TLDR INFORMATION SECURITY 2024-02-19

👉 Download the kit from SecureFrame (free!)

EXPRESSVPN USER DATA EXPOSED DUE TO BUG

ExpressVPN disabled split tunneling on Windows clients to fix a bug introduced in May 2022 which caused DNS requests to bypass its servers. This bug exposed domain visits to ISPs when using split tunneling with app-specific VPN routing. Though traffic stayed encrypted, the DNS leak defeated privacy protections.

U.S. INTERNET LEAKED YEARS OF INTERNAL, CUSTOMER EMAILS

U.S. Internet’s 'Securence' email-providing division had a publicly exposed webpage that listed every email of its 6,500 clients. The CEO of the company stated that the exposure was caused by a mistake in an Ansible playbook controlling the nginx config. U.S. Internet has not commented on how long this misconfiguration was in place or why appropriate controls were not in place to detect or prevent the misconfiguration.

COMMUNITY ALERT: ONGOING MALICIOUS CAMPAIGN IMPACTING AZURE CLOUD ENVIRONMENTS

Proofpoint researchers have identified an ongoing malicious campaign targeting Microsoft Azure environments that has compromised hundreds of user accounts, including accounts from senior executives, through credential phishing and account takeover techniques. The attackers' operational infrastructure includes proxies and data hosting services. The threat is not currently attributed to any known threat actor.

HOW TO WEAPONIZE LLMS TO AUTO-HIJACK WEBSITES

LLMs can autonomously hack websites when paired with tools enabling system interaction. Despite safety efforts, LLMs weaponized without human guidance can compromise vulnerable websites through automated browsing and planning. Weaponized LLMs can break into buggy web apps without knowledge of vulnerabilities, showing that they can hack without oversight.

CHARMINGCYPRESS: INNOVATING PERSISTENCE

CharmingCypress is an Iranian-backed threat actor that engages in spear-phishing campaigns to gather information on political opponents. It engages in unique campaigns that involve long email exchanges before sending malicious links, and in some cases, even creating a malicious VPN and fake webinar application. IOCs are included in the article.

IN-DEPTH ANALYSIS-THE ISFB FIRST LOADER

This post provides an in-depth analysis of the ISFB first loader malware variant. It details the process of analyzing the malware, from using tools like "pestudio" to identifying potential packing to examining memory allocations and process injections. The post offers insights into the complexity and evasion techniques utilized by the ISFB variant through a detailed exploration of the malware's code and behavior.

GAPCAST

Gapcast accurately detects router clients to analyze, capture, and inject packets.

PSFUZZ

Discover with ProSecFuzz hidden files and directories on a web server.

THE HTTP GARDEN

The HTTP Garden is a set of HTTP servers and proxies configured to be composable. It has scripts for interacting with them in a way that makes finding vulnerabilities easier.

ZEUS, ICEDID MALWARE GANGS LEADER PLEADS GUILTY, FACES 40 YEARS IN PRISON

Vyacheslav Penchukov, a leader of the Zeus/IcedID malware groups, has pleaded guilty to cybercrime charges. He was first arrested in 2022 after his involvement in a major theft using Zeus and now faces 40 years in prison. His prosecution is a win against infamous malware operations.

WYZE CAMERAS LET SOME OWNERS SEE INTO A STRANGER’S HOME — AGAIN

Wyze suffered another security lapse that allowed some users to briefly view feeds from strangers' cameras in their app's Events tab. At least 12 such cases were reported. The flaw follows a previous incident that enabled unauthorized live access to Wyze devices.

ALMOST EVERY INFRASTRUCTURE DECISION I ENDORSE OR REGRET AFTER 4 YEARS RUNNING INFRASTRUCTURE AT A STARTUP

A (very) deep dive into one Infrastructure Engineer’s decision-making process at a startup. The post is divided by topic and includes an endorse or reject verdict for each decision with accompanying reasoning. The topics include choice of cloud platform, security products to adopt, and SaaS applications.

2024 STATE OF APPLICATION SECURITY REPORT

Some highlights of the report include the finding that 54% of major code changes get a full security review and that 34% of organizations review over 75% of code changes.

PROTECT GOOD FAITH SECURITY RESEARCH GLOBALLY IN PROPOSED UN CYBERCRIME TREATY

A letter from the EFF to the UN outlining issues with the draft UN Cybercrime Treaty that could lead to prosecution of good faith security researchers.

FEDS DISMANTLE RUSSIAN GRU BOTNET BUILT ON 1,000+ HOME, SMALL BIZ ROUTERS

The US government disrupted a botnet used by Russia's GRU military intelligence unit for phishing, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930