TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-07-05

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

3 MILLION IOS AND MACOS APPS WERE EXPOSED TO POTENT SUPPLY-CHAIN ATTACKS

A group of researchers discovered 3 vulnerabilities in the CocoaPods trunk server. The first vulnerability allows attackers to social engineer pod developers by spoofing the XFH header when sending developers an email for authentication to generate a link to an attacker-controlled server. The second vulnerability allows attackers to take over abandoned pods without proof of ownership. The third vulnerability allows attackers to execute remote code on trunk servers with malicious MX records.

arstechnica.com3 min read

LATEST INTEL CPUS IMPACTED BY NEW INDIRECTOR SIDE-CHANNEL ATTACK

Researchers have discovered a new Branch Target Injection vulnerability in Intel CPUs that could be used to steal sensitive information. The attack has three components: the iBranch Locator uses eviction-based techniques to identify the indices and tags of victim branches and determine the Indirect Branch Predictor entries for them, targeted injections are then performed against the prediction structures to perform speculative code execution, and then an ASLR bypass makes the prediction and manipulation of control flow of protected processes easier. The researchers reported their findings to Intel and recommended more aggressive use of the Indirect Branch Protection Barrier and bolstering the Branch Prediction Unit design.

bleepingcomputer.com2 min read

TWILIO CONFIRMS DATA BREACH AFTER HACKERS LEAK 33M AUTHY USER PHONE NUMBERS

The ShinyHunters hackers announced that they will leak 33M random phone numbers associated with Authy. Twilio has confirmed the breach. It reported that the vulnerability was due to an unauthenticated endpoint and that no systems were compromised. Twilio has secured the endpoint and is encouraging users to be vigilant for phishing and smishing attacks.

securityweek.com1 min read

02STRATEGIES & TACTICS

AMAZON DOCUMENTDB ANNOUNCES IAM DATABASE AUTHENTICATION

Amazon DocumentDB has added support for authentication using IAM users and role ARNs. Users and applications that connect to DocumentDB clusters can now use an IAM identity to authenticate, allowing for a passwordless experience. Clusters can also choose to allow both IAM and password authentication if desired.

aws.amazon.com2 min read

VULNERABILITIES IN COCOAPODS OPEN THE DOOR TO SUPPLY CHAIN ATTACKS AGAINST THOUSANDS OF IOS AND MACOS APPLICATIONS

Researchers from Evasec have found vulnerabilities in CocoaPods that could let attackers insert malicious code into popular iOS and macOS apps by claiming ownership of unclaimed pods. Developers using CocoaPods should check their open source dependencies for security risks, as these vulnerabilities could lead to supply chain attacks affecting thousands of Apple device apps. CocoaPods has addressed the vulnerabilities, but organizations should follow security steps to protect their code from potential exploits.

evasec.io12 min read

THE RUNTIME SECRETS' SECURITY GAP

This blog post discusses a new solution that introduces encrypted secret delivery directly into application memory to prevent exposure. Secrets can be securely stored, delivered, and accessed without compromising security using tools like tang, clevis, and latchy.

blog.gitguardian.com6 min read

03LAUNCHES & TOOLS

DECLARE YOUR AINDEPENDENCE: BLOCK AI BOTS, SCRAPERS, AND CRAWLERS WITH A SINGLE CLICK

Cloudflare has launched the ability for all accounts (including free accounts) to block all AI bots, crawlers, and scrapers with a single toggle under the Security -> Bots section. Cloudflare uses its global bot detection ML model to categorize traffic as potentially bot related. Under the new heuristic, traffic classified with a bot score under 30 will be blocked automatically.

blog.cloudflare.com7 min read

DNSTWIST

DNSTwist lets you find lookalike domains that adversaries can use to attack your domain. This can let you detect typosquatters, phishing attacks, fraud, and brand impersonation. It can be useful as an additional source of targeted threat intelligence.

github.comGitHub repository

FILELESS-ELF-EXEC

fileless-elf-exec is a Python script that generates interpreted code which creates the supplied ELF as a file in memory and executes it. This makes it possible to execute binaries without leaving traces on the disk.

github.comGitHub repository

04MISCELLANEOUS

INTRODUCING DOCS IN PROTON DRIVE

Proton is introducing end-to-end encrypted document editing and sharing to Proton Drive. The company states that all files, media, metadata, and keystrokes are completely encrypted and cannot be accessed by Proton or government surveillance (as it operates under Swiss privacy laws). Proton has begun rolling the feature out and it will be available to all users within the next few days.

proton.me3 min read

NEW GOLANG-BASED ZERGECA BOTNET CAPABLE OF POWERFUL DDOS ATTACKS

A new botnet named Zergeca can launch powerful DDoS attacks and has advanced capabilities like proxying and reverse shell. It is written in Golang and uses DNS-over-HTTPS for communication with its command-and-control servers. The botnet has been actively targeting countries like Canada, Germany, and the U.S. with various attack methods.

thehackernews.com2 min read

MALLOX RANSOMWARE: LINUX VARIANT DECRYPTOR FOUND

Mallox ransomware, which has been active since 2021, has evolved to target Linux systems using custom Python scripts for payload delivery and data exfiltration. The new variant employs AES-256 CBC encryption, appends .lmallox to encrypted files, and utilizes a Flask-based web panel for creating customized ransomware builds. Researchers have discovered decryptors for several build IDs and provided methods for detecting and hunting Mallox infrastructure using security tools like Uptycs XDR and search engines such as FOFA and Censys.

uptycs.com10 min read