TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 13 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 11 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 16 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

CRITICAL CISCO SMART LICENSING UTILITY FLAWS NOW EXPLOITED IN ATTACKS

Cisco Smart Licensing Utility (CSLU) is a Windows application that allows admins to manage licenses and linked products on-prem without connecting them to Cisco's cloud licensing software. In September, Cisco patched a vulnerability that exposed an undocumented, static credential for a built-in admin account and allowed unauthenticated users to access log files containing sensitive data. SANS' Dean of Research reports that threat actors are now chaining these two vulnerabilities to exploit internet-exposed CSLU instances.

bleepingcomputer.com · 2 min

TLDR InfoSec

INFOSTEALER CAMPAIGN AGAINST ISPS

The Splunk Threat Research Team identified a new campaign targeting ISP infrastructure. Attackers use weak credentials to gain initial access, downloading malware from a C2 server that runs a crypto miner and an infostealer to detect crypto wallet passphrases and take screenshots. They establish persistence and pivot to additional IP CIDRs, utilizing Python and Powershell scripts to maintain a minimal presence, including IoCs in the post.

splunk.com · 10 min

TLDR InfoSec

SUPPLY CHAIN SECURITY IS FUBAR - A PROPOSAL FOR GITHUB

The tj-actions and xz utils supply chain attacks have highlighted the issues that exist in establishing a maintainer's identity on GitHub. GitHub should require certain security features on a repository once it hits a certain popularity threshold, such as signed commits, PRs, blocking force pushes with an emergency override system, and 2FA for all admin credentials and maintainers. It should create an opt-in standard for verifying open-source maintainer identities, managing roster changes, and maintaining public audit logs and security settings. GitHub could also implement a production version of Chainguard's octo-sts for short-lived runner credentials and check for typosquatting in GitHub Actions.

pulse.latio.tech · 6 min

TLDR IndexPage 5