TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-09-11

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

approvals quick and painless.

Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.

sonraisecurity.com

02ATTACKS & VULNERABILITIES

PAYMENT GATEWAY DATA BREACH AFFECTS 1.7 MILLION CREDIT CARD OWNERS

Payment gateway provider SlimCD has disclosed a breach affecting 1.7M individuals. SlimCD reported that in June it detected that a threat actor had breached its network nearly a year previously in August 2023 and took steps to block the access. Stolen information included full names, physical addresses, credit card numbers, and expiration dates, but not CVV numbers.

bleepingcomputer.com2 min read

BUG LETS ANYONE BYPASS WHATSAPP'S “VIEW ONCE” PRIVACY FEATURE

WhatsApp introduced “View Once” pictures as a way to prevent other users from sharing private pictures. Security researchers have found ways to bypass these protections on WhatsApp web. WhatsApp has stated that it is aware of the issue and is rolling out a fix.

techcrunch.com3 min read

SPYAGENT ANDROID MALWARE STEALS YOUR CRYPTO RECOVERY PHRASES FROM IMAGES

McAfee detected a new Android malware campaign that uses OCR to steal crypto recovery phrases. The malware also contains the capability to spread via SMS and capture OTPs sent via SMS. McAfee was able to trace back the malware and managed to access the admin panel of the malware operators.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

RED REAPER: BUILDING AN AI ESPIONAGE AGENT

Inspired by the I-Soon leaks, these authors decided to build an AI espionage agent called Red Reaper. Red Reaper consists of 3 data science layers and a basic Flask UI. The first layer seeks to identify entities that deal with LAW in the sample email dataset and assign a confidence score to each one. The next layer builds a Neo4j graph and performs some analysis on the graph to identify key communication clusters and individuals. Generative AI is introduced in the last layer to refine the analysis and identify information that could be relevant for espionage, extortion, blackmail, or other criminal activity.

cybermongol.ca10 min read

SANITIZE YOUR C++ CONTAINERS: ASAN ANNOTATIONS STEP-BY-STEP

This post discusses how to use AddressSanitizer(ASan) to detect memory errors in C++ code. Adding ASan annotations to libc++ containers like std::string and std::deque aids in bug detection. The post walks through various examples and code snippets that use ASan to aid in finding memory bugs in C++ code.

blog.trailofbits.com15 min read

DEPLOYING RUST IN EXISTING FIRMWARE CODEBASES

This blog post explains how to gradually introduce Rust into existing firmware codebases for improved security. Drop-in Rust replacements for C code can enhance security with minimal effort. By following an incremental approach and addressing specific challenges, you can seamlessly integrate Rust into your firmware development process.

security.googleblog.com10 min read

04LAUNCHES & TOOLS

FRIDA 16.5.0 RELEASED

Frida 16.5.0 contains new features like hardware breakpoints and watchpoints to help locate code accessing specific memory data more easily. The release also brings support for Windows on ARM and other improvements, making Frida even more versatile for developers. This article presents a demo using these new APIs in a game like DOOM, showing how to find and monitor memory locations dynamically.

frida.re4 min read

HOOKCHAIN

hookchain aims to provide a new perspective on EDR Evasion. Through a precise combination of IAT Hooking techniques, dynamic SSN resolution, and indirect system calls, hookchain redirects the execution flow of Windows subsystems in a way that remains invisible to the vigilant eyes of EDRs that only act on Ntdll.dll without requiring changes to the source code of the applications and malware involved.

github.comGitHub repository

05MISCELLANEOUS

MAKING SENSE OF THE APPLICATION SECURITY PRODUCT MARKET

The AppSec product market is undergoing rapid change as new tooling such as CSPMs and API security tools shift the way teams interact with traditional tools like WAFs and DASTs. ASPMs are arriving to bridge the UI/UX and contextual gaps that exist in AppSec tools across the SDLC but struggle with requiring more integration points than CSPMs. GenAI is emerging as a useful tool that aids in triaging alerts, but it is still lacking in maturity.

links.tldrnewsletter.com17 min read

BUG LEFT SOME WINDOWS PCS DANGEROUSLY UNPATCHED

Microsoft has released updates to fix 79 security vulnerabilities in Windows, including an unpatched bug affecting some Windows 10 PCs. One critical bug, CVE-2024-43491, caused the rollback of fixes for certain Windows 10 systems. Two zero-day flaws affecting Microsoft Publisher and Office, CVE-2024-38226 and CVE-2024-38217, were disclosed.

krebsonsecurity.com3 min read

CRIMSON PALACE RETURNS: NEW TOOLS, TACTICS, AND TARGETS

The Crimson Palace cyber threat operation has resumed with new tools and tactics to target governments and organizations in South East Asia. This blog post presents various diagrams and timelines showing the details of Crimson Palace's operations. It also discusses the evolution of the malware, as well as efforts to evade detection.

news.sophos.com20 min read