TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-11-04

6 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

LEVEL UP YOUR API SECURITY: 3 ESSENTIAL STEPS

APIs power your systems, but securing them shouldn't feel like a constant uphill battle. That's why STACKHAWK launched OVERSIGHT—a new feature providing a bird's-eye view of API security across your entire application portfolio. Designed to do more than just create another dashboard where teams can “admire their problems,” Oversight gives real-time insights to quickly pinpoint and fix security issues. As app portfolios grow, API DISCOVERY, API SECURITY TESTING, and OVERSIGHT keep security scalable and proactive, empowering teams to stay ahead of risks.

stackhawk.comSponsor

02ATTACKS & VULNERABILITIES

THOUSANDS OF HACKED TP-LINK ROUTERS USED IN YEARS-LONG ACCOUNT TAKEOVER ATTACKS

Chinese hackers are using "Botnet-7777" to conduct stealthy password spray attacks against Azure cloud accounts, targeting organizations across multiple sectors. Comprising mainly TP-Link routers, the 8,000-device botnet's distributed nature and low-volume attempts make detection difficult.

arstechnica.com4 min read

BOOKING.COM PHISHERS MAY LEAVE YOU WITH RESERVATIONS

Scammers stole a Californian hotel's Booking.com credentials and sent targeted phishing messages to customers via the mobile app requesting additional information while citing reservation details. Booking.com confirmed a security breach with a partner but states its internal systems remain secure.

krebsonsecurity.com6 min read

OVER 1K ONLINE SHOPS HACKED TO SHOW FAKE PRODUCT LISTINGS

HUMAN's Satori Threat Intelligence team detected a new phishing campaign dubbed Phish n' Ships. The campaign utilizes n-day vulnerabilities, misconfigurations, and compromised admin credentials to upload fake SEO-optimized listings to compromised online shops. The listings redirect users to payment forms that allow the attackers to steal their credit card information. HUMAN has taken efforts to disrupt the campaign by reporting fake listings to Google as well as the online shops.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

LESSONS IN SECURITY TOOLING: STRATEGIES FOR SUCCESS

Successful security tooling programs require careful vendor selection based on a comprehensive rubric that prioritizes low false positives and workflow integration over cost while ensuring engineers aren't overwhelmed with vulnerabilities by implementing a phased "crawl-walk-run" approach to remediation. Tool success depends on full ecosystem integration with auto-creation/closure of vulnerability tickets, centralized security data lake visibility, and strong engineering team buy-in through their involvement in tool selection. Critical mistakes to avoid include selecting tools that create high operational overhead, failing to achieve complete coverage across all repositories, and overwhelming engineering teams with too many vulnerabilities at once instead of focusing on critical issues first.

gyan.ca11 min read

BLUETOOTH LOW ENERGY GATT FUZZING

Research on the Bluetooth Low Energy Generic ATTribute Profile (GATT) layer revealed vulnerabilities in various Bluetooth Low Energy (BLE) stacks. Attack scenarios were defined and a fuzzer was built to test BLE security. Vulnerabilities like DoS in NimBLE stack and Espressif GATT server example were discovered and reported.

blog.quarkslab.com10 min read

HOW TO DO VULNERABILITY PRIORITIZATION

This post provides an overview of Opus Security's vulnerability prioritization process. The strategy begins by utilizing the base CVSS score and then enriches it with additional information about the vulnerability such as the availability of exploit code, whether there are known attackers who are exploiting the vulnerability, and whether a patch is available. The next level involves adding in environmental factors such as how the resource is configured and its exposure.

pulse.latio.tech8 min read

04LAUNCHES & TOOLS

NOMA SECURITY (PRODUCT LAUNCH)

The Noma platform delivers real-time monitoring, blocking, sensitive data masking, and alerting to defend against AI adversarial attacks and data leakage and enforce safety guardrails aligned with organizational and app-specific policies.

noma.security

XECRETS CLI

A Cross Platform AxCrypt compatible Open Source Encryption command line tool in C# for .NET 8+.

github.comGitHub repository

MIRI

Miri is a rust lang Undefined Behavior detection tool that seeks to detect unsafe code that fails to uphold safety requirements.

github.comGitHub repository

05MISCELLANEOUS

MICROSOFT HAS DELAYED COPILOT+'S ‘RECALL' FEATURE YET AGAIN

Microsoft's Recall feature, which captures PC screenshots for AI searching, will be delayed until December. Originally planned for June with the release of Copilot+ laptops, it was postponed due to security concerns. Microsoft promises it will be opt-in and removable, addressing user skepticism about data privacy.

lifehacker.com4 min read

SUNSHINE THROUGH STORMY CLOUDS: BRINGING AWS SECURITY TO MERGERS AND ACQUISITIONS

This post describes how to effectively manage AWS security during mergers and acquisitions through a detailed six-step, 90-day process. Success requires careful onboarding of AWS accounts into the parent organization's security tools and monitoring systems while prioritizing the remediation of critical security risks like permissive IAM policies and public-facing resources over lower-severity issues. It is important to build trust with the acquired team while maintaining security momentum through the transition period, ultimately working toward full integration into the parent organization's infrastructure-as-code practices and security controls.

awssecuritydigest.com12 min read