TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 12 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 9 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 10 stories
  8. Page 8: TLDR MarketingTLDR Marketing · 10 stories
  9. Page 9: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design · 11 stories
  10. Page 10: SponsoredTLDR, TLDR AI, TLDR InfoSec · 5 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ICLICKER SITE HACK TARGETED STUDENTS WITH MALWARE VIA FAKE CAPTCHA

The website of iClicker, which provides a student engagement platform, was compromised in a ClickFix attack. The attack prompted users to click on a fake CAPTCHA, which copied a PowerShell command to users' clipboards and then instructed them to run it. The PowerShell script downloaded a legitimate Microsoft Visual C++ Redistributable if the script detected that it was in a malware sandbox or an unknown malware that is possibly an infostealer if it was running on a regular machine.

bleepingcomputer.com · 3 min

TLDR InfoSec

THE CRYPTOGRAPHY BEHIND PASSKEYS

Passkeys employ public-key cryptography for authentication. The user's device creates a digital signature with a private key, while the website verifies it using a public key, reducing password vulnerabilities. WebAuthn provides vital anti-phishing protections through origin binding, ensuring passkeys are functional only with their respective websites. Different authenticator types balance security and convenience. The passkey ecosystem supports cryptographic extensions for functionalities such as key derivation and secure storage. However, developers must implement account recovery mechanisms, as lost passkeys cannot be reconstructed.

blog.trailofbits.com · 11 min

TLDR InfoSec

RUDE AWAKENING: UNMASKING SLEEP OBFUSCATION WITH TTTRACER

Modern C2 implants will use sleep obfuscation where the implant encrypts itself and stays dormant for a period of time before decrypting itself, fetching and performing operations, and then repeating the cycle by encrypting itself again. This makes detection difficult because it is unlikely that an EDR will scan the system while the implant is decrypted. This author explores how to utilize Time Travel Debugging to detect when an implant decrypts itself and makes network calls. They note that this method is very successful but can be bypassed by malware authors by extending the sleep period to make the manual analysis untenable or by unloading the attached debugging DLL.

blog.felixm.pw · 8 min

TLDR InfoSec

TALES FROM THE CLOUD TRENCHES: THE ATTACKER DOTH PERSIST TOO MUCH, METHINKS

Attackers leveraged a leaked AWS access key from an organization management account to establish multiple persistence mechanisms, including a "persistence-as-a-service" Lambda function triggered by API Gateway that creates new IAM users on demand. Previously unreported tactics included disabling trusted access for organization-level services, manipulating AWS Identity Center (SSO) to create backdoor users without MFA requirements, and operating from Telegram IP addresses. The attackers implemented comprehensive persistence strategies to survive credential revocation, demonstrating sophisticated knowledge of AWS services and security mechanisms.

securitylabs.datadoghq.com · 5 min

TLDR InfoSec

THE IMPACT OF MICROSOFT'S REFS ON DFIR

This blog post provides an in-depth discussion of the new Microsoft Resilient File System (ReFS) and details how it differs from NTFS from a forensics perspective. It highlights the challenges during the transitional period, such as a gap in tooling maturity, no Master File Table, a lack of undo logs in ReFS' logging, changes in the Change Journal, and various removed NTFS features. However, ReFS also offers new forensics opportunities, including the ReFS Log and “First Events,” the potential for carving opportunities in superblocks and checkpoints, the potential for deleted data to persist if shared with another file, integrity streams traces, and other metadata.

medium.com · 32 min

TLDR InfoSec

LEDGER SECURES DISCORD AFTER HACKER BOT TRIED TO STEAL SEED PHRASES

Hardware wallet provider Ledger notified users that it has secured its Discord server following an attacker's compromise of a moderator's account. The moderator's account was used to notify Discord members of a bogus vulnerability that required users to verify their recovery phrases with a scam link. Ledger reported that after some delays in reporting the issue due to the compromised account muting and banning other Ledger moderators, the compromised account was removed, and the bot was deleted.

cointelegraph.com · 2 min

TLDR IndexPage 5