TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-07-03

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

LONG

Security positions are in high demand. They offer excellent compensation and stability amid a shakier tech ecosystem.

degrees.snhu.eduSponsor

02ATTACKS & VULNERABILITIES

REGRESSHION: REMOTE UNAUTHENTICATED CODE EXECUTION VULNERABILITY IN OPENSSH SERVER

A vulnerability from 2006 has been reintroduced in OpenSSH. This vulnerability is caused by a signal handler race condition and could allow for unauthenticated remote code execution as root on glibc-based Linux systems. Qualys identified over 14 million potentially vulnerable internet-facing SSH servers and recommends immediate patching to prevent exploitation.

blog.qualys.com6 min read

JUNIPER NETWORKS RELEASES EMERGENCY PATCHES FOR CRITICAL VULNERABILITY

Juniper Networks has released emergency patches for routers due to a critical CVE. The vulnerability is an authentication bypass in Juniper Networks' Session Smart Routers and Conductors running with a redundant peer. Juniper does not have evidence of ongoing exploitation but urges immediate patching.

theregister.com2 min read

EVOLVE BANK DATA BREACH IMPACTED FINTECH FIRMS WISE AND AFFIRM

Fintech firms Wise and Affirm were impacted by a recent data breach at Evolve Bank. Evolve Bank & Trust confirmed the security breach and is investigating the incident. Affirm and Wise are reaching out to customers whose data may have been compromised.

securityaffairs.com3 min read

03STRATEGIES & TACTICS

MITIGATING SKELETON KEY, A NEW TYPE OF GENERATIVE AI JAILBREAK TECHNIQUE

Researchers at Microsoft found a new generative AI jailbreak technique to avoid guardrails in models. The Skeleton Key attack involves asking the model to augment its behavior as opposed to modifying it by having the model provide a warning before the blocked content instead of refusing to produce it. This blog provides examples of Skeleton Key prompts and some suggestions, such as output filtering, to mitigate this attack.

microsoft.com6 min read

ATTACK PATHS INTO VMS IN THE CLOUD

A comprehensive overview of different attacks against VM services from AWS, Azure, and GCP. The overview examines six classes of attack vectors and provides a scenario, overview, example attack, and mitigation for each attack. The attack vectors are vulnerability exploitation, startup script manipulation, SSH key push, direct code execution, SSH over middleware, and serial console access.

unit42.paloaltonetworks.com14 min read

EXTENDING BURP SUITE FOR FUN AND PROFIT - THE MONTOYA WAY

The first part of an ongoing series on building Burp Suite extensions using the new Montoya API. The first post explains Burp Extender and the Montoya API and walks through the process of setting up your environment to build a Hello World extension. Subsequent posts include topics such as interacting with HTTP requests and websockets, modifying the UI, and adding functionality to the context menu.

security.humanativaspa.it5 min read

04LAUNCHES & TOOLS

INTRODUCING DETECTION AS CODE BETA SUPPORT IN RUNREVEAL

RunReveal has introduced Detection as Code in beta, enabling users to manage security detections using code. This feature integrates with the runreveal CLI, allowing easy export and import of detections in JSON or YAML formats. Users can create, test, and deploy new detections efficiently, with GitHub actions supporting CI/CD workflows.

blog.runreveal.com6 min read

HSC24REDTEAMINFRA

This repository includes the slides and code used for the workshop Red Team Infrastructure Automation at HSC24. It also includes some automation scripts to start with for redirectors, teamservers, RedELK, and more.

github.comGitHub repository

CHROMEDB

Chromedb is a tool that can read Chromium data like cookies and local storage straight from disk without spinning up the browser.

github.comGitHub repository

05MISCELLANEOUS

SUPPLY CHAIN COMPROMISE LEADS TO TROJANIZED INSTALLERS FOR NOTEZILLA, RECENTX, COPYWHIZ

Trojanized installers for Notezilla, RecentX, and Copywhiz have been discovered distributing malware capable of stealing information and executing additional payloads. The malware observed can steal browser credentials, cryptocurrency wallet information, clipboard contents, and keystrokes. These malicious installers, belonging to a malware family known as dllFake, were distributed through the official website and have been active since early June.

rapid7.com9 min read

BYTECODE BREAKDOWN: UNRAVELING FACTORIO'S LUA SECURITY FLAWS

This blog post provides a detailed breakdown of the flaws in Lua runtime that led to an exploit in the video game Factorio. It's possible to leak memory addresses and manipulate objects in memory by exploiting Lua's handling of numbers as doubles. This manipulation allows for security flaws like bypassing ASLR in programs using Lua.

memorycorruption.net47 min read

EXPOSING FAKEBAT LOADER: DISTRIBUTION METHODS AND ADVERSARY INFRASTRUCTURE

The Fakebat loader is a widespread loader malware sold as a service on cybercrime forums since at least December 2022. It is distributed through malvertising, fake software updates, and social engineering tactics. The malware offers anti-detection features and targets popular software applications.

blog.sekoia.io13 min read