TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-09-09

6 sections19 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

approvals quick and painless.

Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.

sonraisecurity.com

02ATTACKS & VULNERABILITIES

NEW RAMBO ATTACK STEALS DATA USING RAM IN AIR-GAPPED COMPUTERS

A new attack called RAMBO can steal data from highly secure air-gapped computers by using electromagnetic radiation emitted from the computer's RAM. This attack allows data transfer rates of up to 1,000 bits per second, making it suitable for stealing small amounts of data like text, keystrokes, and small files. Mitigation strategies such as zone restrictions and RAM jamming can help defend against the RAMBO attack, but they come with additional complexities.

bleepingcomputer.com3 min read

LOWE'S EMPLOYEES PHISHED VIA GOOGLE ADS

Malwarebytes detected a phishing campaign targeting Lowe's employees by masquerading as the Lowe's benefits portal. The attackers registered domains to common typos of MyLowesLife and bought Google Ads to have them show up in search results for MyLowesLife. The bogus domains were then used to steal login credentials from employees.

malwarebytes.com3 min read

CAR RENTAL COMPANY AVIS DISCLOSES A DATA BREACH

Avis, a car rental company, experienced a data breach in August that compromised customers' personal information. The breach occurred between August 3 and August 6 but was discovered on August 14. Avis is advising impacted customers to monitor their accounts for fraudulent activities and is offering free credit monitoring services.

securityaffairs.com2 min read

03STRATEGIES & TACTICS

WHAT YOU SHOULD KNOW ABOUT PHP CODE SECURITY

This blog dives into PHP security. Due to its popularity and wide usage, PHP is often a target for hackers and malicious entities. Security vulnerabilities can creep in due to various reasons, such as poor coding practices, lack of sanitization of user inputs, and outdated versions.

snyk.io8 min read

LEARNING RUST FOR FUN AND BACKDOO-RS

Rust, a modern systems programming language that offers C/C++ performance without their pitfalls, is growing in popularity. This author shares their journey of learning Rust in 2024, highlighting the abundance of learning resources available and his personal recommendations.

security.humanativaspa.it10 min read

“UNSTRIPPING” BINARIES: RESTORING DEBUGGING INFORMATION IN GDB WITH PWNDBG

Jason An from Trail Of Bits discusses how analyzing stripped binaries can be tough. He has enhanced Pwndbg to restore debugging information in GDB for stripped binaries using Binary Ninja integration. He also introduced the go-dump command for easier debugging of Go values. These improvements are available on the Pwndbg dev branch and its latest release.

blog.trailofbits.com6 min read

04LAUNCHES & TOOLS

Sponsored

FREE EVENT (OCT 17): THE [STREAMING] CISO SUMMIT

Learn from the brightest minds in data security at BigID's digital summit! Industry experts [12] from Microsoft, Google Cloud, Bank of England, and more will explore the latest in DSPM, DLP, AI, and beyond! Plus, you can earn two CPE credits and a raffle entry [12] for attending!

home.bigid.comSponsor

REDFLAGS (PRODUCT LAUNCH)

Redflags is a platform designed to increase secure behavior through the concept of ‘nudging'. By nudging users, they practice ‘good' behavior beyond simply acknowledging poor behavior and bad intent.

thinkcyber.co.uk

GO-OVER

A tool to audit Erlang & Elixir dependencies.

github.comGitHub repository

GITHUB ACTIONS ATTACK DIAGRAM

GitHub Actions Attack Diagram provides guidance for identifying vulnerabilities in GitHub Actions pipelines.

github.comGitHub repository

05MISCELLANEOUS

YEAR-LONG CAMPAIGN OF MALICIOUS NPM PACKAGES TARGETING ROBLOX USERS

A long-running malware campaign is targeting Roblox developers through fake NPM packages mimicking "noblox.js". Attackers are using brandjacking and starjacking to appear legitimate and install malware that steals data, persists in systems, and deploys additional payloads to continue siphoning future data.

checkmarx.com8 min read

HARD TRUTHS YOUR CISO WON'T TELL YOU

Slides from Travis McPeak's off the record BlackHat campfire talk. McPeak shares some unfortunate realities of security in a business context, security organizations, and security practices. He closes with a set of good news such as the community being strong, the industry maturing, and that developers are looking to work with security.

slideshare.net6 min read

WHAT'S THE WORST PLACE TO LEAVE YOUR SECRETS?

A researcher deployed canary tokens to a variety of different locations to measure how quickly attackers would find them and attempt to use them on AWS. Tokens deployed to package managers (npm and PyPi) and GitHub were accessed within minutes whereas Pastebin, a web server, and a Docker container took longer. Tokens deployed to GitLab, BitBucket, S3, GCP Cloud Storage, and a (weak) password-protected Pastebin were never accessed, suggesting that attackers are not actively monitoring these resources.

cybenari.com10 min read