TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 8 stories
  3. Page 3: TLDR AITLDR AI · 14 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 8 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 11 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 11 stories
  7. Page 7: TLDR DesignTLDR Design · 12 stories
  8. Page 8: TLDR FoundersTLDR Founders · 12 stories
  9. Page 9: TLDR MarketingTLDR Marketing · 3 stories
  10. Page 10: Resources & ToolsTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders · 14 stories
  11. Page 11: SponsoredTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Founders, TLDR Marketing · 10 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DISCORD INVITE LINK HIJACKING DELIVERS ASYNCRAT AND SKULD STEALER TARGETING CRYPTO WALLETS

Attackers are exploiting Discord's invite system by hijacking expired vanity links to redirect users from trusted sources to malicious servers distributing AsyncRAT and Skuld Stealer malware targeting cryptocurrency wallets. The attack, designed to harvest credentials from Exodus and Atomic wallets via injection techniques, employs ClickFix social engineering to trick users into running PowerShell commands that download multi-stage payloads, followed by Skuld Stealer. The campaign targets users in the US, Vietnam, France, Germany, and other countries using trusted cloud services like GitHub, Bitbucket, and Pastebin to blend malicious traffic with legitimate communications.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

HUNTING THROUGH APIS

This blog compares three Microsoft security APIs for threat hunting: Azure Monitor API, which queries Sentinel data only; Graph API, which queries both Defender XDR and Sentinel data, and Defender ATP API, which is limited to Defender for Endpoint data. The Graph API is recommended as it offers unified access to both platforms and supports more data types, while the Defender ATP API has notable limitations, such as a 30-day query timeframe restriction. Each API needs specific permissions and has different rate limits, with the Graph API allowing over 45 calls per minute based on tenant size.

kqlquery.com · 5 min

TLDR InfoSec

BUILDING UBER'S MULTI-CLOUD SECRETS MANAGEMENT PLATFORM TO ENHANCE SECURITY

Uber initially employed various secrets management practices and vaults for different teams and clouds, which it consolidated into six vaults under the purview of its Secrets team. The Secrets team created scanners to perform real-time scanning and scheduled scanning to identify secrets usage in chat apps and code, as well as built APIs for automated secrets rotation from the centralized secrets vaults. The team also developed a secrets exchange system to distribute secrets to third-party vendors.

uber.com · 10 min

TLDR InfoSec

WHY IS NO ONE TALKING ABOUT MAINTENANCE IN DETECTION ENGINEERING?

With the movement of detection engineering towards a detection-as-code model, detection engineers must also embrace software maintenance requirements. Maintenance can be broken down into four categories: corrective maintenance, which directly fixes an issue that is occurring; adaptive maintenance, which adapts the detection to changing requirements such as a new API; perfective maintenance, which focuses on improving the query, documentation, or adding new features; and preventative maintenance, which proactively seeks to address issues before clients identify them. Although all detection engineering teams must perform maintenance, there is a dearth of information and posts discussing it.

medium.com · 8 min

TLDR InfoSec

UNUSUAL TOOLSET USED IN RECENT FOG RANSOMWARE ATTACK

Fog ransomware operators attacked an Asian financial firm in May using Syteca monitoring and pentesting tools GC2, Adaptix, and Stowaway. They stayed in the network for two weeks before deploying ransomware. The attackers maintained persistence post-attack and utilized tools often linked to espionage, suggesting intelligence-gathering motives with ransomware as a secondary goal. Since May 2024, Fog ransomware has evolved from targeting US schools through compromised VPNs to exploiting Veeam vulnerabilities and shifted to email infections featuring provocative ransom notes mocking Elon Musk's DOGE agency.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

COMING TO APPLE OSES: A SEAMLESS WAY TO IMPORT AND EXPORT PASSKEYS

Apple previewed a new import/export feature for passkeys at the most recent WWDC. The new mechanism will fundamentally differ from current credentials exports that utilize JSONs or CSVs, as it happens directly between participating credentials manager apps without creating insecure files. Data miners have discovered artifacts in newer releases of the Google Authenticator app, suggesting that Google is working on similar functionality for the Android ecosystem, but Google has not announced the feature yet.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

MENSTRUAL TRACKING APP DATA IS A ‘GOLD MINE' FOR ADVERTISERS THAT RISKS WOMEN'S SAFETY

Researchers from the University of Cambridge highlight the risks associated with cycle tracking apps (CTAs) and broad data collection practices. CTAs regularly collect and sell sensitive data on women's cycles to advertisers and tech giants without user consent. The researchers are calling on governments to create non-profit, public CTAs or at least require CTAs to offer fine-grained data collection approvals.

links.tldrnewsletter.com · 4 min

TLDR IndexPage 5