The Daily Index — Tuesday, March 25, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL INGRESS NGINX CONTROLLER VULNERABILITY ALLOWS RCE WITHOUT AUTHENTICATION

Five vulnerabilities in the NGINX Ingress Admission Controller, called IngressNightmare, enable remote code execution without authentication. Attackers can inject harmful configurations to compromise Kubernetes environments via the admission controller.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

OVER 3M APPLICANTS' DATA LEAKED ON NYU'S WEBSITE

This past Saturday, a hacker took over NYU's website for at least two hours and exposed the personal data of over 3M applicants in an act of hacktivism. The leaked data included names, test scores, majors, zip codes, financial data, and information on applicants' family members dating back to at least 1989. The hacker claimed to have breached NYU to expose its continued use of affirmative action after the 2023 SCOTUS ruling.

nyunews.com · 2 min

TLDR InfoSec

BYPASSING DETECTIONS WITH COMMAND-LINE OBFUSCATION

Defensive tools that use command-line arguments to detect malicious activity are vulnerable to a technique called ArgFuscator. Obfuscation can exploit parsing flaws in executables to evade security detections, highlighting weaknesses in current cybersecurity methods.

wietzebeukema.nl · 7 min

TLDR InfoSec

UNRAVELING TIME: A DEEP DIVE INTO TTD INSTRUCTION EMULATION BUGS

Microsoft's Time Travel Debugging (TTD) framework is a powerful record-and-replay tool that uses CPU instruction emulation to replay program execution. Google's Mandiant team found a bug in the emulation engine and built a fuzzing harness to execute random instruction sequences through TTD and a real CPU, discovering three bugs in the process, which they reported to Microsoft.

cloud.google.com · 10 min

TLDR InfoSec

TUTORIAL: UNPACKING EXECUTABLES WITH TINYTRACER + PE-SIEVE

This tutorial demonstrates how to unpack a modified UPX-packed executable using TinyTracer and PE-sieve tools, which avoids anti-debugging measures common in packed malware. The process involves first tracing the executable to identify its Original Entry Point (OEP), setting a stop offset in TinyTracer to pause execution at the OEP, then using HollowsHunter to dump and reconstruct the unpacked program with its Import Address Table. After dumping, final modifications are needed in PE-bear to fix the entry point and restore proper section characteristics for the executable to run successfully.

hshrzd.wordpress.com · 8 min

TLDR InfoSec

MICROSOFT UNVEILS MICROSOFT SECURITY COPILOT AGENTS AND NEW PROTECTIONS FOR AI (PRODUCT LAUNCH)

Microsoft is expanding Security Copilot with 11 AI agents across its security platform. Six Microsoft-built and five partner-developed agents will help automate cybersecurity tasks like phishing triage, threat intelligence, and vulnerability management, aiming to combat the growing complexity of cyber threats.

microsoft.com

TLDR InfoSec

ALBABAT RANSOMWARE EXPANDS TARGETS, ABUSES GITHUB

Albabat ransomware is evolving to target Windows, Linux, and macOS platforms. Retrieving components from a GitHub repository, it now harvests system information, encrypts files across multiple operating systems, and tracks infections in a PostgreSQL database.

securityweek.com · 3 min

TLDR InfoSec

DRYRUN SECURITY VS TRADITIONAL SAST VENDORS IN RUBY ON RAILS

This post compares DryRun Security's contextual scanner to Snyk Code, GitHub Advanced Security, Semgrep, and SonarQube in finding vulnerabilities in the intentionally vulnerable RailsGoat. The test PR included SQL injection, XSS, SSRF, IDOR, user enumeration, and hardcoded token vulnerabilities. DryRun was the only tool that found all the vulnerabilities, whereas Semgrep found 3/6, GitHub and Snyk found 2/6, and SonarQube found none.

dryrun.security · 10 min

TLDR InfoSec

AWS WAF NOW SUPPORTS URI FRAGMENT FIELD MATCHING

Summary unavailable

aws.amazon.com · 2 min

TLDR InfoSec

SETTING DIRECTION FOR THE UK'S MIGRATION TO POST-QUANTUM CRYPTOGRAPHY

The UK's NCSC aims to adopt post-quantum cryptography (PQC) by 2035, with key milestones including completing discovery and planning by 2028 and high-priority migrations by 2031.

ncsc.gov.uk · 17 min

TLDR InfoSec

CHINESE APT WEAVER ANT INFILTRATED A TELCO IN ASIA FOR OVER FOUR YEARS

China-linked APT Weaver Ant infiltrated an Asian telecom provider's network for over four years, using web shells for persistence and stealthy control of compromised systems.

securityaffairs.com · 3 min

TLDR InfoSec

23ANDME FILES FOR BANKRUPTCY, CUSTOMERS ADVISED TO DELETE DNA DATA

23andMe filed for bankruptcy and will sell its assets - customers should delete their DNA data for privacy.

bleepingcomputer.com · 3 min