The Daily Index — Thursday, April 17, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

APPLE FIXES TWO ZERO-DAYS EXPLOITED IN TARGETED IPHONE ATTACKS

Apple has released emergency security updates to patch two new zero-day vulnerabilities exploited in sophisticated attacks against iPhones. The first vulnerability is a flaw in CoreAudio, which can be exploited by processing an audio stream in a malicious file to execute remote code. The second vulnerability is a flawed RPAC that allows attackers with read or write access to bypass Pointer Authentication, which is a security feature to protect against memory vulnerabilities.

bleepingcomputer.com · 2 min

TLDR InfoSec

HUGE RANSOMWARE CAMPAIGN TARGETS AWS S3 STORAGE

Security researchers have discovered a publicly accessible server containing 1,229 unique AWS credentials. Upon investigation, the researchers found that the active keys were used in S3 ransomware campaigns, where the attackers utilized SSE-C to encrypt S3 bucket data and demanded 0.3 BTC (~$25,000) per victim. In some cases, the highly automated attackers were willing to offer a “proof of decryption” test file restoration.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

EDV - ENDPOINT DETECTION & VIBES

EDV is a tool that feeds Windows Sysmon security events to Microsoft's Copilot AI through WebSocket connections, asking it to identify malicious activity. Testing with known attack techniques showed Copilot could detect about 40% of malicious events not blocked by Windows Defender, though with inconsistent results and false positives.

tierzerosecurity.co.nz · 4 min

TLDR InfoSec

ACCESS DENIED? NOT ALWAYS! HUNTING IDORS AND ACCESS CONTROL FLAWS

IDOR vulnerabilities occur when attackers manipulate direct object references like IDs in URLs to access unauthorized data. As a common form of Broken Access Control, these flaws are prevalent in web applications, relatively easy to find, and highly impactful. This guide walks through how bug bounty hunters regularly exploit it.

medium.com · 9 min

TLDR InfoSec

DETECTING C2-JITTERED BEACONS WITH FREQUENCY ANALYSIS

Frequency analysis is a technique that allows for the detection of anomalies in a set of data. This post details how Fourier Transforms can be used to shift data to the frequency domain and then detect C2 beaconing behavior. When a C2 beacon utilizes jitter to vary its periodicity, a sliding window must be used to properly detect the activity.

diegowritesa.blog · 7 min

TLDR InfoSec

AURASCAPE (PRODUCT LAUNCH)

Aurascape helps corporate IT departments monitor AI employee usage across thousands of AI applications—both approved and unauthorized. The technology tracks interactions, decodes prompt-response data, and evaluates security risks, even for less common AI tools.

aurascape.ai

TLDR InfoSec

GUESS WHAT HAPPENS WHEN RANSOMWARE FIENDS FIND 'INSURANCE' 'POLICY' IN YOUR FILES

Companies with cyber insurance face ransomware demands 2.8 times higher than uninsured victims, as criminals specifically search for insurance policies during attacks. Insured victims pay more often (44% vs 24%) and pay significantly larger amounts.

theregister.com · 4 min

TLDR InfoSec

SECURITY OPERATIONS WITH RUNREVEAL'S MCP SERVER

SIEM provider RunReveal released an MCP server for use with its product. In this post, RunReveal provides insights into some ways that its customers are using the MCP server for threat hunting with Cursor, investigating GuardDuty alerts, and tuning and testing alerts. RunReveal believes that enriching and standardizing data to make it easier for LLMs to query is the future of its product.

blog.runreveal.com · 4 min

TLDR InfoSec

THE WINDOWS REGISTRY ADVENTURE #6: KERNEL-MODE OBJECTS

This blog post focuses on kernel-mode registry objects essential for runtime hive management. It meticulously examines key internal structures, including _CMHIVE, _HHIVE, memory mapping mechanisms, cell maps, and key control blocks that collectively enable registry functionality like transaction management and synchronization. The post provides detailed explanations of these previously undocumented structures based on reverse engineering of Windows Server 2019, noting these findings apply to Windows 11 as well.

googleprojectzero.blogspot.com · 66 min

TLDR InfoSec

KREBS EXITS SENTINELONE AFTER SECURITY CLEARANCE PULLED

Chris Krebs resigned from SentinelOne after his security clearance was revoked and a presidential order was issued to review CISA's conduct under his leadership.

securityweek.com · 2 min

TLDR InfoSec

BIDENCASH MARKET DUMPS 1 MILLION STOLEN CREDIT CARDS ON RUSSIAN FORUM

BidenCash Market leaked over 910,000 stolen credit card records on a Russian forum without names but with card details.

hackread.com · 3 min

TLDR InfoSec

MICROSOFT WARNS OF BLUE SCREEN CRASHES CAUSED BY APRIL UPDATES

Microsoft has advised Windows 11 users of blue screen crashes following recent updates and suggests using Known Issue Rollback or Group Policy for fixes - deployment guidance is available on its support website.

bleepingcomputer.com · 2 min