The Daily Index — Tuesday, February 18, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TELEGRAM ABUSED AS C2 CHANNEL FOR NEW GOLANG BACKDOOR

Researchers at Netskope have discovered a Golang-based malware, likely Russian in origin, that uses Telegram API as a Command and Control Mechanism. It uses the "C:\Windows\Temp\svchost.exe" location to save the binary and listens to commands in a Telegram Channel. This blog post includes the IOCs in a GitHub repository as well as screenshots of decompiled code of the malware.

netskope.com · 2 min

TLDR InfoSec

FINASTRA ANNOUNCES DATA BREACH FOLLOWING DISCOVERY OF NOVEMBER 2024 CYBERATTACK

Finastra reported a data breach after discovering unauthorized access in November 2024 to consumer information, including names and financial details. They are sending out notification letters to those affected by the security incident. The article suggests seeking legal guidance to protect anyone receiving notification letters and for anyone impacted to understand options following the breach.

jdsupra.com · 2 min

TLDR InfoSec

HOW TO APPLY ENCRYPTION TECHNIQUES TO BOLSTER DATA LOSS PREVENTION

In 2024, data breaches cost businesses an average of $4.88 million globally. Data encryption has become increasingly vital and reliable, especially with growing interconnected systems and data transfers. It provides essential protection by encoding information, making it accessible only with the correct decryption key.

ironhack.com · 8 min

TLDR InfoSec

🚨 AWS & EXPOSED CREDENTIALS: THE MISTAKE THAT CAN RUIN YOU (AND HOW TO AVOID IT — I GOT YOU!)

Poor credential management causes 70% of cloud data breaches. Beyond passwords, companies must protect API keys, SSL certificates, authentication tokens, and federated identities. This article notes various actions one can take if credentials are compromised.

medium.com · 5 min

TLDR InfoSec

HOW TO BYPASS GITHUB'S BRANCH PROTECTION

Mercari presents 7 scenarios in which an attacker with write permissions to a branch protected GitHub repository can bypass those protections to merge malicious code without a review. For each of the first six methods mentioned, Mercari also presents a technical control to prevent the attack. However, the final scenario, which involves the attacker adding a commit to a PR that another user created using GitHub Actions and approving it, does not have a comprehensive defense mechanism built into GitHub.

engineering.mercari.com · 5 min

TLDR InfoSec

SOUTH KOREA BLOCKS DOWNLOADS OF DEEPSEEK FROM LOCAL APP STORES

South Korea has temporarily restricted downloads of Chinese AI company DeepSeek's app over data privacy concerns, specifically its transfer of user data to ByteDance. While existing users can continue using the service, they're advised against sharing personal information until DeepSeek complies with Korean privacy laws.

techcrunch.com · 2 min

TLDR InfoSec

INVESTIGATING KERNEL MODE SHADOW STACKS ON WINDOWS

Shadow stacks are a security feature that Intel CET implements to defend against ROP attacks by shadowing and comparing the current stack against a protected, read-only copy. The “Secure Kernel” is a Windows feature that allows the kernel to run in a virtualized form by a protected Secure Kernel. This post utilizes the SourcePoint debugger to perform a novel dynamic analysis of the Windows Secure Kernel.

connormcgarr.github.io · 49 min

TLDR InfoSec

CHASE WILL SOON BLOCK ZELLE PAYMENTS TO SELLERS ON SOCIAL MEDIA

Chase has announced that they will begin to delay, decline, or block Zelle payments to contacts that likely originated from social media contacts. When payments are set up, Chase may request additional information such as the purpose of the payment to make this decision. This move is likely prompted by the CFPB lawsuit against Zelle as well as fraud statistics from Chase.

bleepingcomputer.com · 2 min

TLDR InfoSec

AI HONEYPOT DEMO (WEBAPP)

Demo of an SSH honeypot with artificial intelligence which features a terminal that simulates an Ubuntu environment, allowing you to explore and test Linux commands.

trapster.cloud

TLDR InfoSec

MICROSOFT TO REMOVE THE LOCATION HISTORY FEATURE IN WINDOWS

Microsoft is removing the Location History feature from Windows, which allowed Cortana to access device history.

bleepingcomputer.com · 2 min

TLDR InfoSec

PRO-RUSSIA COLLECTIVE NONAME057(16) LAUNCHED A NEW WAVE OF DDOS ATTACKS ON ITALIAN SITES

The pro-Russia group NoName057(16) launched DDoS attacks on Italian airports, banks, and ports in response to President Mattarella's remarks comparing Russia to the Third Reich.

securityaffairs.com · 3 min