TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-06-14

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

INFORMATION SECURITY

Orca's 2024 State of Cloud Security Report [4] identifies the most commonly found, yet dangerous cloud security risks.

orca.securitySponsor

02ATTACKS & VULNERABILITIES

PURE STORAGE SAYS ATTACKERS BROKE INTO A SNOWFLAKE ENVIRONMENT

Cloud storage provider Pure Storage disclosed that attackers gained unauthorized access to a Snowflake workspace containing customer telemetry data like company names, usernames, emails, and software versions. However, Pure Storage assured no sensitive data like passwords or customer-stored data was compromised.

computing.co.uk3 min read

ARM WARNS OF ACTIVELY EXPLOITED FLAW IN MALI GPU KERNEL DRIVERS

Arm has issued a security bulletin warning users of a vulnerability in the kernel drivers of Bifrost and Valhall GPUs. The vulnerability that is reportedly being actively exploited is a Use-After-Free vulnerability. These GPUs are used in smartphones, tablets, Chromebooks, various embedded devices, automotive infotainment systems, and smart TVs.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

BYPASSING EDR NTDS.DIT PROTECTION USING BLUE TEAM TOOLS

This blog post details a method for extracting NTDS hashes while bypassing EDR and OS protections. The SYSTEM hive and NTDS.dit are needed to extract these hashes. The author utilized forensics tooling to extract these files without triggering EDR or OS protections.

links.tldrnewsletter.com4 min read

HOW TO SECURELY TRANSFER FILES WITH PRESIGNED URLS

This blog post provides prescriptive guidance for generating presigned URLs that involves using tightly scoped IAM roles, unique minces, and VPC endpoints. It details a solution overview for deploying a presigned URL generation API and an access object API. The post concludes with best practices for sharing and monitoring presigned URLs such as using HTTPS for transit, tightly scoping CORS permissions, monitoring CloudWatch logs, and utilizing AWS WAF.

aws.amazon.com7 min read

5 STEPS FOR CREATING AN APPSEC PROGRAM

This post lays out 5 steps to building an AppSec program. Start by creating or updating application and infrastructure diagrams to engage security partners and gain visibility into the attack surface. Existing security tools should then be mapped to the diagrams. The limitations of those tools should be explored and then repeatable processes should be built around security. After a program reaches this level of maturity, further projects such as secure libraries, terraform modules, and DAST integrations can be pursued.

pulse.latio.tech5 min read

04LAUNCHES & TOOLS

BACKSLASH SECURITY (PRODUCT LAUNCH)

Backslash combines SCA, SAST, SBOM, VEX, and secrets detection with a single platform that uncovers the most critical risks through reachability analysis.

backslash.security

WITNESS

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

github.comGitHub repository

OPENRECALL

OpenRecall is a fully open-source, privacy-first alternative to Microsoft's Recall feature. It offers similar digital history functionality as Microsoft's Recall but functions completely on device and is cross-platform.

github.comGitHub repository

05MISCELLANEOUS

IOS 18 CRACKS DOWN ON APPS ASKING FOR FULL ADDRESS BOOK ACCESS

Apple unveiled new privacy features in iOS 18 that restrict apps from accessing users' full address books. Apps must first get permission to access contacts before users can pick which specific contacts to share. This two-step process aims to prevent apps from covertly building social networks from address books without consent.

techcrunch.com4 min read

OPERATION CELESTIAL FORCE EMPLOYS MOBILE AND DESKTOP MALWARE TO TARGET INDIAN ENTITIES

A malware called Celestial Force uses mobile and desktop malware like GravityRAT and HeavyLift to target Indian entities. The malware is managed through a tool called GravityAdmin, facilitating malicious activities on infected devices. The operation involves various campaigns that target different platforms with overlapping infrastructure to distribute malicious payloads.

blog.talosintelligence.com9 min read