TLDR INFORMATION SECURITY 2023-12-08

Start with an exclusive offer for TLDR readers today!

KIDSECURITY’S USER DATA COMPROMISED AFTER APP FAILED TO SET A PASSWORD

A popular parental control app for Android, KidSecurity, provides parents with the ability to set app limits, track their children, and listen to sounds around their children. Researchers discovered an ElasticSearch instance belonging to the app that had no authentication configured. This led to the exposure of private information including phone numbers, email addresses, and portions of credit cards.

EXPERTS WARN OF SNEAKY FAKE LOCKDOWN MODE ATTACK

Researchers from Jamf have discovered that an attacker could run a trojan on a compromised iPhone running iOS 16 to hook into Lockdown mode and bypass its security mechanisms. This post-exploitation technique could allow an attacker to continue persisting on a compromised device while providing users with a false sense of security. Jamf notes that Lockdown mode was moved to the kernel level in iOS 17 which would prevent their attack.

ATLASSIAN ANNOUNCES FIXES FOR FOUR CRITICAL RCE VULNERABILITIES

Atlassian has released fixes for four different vulnerabilities in various products that each could be utilized to achieve RCE. The flaws include a vulnerability in a third-party deserialization library, a template injection flaw in Confluence, an Assets Discovery flaw that could allow RCE on any machines with the agent installed, and a flaw that could allow for RCE via WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper.

DETECTING RUNTIME SECURITY THREATS IN ECS

Amazon GuardDuty has launched a new feature for runtime monitoring on ECS clusters. Runtime Monitoring for ECS checks hundreds of threat vectors to produce 30 different finding categories that can be sent to EventBridge, Security Hub, or Detective. Runtime Monitoring is supported on Fargate and on EC2-based clusters.

CUEING UP A CALCULATOR: AN INTRODUCTION TO EXPLOIT DEVELOPMENT ON LINUX

This blog post focuses on writing a one-click malicious webpage that exploits CVE-2023-43641, an out-of-bounds array access vulnerability in libcue that allows attackers to overwrite the memory of a process. It explains the challenges of bypassing mitigations such as no-execute memory, ASLR, and stack canaries. The post provides insights into ASLR, heap layout, and the development of an exploit targeting libcue in tracker-extract.

UNICODE XSS VIA COMBINING CHARACTERS

This gist demonstrates a variant of unicode XSS using character combinations. It also demonstrates how such an attack works and provides the root cause, as well as suggesting approaches for detecting unicode normalization, and flagging such occurrences to be manually inspected.

WHEN: December 20 - join here ↗️

APK.SH

apk.sh makes reverse engineering Android apps easier. It automates some repetitive tasks like pulling, decoding, rebuilding, and patching an APK.

DECOMPILER EXPLORER

Decompiler Explorer allows you to see decompile output for various decompilers like angr, binary-ninja, and Ghidra. There's a hosted website at dogbolt.org that serves as a frontend but it retains any uploaded binaries.

ADOKIT

ADOKit is a modular toolkit that helps build attacks against Azure DevOps Services using their REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance.

HOW THE FIRST GEN IPOD WAS REVERSE ENGINEERED TO RUN #ROCKBOX

This thread discusses how the original iPod was reverse engineered using a specially crafted HTML webpage to run Rockbox.

GMAIL’S AI POWERED SPAM DETECTION IS ITS BIGGEST UPDATE IN YEARS

Google announced that its new text classification system, RETVec, has been integrated into Gmail’s spam filters. RETVec is designed to combat adversarial text attacks such as those which utilize homoglyphs to bypass detection. It has been open sourced and can be run locally on lower-powered devices.

ANALYSIS OF NORTH KOREAN HACKERS’ TARGETED PHISHING SCAMS ON TELEGRAM

Slowmist, a blockchain security company, conducted an analysis of the North Korean hacking group Lazarus' tactics in Telegram. They found that the hackers employ various tactics, such as convincing project teams to download malicious scripts or inserting malicious links on event pages. Users should take immediate action in case of malware infection and to protect accounts.

APPLE CONFIRMS GOVERNMENTS USING PUSH NOTIFICATIONS TO SURVEIL USERS

Apple has confirmed that unidentified Governments have been using push notifications to surveil users.

23ANDME UPDATES USER AGREEMENT TO PREVENT DATA BREACH LAWSUITS

Genetic testing provider 23andMe has updated its Terms of Use to make it more difficult for customers to sue the company in response to multiple lawsuits following a data breach.

META BEGINS DEFAULT END-TO-END ENCRYPTION FOR MESSENGER ROLLOUT

After years of testing, Meta has announced that it will be rolling out default end-to-end encryption for all users on Messenger. Meta reports that the rollout took so long as many features of Messenger had to be completely rebuilt to work with end-to-end encryption.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930