TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2023-09-11

5 sections15 entriesinline urlcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

ACTIVE NORTH KOREAN CAMPAIGN TARGETING SECURITY RESEARCHERS

North Korean threat actors have been targeting security researchers for the past two and a half years using 0-day exploits. Google’s Threat Analysis Group has tracked and disrupted campaigns from these actors and recently discovered a new campaign likely from the same actors. The threat actors used social media sites to build rapport with their targets before sending a malicious file that contained at least one 0-day in a popular software package.

blog.google3 min read

SPYWARE

Several malicious Telegram clones for Android on Google Play were installed over 60,000 times, infecting people with spyware that steals user messages, contact lists, and other data.

bleepingcomputer.com2 min read

DEVICES

Advanced Persistent threat actors were found to have exploited two vulnerabilities, CVE-2022-47966 (Zoho Suite) and CVE-2022-42475 (FortiOS devices), to gain unauthorized access and establish persistence on an organization's network. The Cybersecurity and Infrastructure Security Agency and co-sealers have released a joint Cybersecurity Advisory to provide network defenders with tactics, techniques, and procedures, IOCs, and methods to detect and protect against similar exploitation.

cisa.gov20 min read

02STRATEGIES & TACTICS

7 WAYS TO ESCAPE A CONTAINER

A blog post containing 7 different techniques that an attacker could use to escape from a container boundary. Each technique includes a list of required Linux capabilities for the attack, a description of the attack, an example command to launch a vulnerable container, and an example command to escape the container.

panoptica.app10 min read

WORKFLOWS

The recommended method for pinning GitHub Actions per GitHub is to pin the action to a full commit hash which causes the tarball of the action to be downloaded. However, some actions can still be exploited through supply chain attacks if they depend upon unpinned external dependencies (docker containers, other actions, etc). A total of 32% of the top started actions were deemed unpinnable. This article concludes with advice to mitigate unpinnable action attacks

paloaltonetworks.com10 min read

CODE VULNERABILITIES PUT PROTONMAIL AT RISK

A blog post from the Sonar research team detailing their findings in Proton Mail. The post includes an in-depth breakdown of the vulnerability that they discovered and the patch that was issued.

sonarsource.com12 min read

03LAUNCHES & TOOLS

FLIGHTSIM

flightsim is a tool to help security teams generate malicious traffic to test security controls and network visibility. It can test for a variety of different malicious traffic patterns.

github.comGitHub repository

SEMGREP-RULES

A collection of Semgrep rules that apply to HashiCorp products. This repository is a work in progress and currently only includes rules for terraform.

github.comGitHub repository

CHEPY

Chepy is a pure Python implementation of the features of Cyberchef utility. It preserves the ability to stack various actions together. While it lacks Cyberchef's magic function, it has a lot of features that could be desirable for security researchers.

github.comGitHub repository

04MISCELLANEOUS

US CYBER BOARD TO INVESTIGATE MICROSOFT HACK OF GOVERNMENT EMAILS

A U.S. review board tasked with investigating major cybersecurity incidents said it will begin looking at the recent intrusion of U.S. government email systems provided by Microsoft, whose handling of the incident drew ire and scrutiny from federal lawmakers and the wider security community.

techcrunch.com2 min read

TWO REAL-LIFE EXAMPLES OF WHY LIMITING PERMISSIONS WORKS

A blog post from the AWS Customer Incident Response Team detailing two cases that they worked on. In both of these cases, real-world examples of least privilege are given in actual customer environments.

aws.amazon.com6 min read

CLOUD DETECTION AND RESPONSE NEEDS TO BREAK DOWN BOUNDARIES

A post that partially leverages the Crowdstrike “Nowhere to Hide” threat hunting report to analyze the current state of cloud detection and response. It notes that many modern attacks and breaches leverage credentials to pivot between systems (such as IDPs, cloud environments, and CI/CD environments). However, most tooling is siloed to a specific environment. The post argues that tooling needs to adapt to these more complex environments and provides advice for teams.

permiso.io5 min read