The Daily Index — Wednesday, February 19, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

VENTURE CAPITAL GIANT INSIGHT PARTNERS HIT BY CYBERATTACK

Insight Partners revealed that they were breached in January following a social engineering attack. Insight has stated that they shut down the attacker's presence in their network immediately after detecting their intrusion and has no evidence that any portfolio companies, funds, or other stakeholders were impacted by this breach.

bleepingcomputer.com · 2 min

TLDR InfoSec

JUNIPER NETWORKS FIXED A CRITICAL FLAW IN SESSION SMART ROUTERS

Juniper Networks fixed a critical authentication bypass vulnerability, tracked as CVE-2025-21589 (CVSS score of 9.8), in its Session Smart Router. The flaw could allow attackers to take control of the device without proper authentication. Users are advised to upgrade to the fixed versions listed on the site to protect against potential attacks.

securityaffairs.com · 2 min

TLDR InfoSec

MAGENTO CREDIT CARD STEALER DISGUISED IN AN `IMG` TAG

Magecart is a credit card skimming malware that is sophisticated and hard to detect as it hides in `img` tags using Base64 encoding. It can seamlessly inject fake payment forms to steal card details, requiring vigilant security measures and monitoring.

blog.sucuri.net · 10 min

TLDR InfoSec

REVOLUTIONIZING SOFTWARE TESTING: INTRODUCING LLM-POWERED BUG CATCHERS

Mutation testing is the process by which automatic test cases are programmatically created based on existing test cases to increase code coverage. Meta created the Automated Compliance Hardening (ACH) system to use LLMs to generate mutants to model realistic inputs. A developer uses ACH by describing the types of bugs that they're concerned about, ACH then generates a series of bugs and converts them into tests to run.

engineering.fb.com · 6 min

TLDR InfoSec

HOW ADVERSARIES EXPLOIT UNMONITORED CLOUD REGIONS TO EVADE DETECTION

Attackers commonly exploit unused regions in cloud providers to launch crypto miners, exfiltrate data, or deploy other payloads. This post explores the various methods and permissions that attackers can utilize in AWS, GCP, and Azure to enumerate or enable unused regions. This post also provides recommended mitigations such as restricting region usage, setting budget alerts, and conducting regular audits.

permiso.io · 7 min

TLDR InfoSec

MIRRORTAB (PRODUCT LAUNCH)

MirrorTab intercepts and sanitizes a browser session before it ever reaches the customer's device eliminating the traditional client-side attack surface by preventing raw code or sensitive data from being exposed in the user's environment.

mirrortab.com

TLDR InfoSec

COMMON OAUTH VULNERABILITIES

This blog provides an overview of how OAuth 2 works with a focus on outlining the different parties involved in a request. It outlines the common flows that are used in OAuth applications such as Implicit Flows, Authorization Code Flows, Client Credentials, Device Authorization Flows, and Resource Owner Password Credentials Flows. The post then provides common attacks and mitigations against these flows.

blog.doyensec.com · 12 min

TLDR InfoSec

UNDERSTANDING SAFETENSORS: A SECURE ALTERNATIVE TO PICKLE FOR ML MODELS

Python Pickles are a binary format that is commonly used to distribute ML models but is inherently insecure because arbitrary code can be executed during deserialization. SafeTensors is a format that was created to solve this issue by only storing metadata and numerical tensors. SafeTensors binaries should always be preferred over Pickles when available as in addition to the security benefits, they can also be more performant.

dev.to · 4 min

TLDR InfoSec

$10 INFOSTEALERS ARE BREACHING CRITICAL US SECURITY: MILITARY AND EVEN THE FBI HIT

The article talks about how relatively inexpensive infostealer malware, like boobytrapped PDFs, game mods, and pirated software, are leading to compromises across the board, even in critical US organizations like the Pentagon and the FBI. According to Hudson Rock's report, over 30 million computers worldwide have been hit, with one in five holding corporate credentials. The article includes a case study on Honeywell and the US Navy and discusses the importance of vigilance and training staff.

hackread.com · 3 min

TLDR InfoSec

MICROSOFT THREAT INTELLIGENCE - NEW XCSSET VARIANT

The first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies.

threadreaderapp.com · 2 min

TLDR InfoSec

CHINA-LINKED APT GROUP WINNTI TARGETS JAPANESE ORGANIZATIONS SINCE MARCH 2024

Researchers from cybersecurity firm LAC have uncovered that a China-linked APT group called Winnti carried out a cyberespionage campaign that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024.

securityaffairs.com · 3 min

TLDR InfoSec

X NOW BLOCKS SIGNAL CONTACT LINKS, FLAGS THEM AS MALICIOUS

Social media platform X is now blocking Signal.me links, used by the Signal encrypted messaging app to share account info, citing spam or malware risks.

bleepingcomputer.com · 2 min