TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2023-11-29

5 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

DESIGN FLAW IN GOOGLE WORKSPACE COULD LET ATTACKERS GAIN UNAUTHORIZED ACCESS

Google Workspace's domain-wide delegation feature has a severe design flaw dubbed DeleFriend that enables privilege escalation without admin access. Attackers could gain unauthorized Workspace API access for theft, exfiltration, and other unauthorized actions domain-wide. Successful exploitation of the flaw could allow exfiltration of sensitive data from Google services like Gmail, Drive, Calendar, and others.

thehackernews.com3 min read

CRITICAL VULNERABILITY FOUND IN RAY AI FRAMEWORK

A critical vulnerability in Ray, an open source compute framework for AI, could allow unauthorized access to all nodes. Tracked as CVE-2023-48023, the vulnerability allows remote attackers to submit or delete jobs without authentication. Furthermore, an attacker could retrieve sensitive information and execute arbitrary code.

securityweek.com4 min read

02STRATEGIES & TACTICS

ANALYZING THE LITTERDRIFTER MALWARE

This article takes a deep dive into Gamaredon’s new LitterDrifter malware. LitterDrifter is a worm written in VBS that spreads via USB devices and communicates with a flexible C2 infrastructure. The article also contains indicators of compromise.

research.checkpoint.com8 min read

POST-EXPLOITING A COMPROMISED ETCD CLUSTER

This post from NCCGroup presents a technique for compromising Kubernetes clusters given a root-compromised etcd host. The post provides an overview of how Kubernetes interacts with etcd and then delves into how to use a compromised etcd host to gain access to a cluster, followed by bypassing AdmissionControllers. The post concludes with some potential mitigation techniques.

research.nccgroup.com12 min read

ADVERSARIAL ATTACKS ON LLMS

This thorough article by Lilian Weng dives deep into different types of attacks on Large Language Models (LLMs). Weng discusses various attacks and prevention strategies in depth.

lilianweng.github.io22 min read

03LAUNCHES & TOOLS

Sponsored

KEYLOGGER MALWARE — AN IN-DEPTH ANALYSIS OF INFECTED USER DEVICES

Keyloggers are used to steal typed passwords, credit card numbers, and private conversations — while bypassing protections such as VPN. Between March to August 2023, Moonlock detected a large number of keylogger samples [12] on macOS devices. Their report highlights the distribution of keyloggers, core modules, anti-analysis techniques, code examples, API usage, detection methods, and more.

moonlock.comSponsor

SCAPY

Scapy is a Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. Scapy is designed to allow fast packet prototyping by using default values that work.

github.comGitHub repository

YOUSHALLNOTPASS

YouShallNotPass executes administrator-specified checks on CI/CD pipelines to prevent unauthorized workflows from executing suspicious commands on sensitive systems. The tool includes support for GitLab runners and experimental support for GitHub.

github.comGitHub repository

ICEKUBE: FINDING COMPLEX ATTACK PATHS IN KUBERNETES CLUSTERS

IceKube is an open-source tool that creates graph databases of resource configurations and relationships in Kubernetes clusters. It can analyze these relationships and identify potential attacks by combining them to query for routes using one or more of the 25 attack techniques it currently implements.

labs.withsecure.com8 min read

04MISCELLANEOUS

EUROPOL ARREST HACKERS ALLEGEDLY BEHIND STRING OF RANSOMWARE ATTACKS

Europol has arrested five individuals who have been accused of a string of ransomware attacks affecting more than 1,800 victims worldwide. The police also seized cryptocurrency assets, including almost four million hryvnias (around $110,000), and other alleged evidence of illegal activities.

techcrunch.com3 min read