TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-07-24

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

TELEGRAM ZERO-DAY ENABLED MALWARE DELIVERY

ESET discovered a vulnerability in Telegram for Android dubbed EvilVideo which allows attackers to disguise malicious APK files as videos. The exploit uses Telegram's automatic file downloading so when users play the "video," they're prompted to install a malicious app.

securityweek.com3 min read

SAFETY GEAR GIANT CADRE HOLDINGS REPORTS CYBERSECURITY BREACH

Cadre Holdings reported a cybersecurity breach on July 15. The company detected unauthorized access to its systems, promptly initiated response protocols, and engaged external experts. While certain operations are affected, the full impact remains unclear. Cadre is working to restore normal operations and continues to investigate the incident.

thecyberexpress.com2 min read

SQUARESPACE PUBLISHES ABOUT DOMAIN HIJACKING INCIDENTS

Squarespace has published an incident report about how some Squarespace Domains customers had their accounts compromised, leading to unauthorized changes in domain settings. Squarespace suspended affected accounts for security and restored access after verifying customer identities. It has strengthened security measures and continues to monitor for any abnormal activity.

status.squarespace.com3 min read

03STRATEGIES & TACTICS

UNIVERSAL CLOUD THREAT MODEL

Securosis and PrimeHarbor Technologies put together a provider and industry agnostic threat model for cloud environments. The model covers threat actors, objectives, targets, and techniques. The authors note that the vast majority of cloud attacks are untargeted/undifferentiated as even small targets can provide financial incentives.

securosis.com18 min read

GETTING STARTED WITH EXPLOIT DEVELOPMENT

A collection of courses to learn exploit development. The list of resources begins with buffer overflows before moving on to return oriented programming and other forms of corruption vulnerabilities. Each link includes an explanation of why that resource was chosen.

dayzerosec.com10 min read

A FIVE YEAR RETROSPECTIVE ON DETECTION AS CODE

Detection as Code is the concept of taking advantage of the codifying process when writing detections. Detection as Code does not require the use of a full programming language and goes beyond storing detections in Sigma format. The future of Detection as Code lies in utilizing test driven development and CI/CD pipelines as well as utilizing LLMs to audit and improve context around detections.

magonia.io5 min read

04LAUNCHES & TOOLS

PROTEXXA (PRODUCT LAUNCH)

Protexxa is an AI-powered platform that helps companies understand their cyber health. It finds exposed passwords, provides incident response plans, and recommends improvements.

protexxa.com

BLT

OWASP BLT is a bug logging tool to report issues and get points.

github.comGitHub repository

RESPOTTER

Respotter is a honeypot designed to detect running instances of Responder. Respotter sends requests for a bogus host name and takes advantage of the fact that Responder will respond to any query.

github.comGitHub repository

05MISCELLANEOUS

GOOGLE'S PLAN TO TURN OFF THIRD-PARTY COOKIES IN CHROME IS DYING

Google has abandoned plans to disable third-party cookie tracking by default in Chrome. Instead, users will be asked to make an informed choice about tracking across websites. This decision follows years of testing and delays as early tests of Google's Privacy Sandbox alternative showed weaker results for re-marketing efforts.

theverge.com3 min read

CROWDSTRIKE'S UBIQUITY UNDER FIRE AS CONGRESS CALLS FOR CEO TO TESTIFY

The House Committee on Homeland Security has demanded transparency from CrowdStrike CEO George Kurtz following major global outages caused by a software defect. The committee seeks detailed explanations of the incident and CrowdStrike's mitigation steps.

arstechnica.com3 min read