The Daily Index — Monday, March 10, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

ETHEREUM PRIVATE KEY STEALER ON PYPI DOWNLOADED OVER 1K TIMES

The PyPI package "set-utils" targets Ethereum developers using the eth-account library. The package hooks the from_key and from_mnewmonic() functions in the ethereum package to intercept private keys, encrypt them, and upload them to the Polygon blockchain. Polygon transactions have very low processing fees, no rate limits, and free public RPC endpoints, enabling attackers to retrieve the keys at any point without requiring their own infrastructure.

bleepingcomputer.com · 3 min

TLDR InfoSec

UNDOCUMENTED COMMANDS FOUND IN BLUETOOTH CHIP USED BY A BILLION DEVICES

Researchers from Tarlogic Security discovered 29 undocumented commands in the firmware of the ESP32 Bluetooth device. The commands could allow for memory manipulation, MAC address spoofing, and LMP/LLCP packet injection. While the commands could open the door for supply chain attacks, a more realistic threat would be a physical attacker establishing persistence and performing further attacks through the ESP32's memory.

bleepingcomputer.com · 2 min

TLDR InfoSec

REVERSING SAMSUNG'S H-ARX HYPERVISOR FRAMEWORK

Mobile devices lead security with defense-in-depth strategies, moving sensitive data from untrusted kernels to higher trust levels like hypervisors and secure enclaves. Samsung's Real-time Kernel Protection (RKP), part of Knox on Exynos devices, uses H-Arx Hypervisor to protect the kernel. The post discusses how to reverse the hypervisor framework, which includes a common core (harx.bin) and loadable plug-ins in a proprietary uH format.

dayzerosec.com · 17 min

TLDR InfoSec

ABUSING VBS ENCLAVES TO CREATE EVASIVE MALWARE

VBS enclaves allow a Windows user to run code in an isolated memory region that even the “standard” kernel cannot access. This presents an appealing attack surface for malware, as VBS malware would be invisible to EDR running in the standard kernel, but the VBS enclave code must be signed by Microsoft. This post explores bypassing the Microsoft checks by abusing debuggable enclave modules or exploiting vulnerable enclaves.

akamai.com · 9 min

TLDR InfoSec

NOT LOST IN TRANSLATION: ROSETTA 2 ARTIFACTS IN MACOS INTRUSIONS

Rosetta 2 technology creates AOT files on Apple Silicon Macs, essential for analyzing macOS intrusions, even if malware is erased. Mandiant found that sophisticated actors target cryptocurrency firms with x86-64 malware due to its wider compatibility and lenient execution policies compared to ARM64. These AOT files, stored in protected cache directories, can uncover critical intrusion evidence through timestamps, execution patterns, and binary features, even after deleting malicious files.

cloud.google.com · 8 min

TLDR InfoSec

ATT&CK EVALUATIONS LIBRARY

The ATT&CK Emulation Library hosts adversary emulation plans from published ATT&CK Evaluations. These plans emulate specific adversaries, like Turla, covering initial access to exfiltration. Organized by evaluation and threat actors, they simulate real breaches.

attackevals.github.io · 1 min

TLDR InfoSec

HACKED HEALTH FIRM HCRG DEMANDED JOURNALIST ‘TAKE DOWN' DATA BREACH REPORTING, CITING UK COURT ORDER

U.S. cybersecurity journalist "Dissent Doe" refused a U.K. court order to remove articles on the ransomware attack against healthcare provider HCRG. Citing First Amendment protections and U.S. jurisdiction, Doe noted that HCRG is taking legal action to stop the republication of stolen data.

techcrunch.com · 4 min

TLDR InfoSec

DEVELOPER SABOTAGED EX-EMPLOYER WITH KILL SWITCH ACTIVATED WHEN HE WAS LET GO

A federal jury convicted Davis Lu, 55, of sabotaging his employer Eaton Corporation's systems after being let go. He created malware that crashed servers and a kill switch that locked thousands of employees out when he was fired in September 2019. Lu now faces up to ten years imprisonment.

theregister.com · 3 min

TLDR InfoSec

1PASSWORD IS MAKING IT EASIER TO FIND PASSWORDS BASED ON YOUR LOCATION

1Password now lets users save a location with a password and view passwords in a "Nearby" tab. This feature could be useful for linking travel documents to airports or healthcare documents to doctors' offices. 1Password ensures that location data is not stored, shared, or tracked, with all nearby checks conducted on the device.

theverge.com · 2 min

TLDR InfoSec

NEW CHIRP TOOL USES AUDIO TONES TO TRANSFER DATA BETWEEN DEVICES

Chirp translates characters into sound frequencies for transmission between Computers and Smartphones.

bleepingcomputer.com · 2 min

TLDR InfoSec

AKIRA RANSOMWARE GANG USED AN UNSECURED WEBCAM TO BYPASS EDR

The Akira ransomware gang used an unsecured webcam to evade Endpoint Detection and Response (EDR) systems and carry out encryption attacks on a victim's network.

securityaffairs.com · 3 min

TLDR InfoSec

CHROMECAST (2ND GEN) AND AUDIO CANNOT CAST IN 'UNTRUSTED' OUTAGE

Chromecast (2nd gen) and Chromecast Audio users have been unable to Cast audio or video content due to an "Untrusted device" error message.

9to5google.com · 1 min