The Daily Index — Wednesday, February 12, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CROOKS USE GOOGLE TAG MANAGER SKIMMER TO STEAL CREDIT CARD DATA FROM A MAGENTO-BASED E-STORES

Threat actors are using Google Tag Manager (GTM) to install credit card skimmer malware on Magento-based e-stores, according to Sucuri researchers. The malware hides in a website's database and steals credit card information entered during the checkout process, sending it to the attackers' server. This sophisticated attack demonstrates how criminals are using legitimate platforms like GTM to deploy malicious code that is difficult to detect.

securityaffairs.com · 2 min

TLDR InfoSec

NEW HACK USES PROMPT INJECTION TO CORRUPT GEMINI LONG-TERM MEMORY

Many of the major LLMs have protections against basic prompt injection however researcher Johann Rehberger unveiled a new indirect prompt injection technique that utilizes delayed tool injection. In Rehberger's attack, Gemini is instructed to download and summarize a website, the summary that Gemini creates includes a covert request to take specific actions if the user responds with specific trigger words, once the user replies with the trigger word the instruction is saved to Gemini's long term memory. Google has responded that it will not fix the issue.

arstechnica.com · 5 min

TLDR InfoSec

BUILD YOUR OWN OFFENSIVE SECURITY LAB A STEP-BY-STEP GUIDE WITH LUDUS

This is a guide for building a red team security lab using Ludus, which simplifies creating Active Directory environments with XDR/SIEM integration. Ludus' key advantages are its template system and YAML configuration for easy customization and sharing.

xphantom.nl · 17 min

TLDR InfoSec

SECURE SANITIZATION AND DISPOSAL OF STORAGE MEDIA

Guidance from the UK's NCSC on how to properly sanitize or dispose of storage media for non-classified data. For devices that can be sanitized, if the device is encrypted (such as with FileVault or BitLocker) disposing of the cryptographic keys may be sufficient whereas devices that are unencrypted should be overwritten with a fixed value and then have the value read back after reboot. For devices that cannot be sanitized, they should be physically destroyed to pieces of a size smaller than 6nm.

ncsc.gov.uk · 5 min

TLDR InfoSec

LEVELDB WAL LOG - EXTRACTING CHATGPT CONVERSATIONS

The ChatGPT desktop app makes use of LevelDB's write ahead log (WAL) to temporarily cache conversation history. This article examines and dissects the binary structure of the WAL file. The author uses the insights that they gained while researching this to create a generic parser for ChatGPT WAL files.

ilyakobzar.com · 7 min

TLDR InfoSec

7AI (PRODUCT LAUNCH)

7ai provides autonomous ‘swarming agents' that can categorize threat alerts and then dispatches the appropriate agents that are capable of investigating the threat using data from multiple sources within the enterprise environment.

7ai.com

TLDR InfoSec

APPLE AND GOOGLE TAKE DOWN MALICIOUS MOBILE APPS FROM THEIR APP STORES

Apple and Google removed 20 apps containing SparkCat malware discovered by Kaspersky researchers. The malware, active since March 2024, used OCR to scan for cryptocurrency wallet recovery phrases and personal data throughout the phone.

techcrunch.com · 2 min

TLDR InfoSec

GOOGLE WILL NOW AUTOMATICALLY REVOKE PERMISSIONS FROM HARMFUL ANDROID APPS

Google's Play Protect will now automatically revoke permissions from apps that it detects to be potentially malicious. Users will be able to re-enable the permissions but will need to acknowledge an additional warning. This is part of Google's push to increase Play Protect's capabilities along with capabilities to automatically block known malicious apps.

theverge.com · 2 min

TLDR InfoSec

AWS IAM IDENTITY CENTER NOW OFFERS IMPROVED ERROR MESSAGES AND AWS CLOUDTRAIL LOGGING

AWS has updated AWS Identity Center to now emit logs to CloudTrail for provisioning errors to aid in troubleshooting. Users can also build automated monitoring and auditing for these log messages.

aws.amazon.com · 1 min

TLDR InfoSec

FEBRUARY PATCH TUESDAY DELIVERS 57 PACKAGES

After January's deluge of patches, February's Patch Tuesday included 57 updates addressing various vulnerabilities in Microsoft products with two critical Windows issues were actively exploited, with additional vulnerabilities expected to be targeted in the next 30 days.

news.sophos.com · 12 min

TLDR InfoSec

OPENAI WAS NOT BREACHED, SAY RESEARCHERS

Threat intelligence firm that investigated claims of millions of breached OpenAI accounts has concluded that these accounts came from existing infostealer malware logs rather than a direct breach.

infosecurity-magazine.com · 2 min

TLDR InfoSec

GCORE DDOS RADAR REVEALS 56% YOY INCREASE IN DDOS ATTACKS

Gcore's latest report shows a 56% increase in DDoS attacks, with the largest hitting 2 Tbps with as well as financial services saw a 117% rise in attacks.

links.tldrnewsletter.com · 4 min