The Daily Index — Wednesday, March 19, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CHATGPT VULNERABILITY EXPLOITED AGAINST US GOVERNMENT ORGANIZATIONS

Hackers exploited an SSRF vulnerability in ChatGPT's pictureproxy.php file, enabling unauthorized requests. There were over 10,000 attacks from one IP focused on the US government and financial institutions in a week.

securityweek.com · 3 min

TLDR InfoSec

SOUTH KOREAN ORGANIZATIONS TARGETED BY COBALT STRIKE ‘CAT' DELIVERED BY A RUST BEACON

Researchers found server hosting tools for cyber attacks on South Korean entities, notably using Cobalt Strike Cat. The attacker targeted government and commercial organizations with open-source tools like SQLMap and Web-SurvivalScan. The malware campaign utilized Rust-compiled loaders and a modified Cobalt Strike for post-exploitation.

hunt.io · 6 min

TLDR InfoSec

THREAT MODELING THE TRAIL OF BITS WAY

Trail of Bits' TRAIL (Threat and Risk Analysis Informed Lifecycle) is a threat modeling process that merges aspects of Mozilla's Rapid Risk Assessment, NIST SP 800-154, and NIST SP 800-53 to identify design-level security flaws. TRAIL constructs a model of system components and trust boundaries, documents threat scenarios of potential adversary exploitations, and generates actionable findings with short- and long-term mitigation recommendations. It addresses root causes at the architecture level, allowing clients to adapt their threat models as systems evolve and offering vital security insights throughout the software development lifecycle.

blog.trailofbits.com · 7 min

TLDR InfoSec

SAML ROULETTE: THE HACKER ALWAYS WINS

This blog explores how to exploit GitLab Enterprise through ruby-saml vulnerabilities using round-trip attacks and namespace confusion for unauthorized admin access. The technical details are provided for security education and understanding these attack vectors.

portswigger.net · 8 min

TLDR InfoSec

DEFEATING STRING OBFUSCATION IN OBFUSCATED NODEJS MALWARE USING AST

This article describes how to defeat string obfuscation in Node.js malware through Abstract Syntax Tree (AST) parsing, focusing on the Nebula Stealer sample. It outlines a method using the Babel library to safely analyze, extract, and execute obfuscated code in a VM context while replacing obfuscated strings with their decoded values. The author includes code snippets for renaming variables, extracting code segments, executing parts of the code to reveal hidden strings, and enhancing readability.

links.tldrnewsletter.com · 14 min

TLDR InfoSec

AI HTTP ANALYZER (BURP APP)

AI HTTP Analyzer is a Burp App that provides an advanced security analysis assistant integrated into Burp Suite.

portswigger.net

TLDR InfoSec

AMAZON RDS NOW PROVIDES VISIBILITY INTO IAM DB AUTHENTICATION METRICS AND LOGS

Amazon RDS IAM DB Authentication enables IAM principals to access RDS databases with their IAM credentials, eliminating the need for separate database credentials. It also reports IAM DB Auth error logs to CloudWatch and publishes authentication metrics automatically.

aws.amazon.com · 2 min

TLDR InfoSec

AWS WAF ADDS JA4 FINGERPRINTING AND AGGREGATION ON JA3 AND JA4 FINGERPRINTS FOR RATE-BASED RULES

A JA4 TLS client fingerprint contains a 36-character fingerprint of the TLS Client Hello which can be used for identifying known bad actors. JA4 fingerprints are now supported in match statements in AWS WAF. Additionally, AWS WAF has added support for both JA3 and JA4 fingerprints to rate-based rules.

aws.amazon.com · 2 min

TLDR InfoSec

UK ONLINE SAFETY LAW MUSK HATES KICKS IN TODAY, AND SO FAR, TRUMP CAN'T STOP IT

The UK's Online Safety Act enforcement began, requiring tech platforms to remove dangerous content or face fines up to 10% of global turnover. Elon Musk hopes Trump will intervene to weaken the law, but UK officials insist it will remain intact and may even expand, particularly to combat AI-generated CSAM.

arstechnica.com · 5 min

TLDR InfoSec

OKX WEB3: TAKING A STAND AGAINST FINANCIAL CRIME

Summary unavailable

okx.com · 3 min

TLDR InfoSec

INFOSTEALERS FUELED CYBERATTACKS AND SNAGGED 2.1B CREDENTIALS LAST YEAR

Cybercriminals used infostealers to steal 2.1 billion credentials last year, leading to ransomware attacks and data breaches.

cyberscoop.com · 3 min