The Daily Index — Friday, February 7, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

GO MODULE MIRROR SERVED BACKDOOR TO DEVS FOR 3+ YEARS

Researchers from Socket discovered that Go Module Mirror had been hosting a malicious Go package for over three years. Go Module Mirror is a caching service that Google runs to cache modules for quicker downloads when building Go programs. The attackers typosquatted an archived Go package, published a version with a backdoor embedded, and then changed their repo back to look like the benign module.

arstechnica.com · 2 min

TLDR InfoSec

EXPERTS FLAG SECURITY, PRIVACY RISKS IN DEEPSEEK AI APP

Brian Krebs reports that experts from NowSecure have raised security and privacy concerns about the DeepSeek AI app from China. He notes that the app sends a lot of user data in unencrypted form and device information to Chinese companies, posing risks. The author also urges organizations to remove the DeepSeek iOS app due to security threats identified by NowSecure.

krebsonsecurity.com · 4 min

TLDR InfoSec

REPLACING A SPACE HEATER FIRMWARE OVER WIFI

A security team discovered a vulnerability in a Govee smart space heater allowing complete firmware control through a man-in-the-middle attack on local networks. After extended disclosure discussions with Govee in early 2024, the product was recalled as the flaw could enable malicious control of device operations.

blog.includesecurity.com · 7 min

TLDR InfoSec

SCATTERBRAIN: UNMASKING THE SHADOW OF POISONPLUG'S OBFUSCATOR

Since 2022, Google Threat Intelligence Group (GTIG) has been tracking a group of malware samples that use the PoisonPlug moniker and employ a complex obfuscator. The ScatterBrain obfuscator operates in three different protection modes which determine to what extent it obfuscates the control flow graph, mutates instructions, and protects the binary's import table. The post walks through how GTIG reverse engineered this obfuscator and created a deobfuscator tool.

cloud.google.com · 15 min

TLDR InfoSec

A NETWORK THREAT HUNTER'S GUIDE TO C2 OVER QUIC

QUIC is a newer network communication protocol that abbreviates the typical TCP 3-way handshake as well as adding other features such as a Communication ID for persistent connections. This post introduces the QUIC protocol and then sets up a lab environment to analyze the Merlin QUIC-based C2 with different sets of delays. The post finds that the Merlin C2 can be detected by RITA with any delay, alternatively, Zeek logs can be examined for unusually persistent QUIC connections, and finally, the post also noted a unique QUIC handshake that is only exhibited by Merlin.

activecountermeasures.com · 8 min

TLDR InfoSec

ASTRA (PRODUCT LAUNCH)

Astra is a DAST (Dynamic Application Security Testing) and Pentest scanning engine that incorporates more than 10,000 security tests to hunt for over 13,000 vulnerabilities.

links.tldrnewsletter.com

TLDR InfoSec

LOLC2 (WEB APP)

LOLC2 is a collection of C2 (Command and Control) frameworks that utilize legitimate services to evade detection.

lolc2.github.io

TLDR InfoSec

GHIDRA 11.3 RELEASED: NEW FEATURES, PERFORMANCE IMPROVEMENTS, BUG FIXES

Ghidra 11.3 has been released by the NSA. It introduces tools like a Visual Studio Code integration and a PyGhidra Python library for easier access to the Ghidra API. The update also includes improvements to the Function Graph, debugger infrastructure, source code mapping, processor support, and string translation capabilities.

helpnetsecurity.com · 3 min

TLDR InfoSec

7-ZIP 0-DAY WAS EXPLOITED IN RUSSIA'S ONGOING INVASION OF UKRAINE

Russia exploited a zero-day vulnerability in 7-Zip that bypassed Windows' Mark of the Web (MotW) security feature. The flaw, tracked as CVE-2025-0411, allowed malware hiding in nested archives to evade detection when targeting Ukrainian agencies.

arstechnica.com · 3 min

TLDR InfoSec

NEW TARGET OF PARAGON SPYWARE COMES FORWARD

WhatsApp revealed that Italian activists and journalists critical of Italian PM Meloni's government were targeted by Paragon spyware. This raises questions about the Italian government's involvement. Paragon claims it only sells to democratic nations.

techcrunch.com · 5 min

TLDR InfoSec

ANNOUNCING THE ELASTIC BOUNTY PROGRAM FOR BEHAVIOR RULE PROTECTIONS

Elastic has expanded the scope of its bug bounty program to include Elastic Security detection rulesets. Under the new scope, Elastic will offer bug bounties for submissions that evade detection by Elastic Security's rules with a particular focus on not requiring elevated privileges. At present, the scope of the expansion is limited to Windows Behavior Alerts.

elastic.co · 9 min

TLDR InfoSec

SECURITY CONSIDERATIONS FOR EDGE DEVICES (ITSM.80.101)

The Five Eyes countries have issued a joint guidance for device manufacturers to secure their edge products against increasingly frequent malicious attacks.

cyber.gc.ca · 7 min

TLDR InfoSec

THE GLOBAL INFOSEC/CYBERSECURITY SALARY INDEX FOR 2025 💰📊

The site lists salaries of different roles in infosec across the world as well as salary trends.

isecjobs.com · 3 min

TLDR InfoSec

S. KOREA'S NOTORIOUS SEX CRIME HUB YA-MOON HACKED, USER DATA LEAKED

A hacker named "Valerie" breached South Korea's notorious Ya-moon website, leaking user data including personal information and illegal activity logs.

hackread.com · 3 min