The Daily Index — Monday, February 24, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

SPYLEND ANDROID MALWARE DOWNLOADED 100K TIMES FROM GOOGLE PLAY

SpyLend is a malicious app masquerading as a finance app called Finance Simplified on the Google Play store. The app evaded detection by running a WebView which instructed users to download an APK for a loan app if the user was in India. It collected a large amount of data and used it to extort users to accept high interest rate loans.

bleepingcomputer.com · 2 min

TLDR InfoSec

FAKE CS2 TOURNAMENT STREAMS USED TO STEAL CRYPTO, STEAM ACCOUNTS

Threat actors have been abusing major Counter Strike 2 tournaments to steal Steam accounts and crypto via stream jacking. They are impersonating professional CS2 players on live streams and promoting fake skin and cryptocurrency giveaways. The attackers use hacked YouTube accounts with looped footage of past streams to trick viewers to scan QR codes or send them crypto.

bleepingcomputer.com · 2 min

TLDR InfoSec

48 MINUTES: HOW FAST PHISHING ATTACKS EXPLOIT WEAKNESSES

A manufacturing company suffered a sophisticated cyberattack where threat actors used a spam email flood as a decoy to contact employees via Teams, posing as IT support. Using Windows Quick Assist, they gained access and achieved network infiltration in just 48 minutes, much faster than typical attacks. This blog dives into how this became possible.

reliaquest.com · 8 min

TLDR InfoSec

VULNWATCH: AI-ENHANCED PRIORITIZATION OF VULNERABILITIES

This blog post describes the Vulnwatch tool from Databricks, an AI-powered system that automatically identifies and prioritizes vulnerabilities in third-party libraries, achieving 85% accuracy in identifying business-critical CVEs while reducing manual security team workload by 95%. The system combines multiple scoring methods including severity score (based on CVSS, EPSS, and community impact), component score (measuring library criticality to Databricks services), and topic score (using LDA to cluster libraries by service context). Using fine-tuned LLMs and vector similarity matching, the system can identify vulnerable dependencies on day zero, enabling the security team to focus only on the most critical 5% of vulnerabilities rather than sifting through hundreds of daily CVE publications.

databricks.com · 7 min

TLDR InfoSec

ANALYZING SECURE AI ARCHITECTURES

AI vulnerabilities shift the traditional patching paradigm from patching individual vulnerabilities to a data modeling problem. This post from NCC Group explores the Gatekeeper and State Machine architectural pattern for securing the data that enters and exits an AI system. Each architecture includes an explanation of the architecture and examples of how it can be applied.

nccgroup.com · 7 min

TLDR InfoSec

BFOREAI (PRODUCT LAUNCH)

BforeAI uses predictive attack intelligence technology to create a list of domains that are likely to be used for malicious purposes in the future instead of leveraging blocklists consisting of domains that have already been seen in attacks.

bfore.ai

TLDR InfoSec

APPLE PULLS ENCRYPTION FEATURE FROM UK OVER GOVERNMENT SPYING DEMANDS

Apple has discontinued Advanced Data Protection (ADP), its end-to-end encrypted iCloud storage service, for new UK users and will require existing users to disable it. This follows reports of UK security services requesting backdoor access to encrypted backups.

theverge.com · 5 min

TLDR InfoSec

THREE QUESTIONS ABOUT APPLE, ENCRYPTION, AND THE U.K.

Cryptographer Matthew Green discusses the backdoor request that the UK government made from Apple and Apple's subsequent decision to disable their encrypted cloud backup feature. He discusses three different points around how seriously Apple has taken encryption for customers, the exact asks from the UK government as well as the ramifications, and how Apple might respond. Green ends on a note that the exit makes the UK Government's request for backdoor moot, but it's unclear what will happen to users who already had Advanced Data Protection enabled, whether they would retain the encryption or be forced to downgrade.

blog.cryptographyengineering.com · 7 min

TLDR InfoSec

BRING YOUR OWN TRUSTED BINARY (BYOTB) – BSIDES EDITION

In this transcript of a talk that David Kennedy gave at BSides London 2024, Kennedy breaks down how existing binaries like Cloudflared and SSH can be used for tunneling and port forwarding in network security scenarios. He notes that the initial example relies on SSH existing on the system and also discusses how the binary can be copied into a Windows system easily. Kennedy also explores defensive measures such as monitoring for specific command line switches and DNS logging to detect potential attacks involving these binaries.

labs.jumpsec.com · 8 min

TLDR InfoSec

MICROSOFT EXPANDS COPILOT BUG BOUNTY TARGETS, ADDS PAYOUTS FOR EVEN MODERATE MESSES

Microsoft has increased bug bounty payments for moderate-severity vulnerabilities from nothing to a maximum of $5,000 and expanded the range of vulnerabilities it will pay people to find and report vulnerabilities.

theregister.com · 3 min

TLDR InfoSec

OPENAI BANS ACCOUNTS MISUSING CHATGPT FOR SURVEILLANCE AND INFLUENCE CAMPAIGNS

OpenAI has banned accounts that were misusing ChatGPT for suspected surveillance activities, including analyzing real-time data on anti-China protests.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

GOOGLE CHROME DISABLES UBLOCK ORIGIN FOR SOME IN MANIFEST V3 ROLLOUT

Google Chrome is disabling uBlock Origin and other extensions in favor of Manifest V3.

bleepingcomputer.com · 2 min