TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2023-12-04

5 sections14 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

SECURITY FLAWS IN COURT RECORDS SYSTEMS USED IN FIVE US STATES EXPOSED SENSITIVE DOCUMENTS

Jason Parker discovered that witness lists and testimony, mental health evaluations, trade secrets, and other court records were publicly accessible in unredacted form by court records systems in five different states. Parker alleged that some of the vulnerabilities were as simple as incrementing a record number. In this article, Parker details the responses received from the various court systems that vary from open communication to refusal to fix the vulnerabilities.

techcrunch.com5 min read

STAPLES CONFIRMS CYBERATTACK BEHIND SERVICE DISRUPTIONS

Staples announced that it has taken proactive steps to mitigate cybersecurity risks and protect customer data. Employees reported a disruption to internal tools and online order fulfillment has been delayed. BleepingComputer attests that no ransomware was deployed and no files have been encrypted.

bleepingcomputer.com2 min read

CRITICAL 'LOGOFAIL' BUGS OFFER SECURE BOOT BYPASS FOR MILLIONS OF PCS

Hundreds of consumer and enterprise-grade x86 and ARM models from various vendors, including Intel, Acer, and Lenovo, are potentially vulnerable to bootkits and takeover. ‘LogoFAIL’ reveals significant security vulnerabilities in the image parsing libraries used by nearly all BIOS vendors to display logo images during boot.

darkreading.com5 min read

02STRATEGIES & TACTICS

SECURING THE FRONTEND: A PRACTICAL GUIDE FOR DEVELOPERS

This blog post delves into the relationship between frontend development and cybersecurity by exploring challenges, best practices, and successful implementations. The goal is to guide developers in navigating the complexities of building a secure frontend without compromising the user experience.

medium.com12 min read

HOW GITLAB'S RED TEAM AUTOMATES C2 TESTING

In this blog post, Gitlab talks about how their red team conducts security exercises that simulate real-world threats to assess and improve the effectiveness of the organization's security measures. The team uses open-source command and control (C2) tools, such as the Mythic framework, to customize and combine different open-source options to evade detection.

about.gitlab.com10 min read

IMPROVE YOUR INCIDENT RESPONSE WITH JUPYTER NOTEBOOKS

This blog post from AWS presents a method for using Jupyter notebooks to document incident response processes, with executable snippets. Using Jupyter notebooks for IR playbooks can aid in making more readable code for analysts as well as standardizing analysis and response. The blog post also contains a tutorial for creating a Jupyter notebook for IR in AWS using Sagemaker.

aws.amazon.com6 min read

03LAUNCHES & TOOLS

KUBECTL-IAM4SA

kubectl-iam4sa is a command line program for debugging IAM roles for Kubernetes service accounts. The tool requires the user to have access to the Kubernetes cluster, AWS IAM, and AWS CloudTrail.

github.comGitHub repository

OPEN-APPSEC

open-appsec builds on machine learning to provide preemptive web app & API threat protection against OWASP-Top-10 and zero-day attacks. It can be deployed as an add-on to Kubernetes Ingress, NGINX, and API Gateways.

github.comGitHub repository

THREAT DRAGON

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram.

github.comGitHub repository

04MISCELLANEOUS

WHATSAPP’S NEW SECRET CODE FEATURE HIDES LOCKED CHATS

WhatsApp has launched a new feature that enables users to hide their Locked Chats folder from appearing in standard search results or browsing. The new Secret Code feature will allow users to set a code specifically for securing Locked Chats. Secret Codes has begun rolling out globally.

bleepingcomputer.com2 min read

NEW ANDROID BANKING MALWARE, “FJORDPHANTOM”

Using social engineering tactics, FjordPhantom tricks unsuspecting users into downloading and installing the malicious app disguised as a legitimate banking app. The malware also employs techniques to evade detection and maintain persistence on infected devices.

promon.co6 min read

IT'S TURTLES ALL THE WAY DOWN 🐢

This post dives into a new ransomware sample for macOS dubbed “Turtle”. It concludes that while in its current state, it does not pose much of a threat to macOS users, it shows that ransomware authors are continuing to set their sites on macOS.

objective-see.org7 min read