TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-02-07

6 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

DEEP JAVA LIBRARY VULNERABILITY ALLOWS PATH TRAVERSAL

A new vulnerability in the ZipUtils.unzip and TarUtils.untar utilities in the Deep Java Library allows for absolute path traversal. These utilities are used by Deep Java Library when extracting models to load. The vulnerability exists because the absolute path is not properly validated. A malicious attacker could exploit this vulnerability to overwrite system files.

securityonline.info2 min read

GO MODULE MIRROR SERVED BACKDOOR TO DEVS FOR 3+ YEARS

Researchers from Socket discovered that Go Module Mirror had been hosting a malicious Go package for over three years. Go Module Mirror is a caching service that Google runs to cache modules for quicker downloads when building Go programs. The attackers typosquatted an archived Go package, published a version with a backdoor embedded, and then changed their repo back to look like the benign module.

arstechnica.com2 min read

EXPERTS FLAG SECURITY, PRIVACY RISKS IN DEEPSEEK AI APP

Brian Krebs reports that experts from NowSecure have raised security and privacy concerns about the DeepSeek AI app from China. He notes that the app sends a lot of user data in unencrypted form and device information to Chinese companies, posing risks. The author also urges organizations to remove the DeepSeek iOS app due to security threats identified by NowSecure.

krebsonsecurity.com4 min read

03STRATEGIES & TACTICS

REPLACING A SPACE HEATER FIRMWARE OVER WIFI

A security team discovered a vulnerability in a Govee smart space heater allowing complete firmware control through a man-in-the-middle attack on local networks. After extended disclosure discussions with Govee in early 2024, the product was recalled as the flaw could enable malicious control of device operations.

blog.includesecurity.com7 min read

SCATTERBRAIN: UNMASKING THE SHADOW OF POISONPLUG'S OBFUSCATOR

Since 2022, Google Threat Intelligence Group (GTIG) has been tracking a group of malware samples that use the PoisonPlug moniker and employ a complex obfuscator. The ScatterBrain obfuscator operates in three different protection modes which determine to what extent it obfuscates the control flow graph, mutates instructions, and protects the binary's import table. The post walks through how GTIG reverse engineered this obfuscator and created a deobfuscator tool.

cloud.google.com15 min read

A NETWORK THREAT HUNTER'S GUIDE TO C2 OVER QUIC

QUIC is a newer network communication protocol that abbreviates the typical TCP 3-way handshake as well as adding other features such as a Communication ID for persistent connections. This post introduces the QUIC protocol and then sets up a lab environment to analyze the Merlin QUIC-based C2 with different sets of delays. The post finds that the Merlin C2 can be detected by RITA with any delay, alternatively, Zeek logs can be examined for unusually persistent QUIC connections, and finally, the post also noted a unique QUIC handshake that is only exhibited by Merlin.

activecountermeasures.com8 min read

04LAUNCHES & TOOLS

ASTRA (PRODUCT LAUNCH)

Astra is a DAST (Dynamic Application Security Testing) and Pentest scanning engine that incorporates more than 10,000 security tests to hunt for over 13,000 vulnerabilities.

links.tldrnewsletter.com

LOLC2 (WEB APP)

LOLC2 is a collection of C2 (Command and Control) frameworks that utilize legitimate services to evade detection.

lolc2.github.io

GHIDRA 11.3 RELEASED: NEW FEATURES, PERFORMANCE IMPROVEMENTS, BUG FIXES

Ghidra 11.3 has been released by the NSA. It introduces tools like a Visual Studio Code integration and a PyGhidra Python library for easier access to the Ghidra API. The update also includes improvements to the Function Graph, debugger infrastructure, source code mapping, processor support, and string translation capabilities.

helpnetsecurity.com3 min read

05MISCELLANEOUS

7-ZIP 0-DAY WAS EXPLOITED IN RUSSIA'S ONGOING INVASION OF UKRAINE

Russia exploited a zero-day vulnerability in 7-Zip that bypassed Windows' Mark of the Web (MotW) security feature. The flaw, tracked as CVE-2025-0411, allowed malware hiding in nested archives to evade detection when targeting Ukrainian agencies.

arstechnica.com3 min read

NEW TARGET OF PARAGON SPYWARE COMES FORWARD

WhatsApp revealed that Italian activists and journalists critical of Italian PM Meloni's government were targeted by Paragon spyware. This raises questions about the Italian government's involvement. Paragon claims it only sells to democratic nations.

techcrunch.com5 min read

ANNOUNCING THE ELASTIC BOUNTY PROGRAM FOR BEHAVIOR RULE PROTECTIONS

Elastic has expanded the scope of its bug bounty program to include Elastic Security detection rulesets. Under the new scope, Elastic will offer bug bounties for submissions that evade detection by Elastic Security's rules with a particular focus on not requiring elevated privileges. At present, the scope of the expansion is limited to Windows Behavior Alerts.

elastic.co9 min read