The Daily Index — Wednesday, February 5, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ZYXEL WON'T PATCH NEWLY EXPLOITED FLAWS IN END-OF-LIFE ROUTERS

Zyxel has issued a security advisory about actively exploited flaws in CPE series devices that it has no plans to fix. VulnCheck released the full details of two CVEs - one is for insecure default passwords and the other is for improper command validation leading to command injection. According to FOFA and Censys, there are over 1,500 potentially vulnerable devices that are internet exposed.

bleepingcomputer.com · 2 min

TLDR InfoSec

AMD SEV-SNP VULNERABILITY ALLOWS MALICIOUS MICROCODE INJECTION WITH ADMIN ACCESS

A security flaw in AMD's SEV could allow an attacker to inject malicious CPU microcode with admin access. The vulnerability, tracked as CVE-2024-56161, has a high severity score of 7.2 and could lead to loss of confidentiality and integrity in a virtual machine environment. Google researchers discovered the flaw and AMD is working on a fix to address the issue.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

WHAT DOES IT MEAN TO BUILD IN SECURITY FROM THE GROUND UP?

Security has a unique position as a systems requirement. While "building security from the ground up" is a popular way of starting, using established security mechanisms and following best practices might be more practical.

theregister.com · 5 min

TLDR InfoSec

PHISHING FOR REFRESH TOKENS

This article examines an Attacker-in-the-Middle technique for stealing access and refresh tokens from the OAuth 2.0 authorization flow. The attacker first allows the user to go through the initial steps of the OAuth 2.0 flow until a response from the upstream server that has a header containing “nativeclient?code=“ is seen. This code can be used to request access and refresh tokens from the /oauth2/token endpoint.

zolder.io · 6 min

TLDR InfoSec

ANTHROPIC DARES YOU TO JAILBREAK ITS NEW AI MODEL

Anthropic has released Constitutional Classifiers, a new system for preventing AI model jailbreaks. The system uses natural language rules and extensive training data to detect and block prohibited content requests. It has withstood 3,000+ hours of bug bounty testing. Anthropic invites public testing through to February 10.

arstechnica.com · 7 min

TLDR InfoSec

INDEXED FINANCE HACKER CHARGED IN US FOR ALLEGED $65M THEFT

US prosecutors charged Andean Medjedovic, 22, for allegedly hacking Indexed Finance ($16M) in 2021 and KyberSwap ($48M) in 2023. The Canadian math prodigy, who's been a fugitive since 2021, faces fraud, money laundering, and extortion charges.

dlnews.com · 4 min

TLDR InfoSec

REVERSE ENGINEERING CALL OF DUTY ANTI-CHEAT

An in-depth look at the user-mode Treyarch Anti-Cheat (TAC) system used in Call of Duty Black Ops Cold War. The system uses Arxan as an obfuscation/protection tool which includes features such as runtime executable decryption, continuous executable checksum monitoring, Jmp and entry point obfuscation, and pointer encryption. Layered on top of this is TAC, which features various anti-cheat systems like network monitoring, API hook detection, debug register detection, anti-debugging capabilities, visuals detection, and custom syscall encryption, among others, and terminates the process on detection.

ssno.cc · 39 min

TLDR InfoSec

GOOGLE PLAY, APPLE APP STORE APPS CAUGHT STEALING CRYPTO WALLETS

Android and iOS apps from Google Play and Apple App Store have a malicious SDK that steals cryptocurrency wallet recovery phrases using image recognition.

bleepingcomputer.com · 3 min

TLDR InfoSec

EXPLOITATION OF OVER 700 VULNERABILITIES CAME TO LIGHT IN 2024

Over 700 vulnerabilities were publicly reported as exploited for the first time in 2024, a significant increase from the previous year.

securityweek.com · 2 min

TLDR InfoSec

NEW VALLEYRAT MALWARE VARIANT SPREADING VIA FAKE CHROME DOWNLOADS

A new ValleyRAT malware variant is spreading through fake Chrome downloads, targeting high-value individuals in organizations like finance and sales to steal sensitive data.

hackread.com · 2 min