The Daily Index — Friday, February 14, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

HACKER LEAKS ACCOUNT DATA OF 12 MILLION ZACKS INVESTMENT USERS

In what could be the third major data breach in four years, Zacks Investment has been breached again. Have I Been Pwned (HIBP) verified 12 million unique email accounts in the leak. However, HIBP also notes that roughly 93% of the leaked email addresses were already in its database from past breaches of the same platform or other services.

bleepingcomputer.com · 2 min

TLDR InfoSec

ASTAROTH PHISHING KIT BYPASSES 2FA TO HIJACK GMAIL AND MICROSOFT ACCOUNTS

A new phishing kit called Astaroth can bypass two-factor authentication to steal login credentials from Gmail, Yahoo, and Microsoft accounts. Astaroth utilizes an evilnginx-style proxy to Man In The Middle user sessions to intercept authentication data, making it difficult for users to detect the attack. The sophisticated kit is sold on cybercrime networks for $2,000 and includes custom hosting options to evade detection.

hackread.com · 3 min

TLDR InfoSec

DETECTION ENGINEERING AT SCALE: ONE STEP CLOSER

Part two of a series describing how Sekoia develops detection rules using Sigma to identify TTPs. Sekoia implements the Alerting and Detection Strategy Framework which focuses heavily on testing and documentation. Sekoia augments their automated documentation with comprehensive testing that tests syntax, test coverage, and both production and pre-production regression testing.

blog.sekoia.io · 9 min

TLDR InfoSec

WHOAMI: A CLOUD IMAGE NAME CONFUSION ATTACK

Researchers discovered a "whoAMI" vulnerability where attackers could exploit AWS accounts by publishing malicious AMIs with specific names, targeting systems that don't specify owner verification when searching for AMIs. This post dives into this new attack.

securitylabs.datadoghq.com · 15 min

TLDR InfoSec

HOW SECURITY TEAMS FAIL

Michal Zalewski discusses common pitfalls in corporate security teams, from their origins to cultural challenges and eventual breaches. Security teams often start reactively, leading keener senses on security challenges which often morph into a sense of superiority and disconnect from other departments. The cycle usually ends with a major breach that prompts a reevaluation of the team's strategy and communication.

lcamtuf.substack.com · 4 min

TLDR InfoSec

JSCRAMBLER (PRODUCT LAUNCH)

JScrambler can prevent web supply chain attacks by monitoring script execution, preventing vulnerability exploitation, detecting modifications in third-party resources, and detecting anomalous behavior.

jscrambler.com

TLDR InfoSec

MASSIVE BRUTE FORCE ATTACK USES 2.8 MILLION IPS TO TARGET VPN DEVICES

The Shadowserver Foundation is warning of a massive password-spraying attack targeting a wide range of networking devices. The attackers are using a botnet composed of almost 2.8 million source IP addresses. The compromised devices seem to be largely edge network devices.

bleepingcomputer.com · 2 min

TLDR InfoSec

TRUMP'S CYBER CHIEF PICK HAS LITTLE EXPERIENCE IN THE CYBER

Trump reportedly plans to nominate Sean Cairncross as National Cyber Director, despite his lack of cybersecurity experience. Cairncross, a lawyer, would replace Harry Coker, who had decades of CIA and NSA experience.

theregister.com · 4 min

TLDR InfoSec

FEDS WANT DEVS TO STOP CODING “UNFORGIVABLE” BUFFER OVERFLOW VULNERABILITIES

Citing half a dozen CVEs, CISA and the FBI have released a scathing critique of manufacturers writing memory-unsafe code. They have urged organizations to adopt memory-safe languages such as Go, Rust, and Swift. Acknowledging that full rewrites are difficult, they have urged organizations to make plans for a phased transition and utilize memory safety flags and testing.

theregister.com · 2 min

TLDR InfoSec

BARCELONA-BASED SPYWARE STARTUP VARISTON SHUTS DOWN, PER FILING

Variston finally shut down as it started crumbling after Google exposed its secretive operations in 2022.

techcrunch.com · 2 min

TLDR InfoSec

SALT TYPHOON REMAINS ACTIVE, HITS MORE TELECOM NETWORKS VIA CISCO ROUTERS

According to a report by Recorded Future, Salt Typhoon, a Chinese threat group, continues to target global telecom networks using Cisco routers.

cyberscoop.com · 3 min

TLDR InfoSec

SCARLETT JOHANSSON WARNS OF “1000-FOOT AI WAVE” FOLLOWING VIRAL DEEPFAKE

Following a viral AI-generated post, Scarlett Johansson warns about the dangers of AI being used to create non-consensual content and urges legislators to take action to regulate AI use.

links.tldrnewsletter.com · 2 min