authorization scheme using Langchain.

dev.to · 6 min

TLDR InfoSec

OPA GATEKEEPER BYPASS REVEALS RISKS IN KUBERNETES POLICY ENGINES

Gatekeeper enforces security policies in Kubernetes by using Constraints and ConstraintTemplates to control cluster access and prevent unauthorized actions. Administrators can define custom policies or use pre-built templates to enhance cluster security by leveraging Gatekeeper. However, misconfigurations in policy logic, such as omitting trailing slashes in Constraint values, can introduce security risks and allow for policy bypasses.

aquasec.com · 7 min

TLDR InfoSec

CONIFERS.AI (PRODUCT LAUNCH)

Conifers.ai maps incidents to a relevant security use case and uses pre-trained underlying agents and models to handle the complexities of security operations incidents.

conifers.ai

TLDR InfoSec

OWASP NON-HUMAN IDENTITIES TOP 10: FORGING A NEW STANDARD IN CLOUD SECURITY

The OWASP recently launched a new project called the OWASP Non-Human Identities Top 10 to categorize the most common vulnerabilities affecting non-human identities. This post includes an overview of each vulnerability class as well as additional insights from the Orca Research Pod. It concludes with recommendations on how to prevent these vulnerabilities, such as using JIT provisioning, rotating secrets, and mapping third-party integrations.

links.tldrnewsletter.com · 11 min

TLDR InfoSec

AWS DATASYNC ADDS SUPPORT FOR KERBEROS AUTHENTICATION

AWS has added support to DataSync SMB locations for Kerberos authentication. DataSync is used for syncing data between AWS services, on-prem networks, or multiple clouds using SMB. Previously, only NTLM authentication was available.

aws.amazon.com · 1 min

TLDR InfoSec

2024 TRENDS IN VULNERABILITY EXPLOITATION

768 vulnerabilities were reported as exploited in the wild in 2024, up from 639 CVEs in 2023, registering a 20% increase year-over-year.

vulncheck.com · 6 min

TLDR InfoSec

ALPINE LINUX SEEKING SUPPORT AFTER EQUINIX METAL SUNSETS

Alpine Linux is seeking infrastructure support for the project since its previous provider is sunsetting their bare metal hosting service.

alpinelinux.org · 2 min

TLDR InfoSec

HACKERS HIDE MALWARE IN FAKE DEEPSEEK PYPI PACKAGES

Researchers discovered malicious malware hidden in fake DeepSeek PyPI packages targeting developers and AI enthusiasts stealing sensitive data from users' systems.

hackread.com · 2 min