TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2023-09-04

5 sections14 entriesinline urlcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

DOXXING NEARLY ANYONE IN AMERICA FOR $15

An investigation from 404 Media details a category of bots that utilizes credit headers to dox nearly anyone in America. Hackers seem to have acquired access to this data and are selling it for $15-$40. 404 Media has confirmed that at least some of the extensive data is accurate. Data that the tool provides include addresses, mobile phone numbers, email addresses, driver's license numbers, and even names and birth years of the target’s relatives.

404media.co8 min read

SOURCEGRAPH DISCLOSES DATA BREACH FOLLOWING ACCESS TOKEN LEAK

Code search and navigation platform Sourcegraph on Thursday announced that it has experienced a data breach after an engineer accidentally leaked an admin access token. Sourcegraph account email addresses for community members and license owners were obtained. No other customer info, including private code, passwords, usernames, or other PII, was accessible.

about.sourcegraph.com4 min read

02STRATEGIES & TACTICS

ANDROID GOES ALL-IN ON FUZZING

The blog post details the Android team’s massive investment into fuzzing and the fuzzing pipeline that they’ve built. It highlights how the Android team writes and detects fuzzers, how those bugs get routed and examined for vulnerabilities, and examples of CVEs that were detected by fuzzing.

security.googleblog.com5 min read

CAMPAIGN

The Classiscam scam-as-a-service program has reaped criminal actors $64.5 million in illicit earnings since its emergence in 2019. This blog includes a detailed analysis of how Classiscam campaigns have changed over the past four years. Would-be cybercriminals can now leverage a range of automated tools to create new Classiscam schemes – including phishing sites — in a handful of minutes.

group-ib.com15 min read

AND SYSTEMD

Using the vulnerability described in this blog, an attacker may take control of an encrypted Linux computer during the early boot process, manually unlock TPM-based disk encryption, and either modify or read sensitive information stored on the computer’s disk. This blog post runs through how the vulnerability was identified and exploited - no tiny soldering required.

pulsesecurity.co.nz8 min read

03LAUNCHES & TOOLS

JS-X-RAY

JavaScript & Node.js open-source SAST scanner. A static analyzer for detecting most common malicious patterns.

github.comGitHub repository

CHERRYBOMB

Cherrybomb is a CLI tool written in Rust that helps prevent incorrect code implementation early in development. It works by validating and testing your API using an OpenAPI file. Its main goal is to reduce security errors and ensure your API functions as intended.

github.comGitHub repository

CHROMEAUDIT

ChromeAudit is a plugin for the nuclei vulnerability scanner for Chrome Extension. It allows you to download the Chrome extension as a zip file and supply it to nuclei to find any vulnerabilities in the Chrome extension.

github.comGitHub repository

04MISCELLANEOUS

UNMASKING TRICKBOT

Trickbot was formed in 2016 and rose to become one of the world’s top cybercrime gangs. An investigation into the leaked internal messages, known as Trickfiles, from this group reveals the identities of key players, ties to the Kremlin, and insights into their internal organization.

wired.com15 min read

NETWRIX HYBRID SECURITY TRENDS REPORT 2023 - EDUCATION SPECIAL

Netwrix survey shows 69% of education organizations suffered a cyberattack in the past year, higher than other sectors. Phishing and compromised on-prem user/admin accounts were top attack vectors, unlike others. Highlights increased threats and account risks facing the education sector.

netwrix.com6 min read