TLDR INFORMATION SECURITY 2025-01-29

assessment [6] or schedule a demo of Feroot.

DEEPSEEK HALTS NEW SIGNUPS AMID “LARGE-SCALE” CYBERATTACK

Chinese AI platform DeepSeek disabled registration on its DeepSeek-V3 chat platform due to an ongoing attack. It is believed that the company is facing a DDoS attack against its API and Web Chat platforms. Users can still sign in with Google to the platform.

ZERO-CLICK OLE RCE IMPACTS MICROSOFT OUTLOOK

Microsoft has patched a critical vulnerability in Windows Object Linking and Embedding (OLE) caused by a double-free in ole32.dll. An attacker can exploit this vulnerability to execute arbitrary code by sending a malicious RTF file, which is previewed by a victim in Microsoft Outlook. This post includes PoC code and threat hunting queries for the vulnerability.

BREAKING THE APPLE M3 CPU VIA FALSE LOAD OUTPUT PREDICTIONS

Researchers at Georgia Tech have discovered SLAP and FLOP attacks that exploit microarchitecture features in Apple CPUs to read sensitive data from webpages. These attacks involve predicting memory access patterns and tricking the CPU into operating on incorrect data values. SLAP and FLOP will be presented at upcoming security conferences to showcase the potential risks posed by these exploits.

TOP 5 ACTIVE DIRECTORY ATTACKS

Active Directory is the most widely used enterprise access system. This post introduces LLMNR poisoning, SMB relay, IPv6 relay, Pass the Hash, and Kerberoasting attacks. A video demo is also included.

TIPS FOR INVESTIGATING CYBERCRIME INFRASTRUCTURE

HOW TO MIGRATE TO SASE AND ZERO TRUST

The traditional network security model is no longer effective due to the rise of cloud services and remote work, exposing vulnerabilities in VPN solutions. A new approach, called Secure Access Service Edge (SASE) and Zero Trust, emphasizes granular access control and secure remote access to data and services. By adopting these solutions, companies can enhance security, simplify management, and adapt to the changing landscape of cybersecurity threats.

XSS-AGENT

A proof of concept AI-based autonomous post-exploitation system. It is intended for security testing and research purposes only. Users must agree to use the tool ethically and legally and ensure compliance with local laws and regulations.

JA4+ DATABASE (WEBPAGE)

JA4DB is community maintained repository of JA4+ TLS fingerprints

BLUESKYNET

BlueSkyNet is a web tool for OSINT researchers for searching, analyzing, and exporting data from BlueSky's API. It offers advanced search options, multiple endpoints, and CSV export functionality. Users need a BlueSky account to access the tool and can host it locally by cloning the repository.

DEEPSEEK R1 EXPOSED: SECURITY FLAWS IN CHINA'S AI MODEL

DeepSeek's R1 model is a powerful model, but it lacks some of the defenses that some of the more established competitors like ChatGPT's models provide. R1 can be trivially jailbroken using the “evil jailbreak” attack that the ChatGPT models are patched against. It does not have any protections against generating malicious code or unethical results.

FIVE REASONS TO CARE ABOUT OPENGREP

Opengrep was announced as a forever open source fork after Semgrep changed its licensing structure. James Berthoty highlights the importance of an open source SAST for establishing a comparison baseline for commercial SASTs, for the development of an industry standard for abstract syntax trees (ASTs), and the ability for community rules to unify open source scanners. Opengrep will gradually implement some of the Semgrep pro features.

TRACKING A MALICIOUS BLOGSPOT REDIRECTION CAMPAIGN TO APATEWEB

This article analyzes the "ApateWeb" malware campaign, which uses weaponized Blogspot links that appear legitimate but redirect users to malicious content including phishing pages, malware, and scam sites. Through technical investigation, the author identifies several key tactics including VPN detection, internationalization for broader targeting, and the use of "empty OK" responses to evade security scanners, ultimately discovering over 9,500 domains involved in this campaign. The analysis concludes by providing detailed indicators and infrastructure information, including domain lists and investigation tools, to help security teams identify and track similar malicious redirector campaigns.

APPLE PATCHES FIRST EXPLOITED IOS ZERO-DAY OF 2025

Apple has released patches for multiple vulnerabilities, including an iOS bug exploited in attacks.

GOOGLE TO KILL CHROME SYNC ON OLDER CHROME BROWSER VERSIONS

Google is ending Chrome Sync for older Chrome versions in early 2025.

SIGNAL WILL LET YOU SYNC OLD MESSAGES WHEN LINKING NEW DEVICES

Signal is introducing a new feature that allows users to synchronize their old message history from their primary iOS or Android devices to newly linked devices like desktops and iPads while maintaining end-to-end encryption and data security.