TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-06-12

6 sections19 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

SOC 2 COMPLIANCE KIT

Security compliance can be complicated. This free SOC 2 compliance kit simplifies the process with key assets you'll need to get your report.

secureframe.comSponsor

02ATTACKS & VULNERABILITIES

NEW YORK TIMES SOURCE CODE STOLEN USING EXPOSED GITHUB TOKEN

An attacker posted an archive of stolen source code and data belonging to the New York Times onto 4chan. The leaker claims to have accessed the source code via a compromised GitHub token which was confirmed by The Times. The Times stated that the leak did not impact any internal corporate systems or operations.

bleepingcomputer.com2 min read

MALICIOUS VSCODE EXTENSIONS WITH MILLIONS OF INSTALLS DISCOVERED

A group of Israeli researchers managed to infect over 100 organizations by typosquatting the Dracula extension. The researchers created a domain for their typosquatted extension, which allowed them to become a verified publisher and increase credibility. They identified over 1,200 extensions that were known to have malicious code on the VSCode extension marketplace.

bleepingcomputer.com2 min read

UPDATES FOR SECURITY ISSUE AFFECTING INTELLIJ-BASED IDES 2023.1+ AND JETBRAINS GITHUB PLUGIN

JetBrains has disclosed security issues affecting IntelliJ-based IDEs and the JetBrains GitHub Plugin leading to an access tokens leak. The issue has been fixed in the latest IDE versions. Users are urged to update and revoke any affected GitHub tokens. JetBrains has provided instructions on how to revoke tokens and set up the plugin again if needed.

blog.jetbrains.com2 min read

03STRATEGIES & TACTICS

A GUIDE TO KUBERNETES LOGS THAT ISN'T A VENDOR PITCH

This post explains logging in Kubernetes clusters using the 4Cs of cloud-native security framework. Code level logging can be achieved with sidecar pods. Cloud level logging relies on the specific cloud's services (for example CloudTrail on AWS). Container level logging isn't generally helpful for security. The post contains a deep dive into using and enabling AuditPolicy to collect logs at the cluster level.

grahamhelton.com6 min read

WHAT HAPPENED TO RASP?

A blog post looking at the decline of RASP and the rise of ADR. The post outlines various nontechnical and technical critiques that stymied RASP's implementation such as unclear time-to-value and added complexity. It concludes by looking at how ADR might address some of these concerns but concludes that it's too early to tell if it will succeed.

ramimac.me5 min read

TECHNICAL ANALYSIS OF THE LATEST VARIANT OF VALLEYRAT

The ValleyRAT malware uses a multi-stage process involving DLL sideloading, process injection, and shellcode execution to establish connections with a command-and-control server for downloading further malicious payloads. The malware utilizes encryption, decryption, and hashing algorithms to dynamically load and execute embedded DLLs, collect system information, and carry out specific actions based on the victim host's configuration. ValleyRAT conducts device fingerprinting to gather detailed information about the infected system, such as IP address, system uptime, hardware details, and user privileges, aiding in its malicious activities.

zscaler.com10 min read

04LAUNCHES & TOOLS

RATIFY

Ratify is a verification engine that enables verification of artifact security metadata and admits for deployment only those that comply with defined policies.

github.comGitHub repository

GEMINI YOUTUBE RESEARCHER (PYTHON NOTEBOOK)

This Python Notebook demonstrates searching for YouTube videos, takes 5 results, "listens" to their audio tracks, summarizes them, and then assembles a report from those summaries. It could be helpful for catching up on conference talks, extracting summaries, and understanding TTPs for researchers.

github.com

EVIL NGINX PHISHING INFRA SETUP

This repository contains a guide to build a phishing engagement infrastructure setup using EvilNginx or GoPhish. The guide covers various parts of the lifecycle, from domain registration to securing the Nginx instances, and contains videos for further learning.

github.comGitHub repository

05MISCELLANEOUS

SNOWFLAKE BREACH EXPOSES 165 CUSTOMERS' DATA IN ONGOING EXTORTION CAMPAIGN

Mandiant, which is working with Snowflake on incident response, has identified that 165 customers' data has been breached. It stated that the attackers are using the Snowflake access to deploy an info-stealer malware dubbed FROSTBITE. Mandiant had previously denied responsibility and stated that the breaches were caused by a lack of MFA by customers.

thehackernews.com2 min read

CITY OF CLEVELAND SHUTS DOWN IT SYSTEMS AFTER CYBERATTACK

The City of Cleveland's IT systems have been shut down due to a cyberattack that forced essential services offline. Investigations are ongoing with third-party experts. Key services like emergency response and utilities remain unaffected. Authorities are working to provide updates as the situation unfolds.

links.tldrnewsletter.com2 min read

ANTI-CHEAT EXPERT: ALL YOUR PIXELS ARE BELONG TO US

ACE is an anti-cheat software made by Tencent, a Chinese tech giant. It has raised privacy concerns as it takes screenshots of users' entire display. ACE has components with screenshot-taking capabilities, sparking worries about data privacy and potential misuse.

invlpg.dev5 min read