TLDR INFORMATION SECURITY 2025-02-06

GET THE AWS EKS CHEAT SHEET

HACKERS SPOOF MICROSOFT ADFS LOGIN PAGES TO STEAL CREDENTIALS

Abnormal Security has detected a new phishing campaign targeting education, healthcare, and government organizations' ADFS. The attackers send emails to targets, impersonating their company's IT team, with a request that they sign in to accept new policies or other routine changes, steal the login credentials and MFA, and then redirect the victims to the login page.

LIVE CHAT BLOG #2: CISCO WEBEX CONNECT - ACCESS TO MILLIONS OF CHATS HISTORIES

A vulnerability was discovered in Cisco's Webex Chat that allowed unauthorized access to the chat histories of many organizations, including internal and customer-facing help desks. The flaw was related to the use of the clientKey as a secretKey in API calls, which allowed attackers to read chat histories by exploiting specific parameters. The issue was reported to Cisco in July 2024 and patches were released to address the security vulnerability.

NETGEAR URGES USERS TO UPGRADE TWO FLAWS IMPACTING WIFI ROUTER MODELS

Netgear has identified critical flaws in multiple WiFi router models (XR1000, XR1000v2, and XR500) and is urging users to update their firmware as soon as possible. The vulnerabilities include a remote code execution issue and an authentication bypass vulnerability that can be exploited by attackers without user interaction. This post includes the firmware versions to download the patches as well as instructions on how to upgrade.

HOW WE BUILT AN APPSEC AI THAT SECURITY RESEARCHERS AGREE WITH 96% OF THE TIME

Semgrep built Semgrep Assistant's auto triage function to automatically classify a finding as a true or false positive by sending a minimal amount of code to an LLM. To benchmark the model, Semgrep's research team labeled 2,000 findings and then the system was evaluated against it. The original Assistant system was able to score a 90% success rate, but through optimizations around models, prompting, and context the team managed to increase the true positive rate to 96%.

INSIDE IMESSAGE-EXPORTER: REVERSE ENGINEERING APPLE'S TYPEDSTREAM FORMAT

Apple uses a proprietary and undocumented serialization format for serializing iMessage data. This researcher breaks down the process of reverse engineering the binary format, noting the patterns found, and shows how those assumptions are translated into the imessage-exporter tool.

LINUX DETECTION ENGINEERING - A CONTINUATION ON PERSISTENCE MECHANISMS

This blog post is part of a three part series from Elastic Security that covers various persistence mechanisms and utilizes PANIX, a custom-built Linux persistence tool. It goes in-depth on various techniques like Dynamic Linker Hijacking that exploit LD_PRELOAD and LD_LIBRARY_PATH to inject malicious libraries, Kernel Module Persistence, Web Shell persistence, and system account SSH backdoors. The post also provides key detection and mitigation strategies file, configuration monitoring, as well as examples of utilizing ElasticSearch and OSquery for hunting.

STONEKEEPER

StokeKeeper is an experimental EDR evasion framework for research purposes.

INTRODUCING NATURAL LANGUAGE CODE POLICIES IN DRYRUN SECURITY

DryRun Security has introduced Natural Language Code Policies (NLCP) to help AppSec teams identify critical code changes without drowning in alerts. NLCP uses plain language to create policy checks, making it easier to spot high-impact vulnerabilities.

VMINER

Vminer is a tool that aims to simplify the retrieval of data from virtual machines without utilizing guest tools or working with memory dumps. It supports multiple guest OS and architectures and offers features like getting process information and backtraces. To use it, you attach it to the VM process. Required PDBs are automatically downloaded for Windows guests.

ALMOST 1 IN 10 PEOPLE USE THE SAME FOUR-DIGIT PIN

The Australian Broadcasting Company (ABC) analyzed a corpus of 29 million four digit pins from Have I Been Pwned? Some of the most popular pins are expected keyscans, 1234, and number repetitions (1111, etc). Some other more interesting trends are highlighted such as 0229 and 2902 being less popular than other surrounding pins as they represent leap days.

CVSS IS DEAD TO US

The curl team abandoned the CVSS system in favor of four security levels ranging from critical to low for use in their bug bounty system. They cited evidence from previous incidents, where CVSS calculators overstated the impact of a vulnerability that is only present in very niche configurations. One issue that the team notes is that even though the CVSS score is not mandatory in CVE filings, it is often added by CISA as an enrichment.

ROBOCALLERS POSING AS FCC FRAUD PREVENTION TEAM CALL FCC STAFF

Scammers using Telnyx's VoIP service made nearly 1,800 robocalls impersonating a fictitious FCC "Fraud Prevention Team," ironically targeting FCC staff and their families among others. The FCC has proposed a $4.5M fine against Telnyx for allegedly failing to properly verify customer identities through Know Your Customer (KYC) procedures, though Telnyx denies these accusations. The scammers, operating under "MarioCop" accounts with suspicious discrepancies between their registered location and IP addresses, attempted to defraud victims by demanding $1,000 in Google gift cards to avoid supposed jail time.

LAZARUS APT TARGETS CRYPTO WALLETS USING CROSS-PLATFORM JAVASCRIPT STEALER

The Lazarus APT group, linked to North Korea, uses a JavaScript stealer to target crypto wallets through fake job offers on platforms like LinkedIn.

THE BIGGEST SUPPLY CHAIN ATTACKS IN 2024

Software supply chain attacks in 2024 targeted repositories and development tools, exploiting npm, PyPI, and JavaScript libraries to steal credentials and distribute malware.

SILENT LYNX USING POWERSHELL, GOLANG, AND C++ LOADERS IN MULTI-STAGE CYBERATTACKS

A new threat actor named Silent Lynx has been targeting organizations in Kyrgyzstan and Turkmenistan with cyber attacks using sophisticated methods like using ISO files, C++ loaders, PowerShell scripts, Golang implants, and Telegram bots for command and control.