TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-01-31

5 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

ACTIVELY EXPLOITED VULNERABILITY IN HITRON DVRS: FIXED, PATCHES AVAILABLE

The Akamai Security Intelligence Response Team (SIRT) has discovered vulnerabilities in multiple Hitron DVR device models that are actively being exploited. The vulnerabilities allow an authenticated attacker to achieve OS command injection using default credentials. Hitron Systems has released new firmware versions to address the vulnerabilities and advises users to upgrade to firmware version ≥ 4.03.

akamai.com3 min read

MALWARE CAMPAIGN USING ARS TECHNICA HAD NOVEL ATTACK TO FLY UNDER THE RADAR

Ars Technica and Vimeo were used to covertly serve malware via a novel attack hiding in image/video links. Payloads were disguised as Base64-encoded random strings. The first-stage infected devices and then fetched the strings, decoding them to install second-stage malware.

arstechnica.com3 min read

02STRATEGIES & TACTICS

RIDING THE AI WAVES: THE RISE OF ARTIFICIAL INTELLIGENCE TO COMBAT CYBER THREATS

AI is transforming cybersecurity with machine learning to adapt to evolving threats. This post dives into how AI has been evolving over the last two decades, from spam filters to predictive analytics. This rise has democratized AI, empowering more sophisticated attacks. While AI is indispensable for modern cyber protection, its dual-use nature poses risks.

blogs.blackberry.com10 min read

EXTRACTING STRINGS FROM GO AND RUST EXECUTABLES

The Mandiant FLARE team has released a new version of FLOSS that contains specialized algorithms for extracting strings from Go and Rust binaries. These languages use structs to determine string length as opposed to null-terminated strings which leads to strings.exe struggling to extract strings. This post includes details of how strings are stored in the languages and how FLOSS detects them.

mandiant.com8 min read

MASTERING KUBERNETES SECURITY: SAFEGUARDING YOUR CONTAINER KINGDOM

A post from Red Canary that looks at Kubernetes security through the 4C security model with a particular focus on Container and Cluster threat models. The Container section focuses on issues such as malicious containers and on-the-fly containers. The Cluster section focuses on common misconfigurations and contains remediation advice.

redcanary.com10 min read

03LAUNCHES & TOOLS

Sponsored

🪟 “SINGLE PANE OF GLASS” — EMPTY BUZZWORD OR MEANINGFUL APPROACH TO VULNERABILITY MANAGEMENT?

Single Pane of Glass (SPOG) has long been derided as vendor-speak. But is it actually useful in describing the way enterprises manage vulnerabilities in sprawling IT environments [11]? In this upcoming webinar, Scott Kuffer, Co-Founder and COO of Nucleus Security [11] and a special expert guest, will discuss what a SPOG actually is, and offer actionable tips for elevating your vulnerability management

nucleussec.comSponsor

VULS

Agentless vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, and Network devices.

github.comGitHub repository

TOMCTER

Tomcter is a Python tool developed to brute force Apache Tomcat manager logins with default credentials. Tomcter also works with proxychains.

github.comGitHub repository

APIDETECTOR

APIDetector is a multithreaded tool for testing exposed Swagger endpoints in various subdomains. It is customizable and can test http or https endpoints. APIDetector features false-positive detection capabilities.

github.comGitHub repository

04MISCELLANEOUS

9 WAYS TO GAIN EXPERIENCE IN CYBER SECURITY

A blog post from TryHackMe that suggests ways to gain experience in cybersecurity. The suggestions include work placements, volunteering, CTF events, networking, home labs, bug bounties, and open source projects.

tryhackme.com4 min read

DEFENDING AGAINST THE ATTACK OF THE CLONE[D WEBSITE]S!

This article discusses the release of two new versions of the Cloned Website Canarytoken, which alerts users when an attacker is using an Adversary-in-the-Middle attack against their sites.

blog.thinkst.com7 min read