TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2024-12-13

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

NEW EVILMSGSPY ANDROID SPYWARE USED BY CHINESE POLICE

Researchers from Lookout have discovered a spyware app developed by Wuhan Chinasoft Token Information Technology Co., Ltd and used by Chinese law enforcement. The spyware collects messages from chat apps, screen recordings, screenshots, audio recordings, location information, network activity, installed apps, browser bookmarks, and external storage files. Lookout found evidence that the app is still in active development and that an iOS equivalent may exist.

bleepingcomputer.com2 min read

RESEARCHERS CRACK MICROSOFT AZURE MFA IN AN HOUR

Researchers from Oasis Security discovered an MFA bypass on one of Microsoft Azure's MFA methods that could lead to the compromise of Microsoft 365 accounts. The researchers discovered that the endpoint did not implement rate limiting and that the auth period lasted for a full three minutes as opposed to the recommended 30 seconds. The researchers also discovered that an attacker could rapidly make many auth attempts to enumerate the full 6-digit MFA space.

darkreading.com4 min read

300,000+ PROMETHEUS SERVERS AND EXPORTERS EXPOSED TO DOS ATTACKS

Researchers at Aquasec have found over 336,000 exposed Prometheus servers and exporters, risking data breaches and DoS attacks. Vulnerabilities like "RepoJacking" can lead to code execution through compromised exporters. To mitigate risks, organizations should prioritize authentication, limit public exposure, and secure debugging endpoints.

aquasec.com9 min read

03STRATEGIES & TACTICS

SECURING AWS LAMBDA: HOW MISCONFIGURATIONS CAN LEAD TO LATERAL MOVEMENT

AWS Lambda functions are popular attack vectors for credentials theft and lateral movement. This post presents a realistic application architecture and walks through a scenario in which an attacker exploits a vulnerability in a Lambda function to achieve code execution and pivots to data exfiltration. It suggests using hardened IAM roles, secure coding practices, and monitoring to mitigate Lambda attacks.

sentinelone.com10 min read

RETROFITTING SPATIAL SECURITY TO HUNDREDS OF MILLIONS OF LINES OF C++

Google has made a large push to move to memory safe languages but in the process is embracing hardening C++ to bridge the gap. The security team has attempted to harden libc++ by adding bounds checking to improve spatial security. The team started by integrating the changes into the test and preproduction environment for a year before promoting to production for all but a few exceptions. The safety checks only add a 0.3% performance overhead, but they have resulted in the discovery of over 1,000 bugs and successfully interfered with a red team engagement.

security.googleblog.com7 min read

EVERYDAY GHIDRA: GHIDRA DATA TYPES — CREATING CUSTOM GDTS FROM WINDOWS HEADERS — PART 2

This second part of a guide on "Everyday Ghidra" explains how to create custom Ghidra Data Type (GDT) files from Windows headers to improve reverse engineering. You can ensure accurate and efficient analysis of binaries by using a compiler to preprocess headers before submission to Ghidra. Training Ghidra to use NDIS data types enhances the decompilation process and reveals new structures and variables for better analysis.

links.tldrnewsletter.com11 min read

04LAUNCHES & TOOLS

Sponsored

ZEROPATH RESEARCH REVEALS VULNERABILITIES IN POPULAR AI PLATFORMS AND OPEN SOURCE PROJECTS

Since July 2024, ZeroPath's software has autonomously uncovered critical zero-day vulnerabilities—including RCE, authentication bypasses, and IDORs—in widely-used AI and open source tools. These include security flaws in projects owned by Netflix, Salesforce, and Hulu. See the full list [11] and read more about the methodology and research [11].

zeropath.comSponsor

PIPE

Pipe offers authenticated pub sub pipes over SSH with zero install.

pipe.pico.shTool

PICKLESCAN

Picklescan is a CLI tool that can scan Python pickle files to detect suspicious actions. It can load files from directories, URLs, zip archives, or Hugging Face.

github.comGitHub repository

05MISCELLANEOUS

OVER 600 VULNERABILITIES FOUND IN AVERAGE SOFTWARE CONTAINER

NetRise compiled advanced SBOMs for 70 of the most downloaded containers on DockerHub and found that the average container had over 600 vulnerabilities. 45% of the vulnerabilities were 2-10 years old and 7.9% were over 5 years old. 4.2% of high and critical vulnerabilities were being actively exploited. NetRise also noted that many components did not include manifests and emphasized the importance of advanced SBOMs.

techmonitor.ai4 min read

HACKING TERRAFORM STATE FOR PRIVILEGE ESCALATION

This article discusses hacking Terraform state for privilege escalation by modifying the state file to control infrastructure changes without a "terraform apply." Attackers can manipulate the state file to delete resources or take over a deployment pipeline, which is why it is important to secure and lock the Terraform state to prevent unauthorized changes. The article highlights the need to use a read-only role for "terraform plan" executions to inspect changes without altering infrastructure until the deployment step.

plerion.com12 min read

RADIANT CAPITAL INCIDENT UPDATE

Radiant Capital faced a cyberattack resulting in a $50M loss. It was traced back to a DPRK-aligned threat actor using sophisticated malware. Despite following best practices, the attackers evaded detection by simulating benign transactions while executing malicious ones in the background. The incident highlights the need for stronger device-level security measures in the evolving DeFi industry to combat advanced threats.

links.tldrnewsletter.com3 min read