TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-09-16

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

approvals quick and painless.

Start your 14-day free trial at sonrai.co/zombie-identities [5] and experience effortless, continuous AWS cloud security.

sonraisecurity.com

02ATTACKS & VULNERABILITIES

FORTINET CONFIRMS DATA BREACH AFTER HACKER CLAIMS TO STEAL 440GB OF FILES

Last week, a threat actor posted credentials to an S3 bucket containing 440GB of files allegedly stolen from a Microsoft Sharepoint server belonging to Fortinet. Fortinet has confirmed that it experienced a breach due to an exposed third-party cloud-based file drive. It has stated that the breach only affects 0.3% of customers.

bleepingcomputer.com2 min read

FAKE PASSWORD MANAGER CODING TEST USED TO HACK PYTHON DEVELOPERS

The North Korean Lazarus hacking group launched a campaign where it approached Python developers with a coding interview challenge. The candidates were tasked with finding and fixing bugs in a password manager application that pulled in two malicious PyPi packages that executed an obfuscated C2 payload in their __init__.py. Candidates were rushed to complete the assignment due to tight deadlines listed in the README file that may have led to them skipping some security checks.

bleepingcomputer.com2 min read

GAZEPLOIT COULD WORK OUT VISION PRO USER PASSWORDS FROM WATCHING THEIR AVATAR

Researchers have developed a new exploit, dubbed GAZEploit, that uses a neural network to detect Vision Pro users' passwords based on the eye movements reflected in their avatars' faces when the on-screen keyboard is pulled up. The researchers managed to achieve an 85.9% precision rate and 96.8% recall rate in their test of 30 users. Apple has fixed this vulnerability by disabling avatars while the virtual keyboard is pulled up.

9to5mac.com3 min read

03STRATEGIES & TACTICS

EVIL MSI. A STORY ABOUT VULNERABILITIES IN MSI FILES

This post provides a primer on finding vulnerabilities in MSI files. It begins with an overview of the MSI file format and details the tables that may be relevant. It then covers ways to enumerate MSI files and common attack vectors such as abandoned credentials, custom actions, and GUI escapes. The post also provides examples of utilizing tools to automate the procedure as well as a tool that they wrote.

links.tldrnewsletter.com9 min read

OFFENSIVE AI AGENTS: A TIMELINE OF MY RESEARCH

Jeff Sims, a frontier AI/ML cyber researcher, shares a timeline of his research on offensive AI agents, including BlackMamba, EyeSpy, and Red Reaper. These AI systems demonstrate the potential for adversarial use of AI technology and the need for awareness in the field. Sims' research focuses on developing advanced offensive AI agents capable of self-training and targeting other AI systems.

links.tldrnewsletter.com3 min read

SSH KEYSTROKE OBFUSCATION BYPASS

OpenSSH 9.5 added keystroke timing obfuscation to prevent traffic analysis attacks. The feature hides keystroke timings and floods chaff packets to obscure real keystrokes. This blog post walks through how analyzing packet sizes can reveal keystrokes and their types, aiding in traffic analysis.

crzphil.github.io11 min read

04LAUNCHES & TOOLS

INTRODUCING SIGMALITE. RUNREVEAL'S OPEN SOURCE SIGMA RULE EVALUATOR FOR DETECTION

RunReveal has released Sigmalite, an open-source sigma rule evaluator for detection, under the Apache 2.0 license for stream processing. Sigmalite allows security teams to use sigma rules for detections outside of their SIEM, providing flexibility in log processing and detection. By integrating Sigmalite into its pipeline, RunReveal aims to offer customers the ability to easily create, validate, and run sigma detections for better log management and correlation.

blog.runreveal.com6 min read

SIMPLIFY SBOM MANAGEMENT FOR DEVELOPERS: INTRODUCING BOMCTL

Bomctl is a new tool within OpenSSF that helps manage Software Bill of Materials (SBOMs) for developers. It aims to simplify handling SBOM documents by providing a command-line interface for retrieving, storing, and manipulating component information. Bomctl supports complex SBOM operations and aims to facilitate integration with existing SBOM tooling ecosystems.

openssf.org3 min read

BOUNTYHUNTER

The Bounty Hunter plugin for Caldera enhances emulation by simulating realistic cyberattack chains. Existing tools that automate assessments can be limited and predictable. bountyhunter uses real-world attacker tactics to emulate realistic scenarios.

github.comGitHub repository

05MISCELLANEOUS

PORT OF SEATTLE HIT BY RHYSIDA RANSOMWARE IN AUGUST ATTACK

The Port of Seattle was attacked by Rhysida ransomware, causing disruptions to critical systems like reservation check-in and flight delays. The ransomware gang demanded payment, but the Port refused, choosing to restore affected systems instead. Rhysida is known for targeting various industries and has been linked to attacks on healthcare organizations and other high-profile targets.

bleepingcomputer.com2 min read

A NEW PATH FOR KYBER ON THE WEB

Google is making changes to Chrome to switch from supporting the Kyber algorithm to the new ML-KEM algorithm for post-quantum key exchange. The switch is necessary due to the standardization of ML-KEM and incompatibility with the previous version of Kyber. Server operators can temporarily support both algorithms to maintain post-quantum security while clients update their implementations.

security.googleblog.com2 min read

ACQUIRING MALICIOUS BROWSER EXTENSION SAMPLES ON A SHOESTRING BUDGET

The blog post explains how to acquire and decrypt samples of a malicious browser extension using free resources and simple cryptanalysis techniques. By leveraging services like urlscan, the author was able to identify potentially malicious domains and scripts used by the malware. The analysis revealed active and potentially harmful domains, highlighting the importance of monitoring and detecting malicious activities online.

pberba.github.io10 min read