TLDR INFORMATION SECURITY 2024-08-05

See Rippling IT in action →

MASSIVE SMS STEALER CAMPAIGN INFECTS ANDROID DEVICES IN 113 COUNTRIES

Researchers are tracking a campaign that utilizes 2,600 Telegram bots to promote malicious Android APKs controlled by 13 C2 servers. The bots deliver the malware by either directing victims to fake download pages that mimic Google Play or by promising to deliver victims a pirated APK. The malware transmits captured SMS messages to a website that offers anonymization services by using these phone numbers to relay OTP codes.

STACKEXCHANGE ABUSED TO SPREAD MALICIOUS PYPI PACKAGES AS ANSWERS

Checkmarx researchers have discovered an infostealer campaign targeting users of the Raydium and Solana blockchains. The campaign published a set of PyPi packages purporting to be official packages and then posted high quality responses on StackExchange threads that promoted the malicious packages. The packages were downloaded over 2,000 times before being removed from PyPi.

NEW BLANKBOT ANDROID TROJAN CAN STEAL USER DATA

A new Android trojan called BlankBot, aimed at Turkish users, offers attackers extensive malicious capabilities. It poses as utility apps and tricks users into granting permissions. BlankBot can log device information, steal sensitive data, and perform custom injections.

WHERE TO STORE JWTS

This post breaks down the pros and cons of storing JWT tokens in cookies vs Session/Local Storage. Neither option is completely secure. Cookies used with HttpOnly are protected from JavaScript but they are vulnerable to CSRF and can be used in XSS attacks because the browser will send them on every request. Session and Local Storage are not vulnerable to CSRF but are designed to be accessed from JavaScript and are also vulnerable to XSS. Session Storage is per-tab, so users that open a link in a new tab will be logged out in that tab.

AN OPINIONATED RAMP UP GUIDE TO AWS PENTESTING

This article begins with discussing some dark patterns in cloud pentesting before offering a 7 stage roadmap to ramp up in AWS pentesting. The first couple of stages begin with solving Red Team labs with official and community walkthroughs before beginning to do CTFs independently. The next couple of stages involve automating exploits for CTFs and learning to build a secure AWS environment with CloudSLAW. The final stages focus on filling in knowledge gaps, synthesizing knowledge, and continuous learning.

APPSEC GUIDES, NOT GATES: INTRODUCING SECURE GUARDRAILS WITH SEMGREP

Use secure guardrails instead of traditional “shift-left” gates. Secure guardrails integrate directly into developer workflow, should offer autofixes or advice that aligns with organization policies, and should empower developers to write more secure code and use secure-by-default libraries while also allowing developers to adjust or override guardrails when needed. Semgrep can be used to implement secure guardrails and provides a scorecard to grade your implementation of secure guardrails.

PROMPT AIRLINES (WEBAPP)

Prompt Airlines is an AI Security CTF that contains 5 levels of increasingly difficult challenges. The ultimate goal is to manipulate an AI chatbot to get a free airline ticket.

DIOPTRA

Dioptra is a software test platform for assessing the trustworthy characteristics of AI. Trustworthy AI is valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair - with harmful bias managed.

URLHUNTER

urlhunter is a recon tool that enables search on URLs exposed via shortener services such as bit.ly and goo.gl.

LAW FIRMS HIT WITH AVERAGE RANSOM DEMAND OF $2.5 MILLION

Since 2018, 138 legal firms globally have confirmed ransomware attacks affecting 2.9 million records. 2023 saw the most attacks (45) and records impacted (1.6 million). Average ransom demands are $2.47 million, with $1.65 million typically paid.

PANAMORFI: A NEW DISCORD DDOS CAMPAIGN

Researchers have uncovered a new DDoS campaign called Panamorfi targeting misconfigured Jupyter Notebooks. It uses a Java-based tool, mineping, to launch TCP flood attacks. The attack exploits exposed Jupyter instances to download malicious files, which then connect to a Discord channel and execute the DDoS tool, overwhelming target servers.

YOU CAN'T SPELL WEBRTC WITHOUT RCE - PART 2

This post discusses leveraging vulnerabilities in iOS to achieve full Remote Code Execution (RCE) in WebRTC based protocols. It covers topics like breaking Address Space Layout Randomization (ASLR) and exploiting shared libraries like SignalServiceKit. By chaining together various leaks and utilizing ARM64 ROP chains, the researchers successfully achieved their goal of leaking Signal-iOS's database.

HACKERS BREACH ISP TO POISON SOFTWARE UPDATES WITH MALWARE

A Chinese hacking group named StormBamboo compromised an ISP to inject malware into software updates by exploiting insecure update mechanisms.

APT28 TARGETS DIPLOMATS WITH HEADLACE MALWARE VIA CAR SALE PHISHING LURE

A Russia-linked group used car-for-sale phishing lure to target diplomats with a Windows backdoor called HeadLace.

CISA NAMES FIRST CHIEF ARTIFICIAL INTELLIGENCE OFFICER

CISA appointed Lisa Einstein as its first Chief Artificial Intelligence Officer to advance cybersecurity efforts in using AI responsibly.