TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-01-08

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

Security programs are hard to justify if they continuously generate false positives, incomplete findings, or a high volume of incidents that need to be triaged.

defectdojo.comSponsor

02ATTACKS & VULNERABILITIES

EFFECTIVE PHISHING CAMPAIGN TARGETING EUROPEAN COMPANIES AND ORGANIZATIONS

Palo Alto Network's Unit42 discusses a phishing campaign targeting European companies and organizations, highlighting indicators to identify similar attacks. These indicators include a tone of urgency and failed authentication checks like SPF and DKIM. The threat actor employed evasion techniques, such as using trusted devices and VPN proxies, to disguise their malicious activities.

unit42.paloaltonetworks.com10 min read

FIRESCAM ANDROID SPYWARE CAMPAIGN POSES 'SIGNIFICANT THREAT WORLDWIDE'

A new Android spyware, "FireScam," masquerades as Telegram Premium to steal sensitive data using Firebase for data exfiltration. The malware spreads through a fake RuStore website on Github.io, highlighting evolving threats that exploit legitimate platforms and user trust.

darkreading.com3 min read

BIOS FLAWS EXPOSE ISEQ DNA SEQUENCERS TO BOOTKIT ATTACKS

Eclypsium found that the BIOS firmware of Illumina iSeq 100 devices ran an outdated version of the BIOS firmware which was not write protected and did not implement Secure Boot. Attackers could exploit these vulnerabilities to manipulate results or brick the systems. Illumina has issued a patch to affected customers.

bleepingcomputer.com3 min read

03STRATEGIES & TACTICS

OPEN PORT CHRONICLE: WHAT PORT 80 REVEALED ABOUT THE INTERNET

RedHunt Labs scanned billions of IP addresses for open port 80s and discovered 42 million accessible IPs. Its research revealed 25,000 unique HTTP headers, 2.1 million favicon hashes, 500,000 email addresses, 600,000 social media links, and 25,000 cloud storage buckets, highlighting internet security's current state.

redhuntlabs.com10 min read

A PRACTICAL GUIDE TO GETTING STARTED WITH POLICY AS CODE

Policy as Code (PaC) is an approach that aids the assessment of an organization's configuration and validation of compliance requirements through the use of software automations. Before beginning to implement PaC, an organization should map out the level of effort to codify policies and the criticality of the policy. One mechanism to begin using PaC can be through CloudFormation Hooks or CloudFormation Guards.

aws.amazon.com9 min read

HOW (AND WHY) TO USE APPROLE CORRECTLY IN HASHICORP VAULT

Vault AppRoles aim to solve the “Secret Zero” problem in systems that don't have native Vault authentication capabilities by splitting authentication into two components: a role ID and secret ID. The role ID is not sensitive and the secret ID is a time limited credential that should only be provided to the application at the expected time of use. Vault also supports wrapping the secret ID to decrease exposure. The Vault agent can automate AppRole authentication in applications that cannot be modified.

hashicorp.com6 min read

04LAUNCHES & TOOLS

BANDIT

Bandit is a tool designed to find common security issues in Python code. To do this, Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. It generates a report once it has finished scanning all the files.

github.comGitHub repository

DARKFLARE

A stealthy command line tool to create TCP-over-CDN(http) tunnels that keep your connections cozy and comfortable.

github.comGitHub repository

PACKAGEANALYSIS

The Package Analysis project examines open source packages for signs of malicious behavior by analyzing their file access, network connections, and commands they execute. It aims to enhance open source software security by detecting suspicious behavior and providing insights to consumers and researchers. The project's components work together to analyze packages in a sandboxed environment and store the results for inspection in BigQuery.

github.comGitHub repository

05MISCELLANEOUS

THE MAC MALWARE OF 2024

The amount of malware targeting macOS has increased along with the market share of Macs. This post provides an introduction to some common macOS malware analysis tools and then introduces each new macOS malware released in 2024. The samples are categorized into stealers or ransomware and each includes a brief overview, links to writeups, infection vectors, persistence mechanisms, and capabilities.

objective-see.org15 min read

CRITICAL INFRASTRUCTURE RANSOMWARE ATTACK TRACKER REACHES 2,000 INCIDENTS

Temple University researchers have documented over 2,000 ransomware attacks on critical infrastructure since 2013, with government, healthcare, and education being the most targeted sectors. Their CIRA database shows increasing ransom demands, with the project providing valuable data for cybersecurity professionals and government entities.

securityweek.com4 min read

STREAMLINING SECURITY INCIDENT RESPONSE WITH AUTOMATION AND LLMS

The Mercari security team implemented automations through a Slackbot and LLM that saved 160-250 minutes of incident responder time for small security incidents. The Slack bot automates tasks such as establishing communication, managing document access, and assigning tasks. The LLM aids in adding documentation and evaluating incident impact and severity as well as summarizing incidents over a long period of time for reporting purposes.

engineering.mercari.com12 min read