TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-09-02

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

NGATE ANDROID MALWARE RELAYS NFC TRAFFIC TO STEAL CASH

A threat actor operating in Czechia evolved from utilizing PWAs and WebAPKs to utilizing the NGate malware to attack Android users of major Czech banks. The NGate malware is delivered via smishing, where attackers alert users to either an issue in their banking app or a way to get tax returns faster. The malware then utilizes NFCGate to relay any NFC payments from the device, which allows the attackers to duplicate the cards and withdraw money from an ATM. This attack does not require the victim's device to be rooted.

welivesecurity.com19 min read

RANSOMHUB HITS 210 VICTIMS IN JUST 6 MONTHS

US agencies have issued a warning about RansomHub, a rapidly growing ransomware group formed in February with at least 210 victims across various sectors, including critical infrastructure. RansomHub exploits vulnerabilities with common hacking tools.

theregister.com3 min read

02STRATEGIES & TACTICS

EXPOSING SECURITY OBSERVABILITY GAPS IN AWS NATIVE SECURITY TOOLING

SecurityRunners' Jonathan Walker provides an analysis of the coverage of IAM Access Analyzer for detecting public or cross-account access to resources. Walker puts coverage at about 65% and lists a few notable gaps. AWS Glue and SES are fundamental services that Walker believes should have coverage. Secrets Manager currently only alerts if a KMS key and secret are public but Walker believes that it should alert on just a public secret in case a method of accessing it becomes apparent. Walker also notes that Elemental MediaStore certainly should have coverage but is fairly obscure so may be a backlog item. He also highly encourages deploying IAM Access Analyzer as it is simple to manage and cost-effective.

securityrunners.io9 min read

UNPROTECTED CONTAINER REGISTRIES

Unprotected container registries are easily detectable on the web through tools like Shodan or scanning for common endpoints. This post demonstrates the ease with which an attacker can locate an unprotected container registry and upload or replace an existing image. The author located over 10k unprotected registries across the full IP space and was able to push a benign, PoC image to over 4,500 of them. They only uploaded a dummy image under an easily detectable name due to ethical considerations, but a motivated attacker could upload a malicious image just as easily.

dreher.in8 min read

SET-TOP BOX RE: 6-PART SERIES (1 OF 6)

This blog series examines the security of six set-top boxes to determine if they're compromised or part of botnets. The research involves hardware triage, filesystem extraction, and malware analysis. It also explores how easily these devices could be exploited.

cc-sw.com4 min read

03LAUNCHES & TOOLS

DALEC

Dalec provides a declarative format for building system packages and containers from those packages. It is designed for building containers for Azure and supports Azure Linux 2 and 3 and Windows containers.

github.comGitHub repository

UNIQKEY (PRODUCT LAUNCH)

Uniqkey's password and access management solution allows employees to use mobile applications when logging into enterprise systems while keeping passwords encrypted.

uniqkey.eu

NETTACKER

OWASP Nettacker project was created to automate information gathering, vulnerability scanning, and eventually generating a report for networks. It includes information on services, bugs, vulnerabilities, misconfigurations, and other topics.

github.comGitHub repository

04MISCELLANEOUS

ADVANCING THREAT INTELLIGENCE: JA4 FINGERPRINTS AND INTER-REQUEST SIGNALS

JA3 Fingerprints were first introduced in 2017 as a method to fingerprint browsers by taking a hash of the TLS ClientHello message, but they have lost efficacy due to differences in how tools handle various extensions and modern browsers scrambling TLS extensions. To combat this, FoxIO introduced JA4, which introduces other protocol elements into the fingerprint and is resilient to randomization of TLS extensions by first sorting them before hashing. To make JA4 fingerprints more useful to customers, Cloudflare aggregates data across its network on JA4 fingerprints into signals that can be used in Workers and rules. This post includes a breakdown of the different fields in a JA4 fingerprint, the statistics available via JA4 signals for a fingerprint, and a script demonstrating how to utilize signals in a Worker.

blog.cloudflare.com11 min read

DON'T FORCE YOURSELF TO BECOME A BUG BOUNTY HUNTER

Sam Curry, a hacker and bug bounty hunter, reflects on a common mentality of setting up extensive goals and plans for getting into bug bounty hunting. Curry compares this with his experience and failure doing the same with his studies in high school. Ultimately, Curry suggests that the fundamental issue in many hackers that set out these goals and fail is that they aren't actually interested in bug bounty hunting and should instead not force themselves to do it.

samcurry.net5 min read

CITY OF COLUMBUS SUES MAN AFTER HE DISCLOSES SEVERITY OF RANSOMWARE ATTACK

An Ohio judge has issued a restraining order against a security researcher who contradicted Columbus officials' claims about a recent ransomware attack. The researcher presented evidence that sensitive data stolen in the attack was intact and accessible, contrary to the mayor's statement. The city sued the researcher, claiming his actions made dark web data publicly available.

arstechnica.com4 min read