TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-02-13

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

EFFECTIVE — AND AFFORDABLE

What do you actually need to protect your organization from hackers, viruses, phishing, and data leaks?

threatspike.comSponsor

02ATTACKS & VULNERABILITIES

TRUMP HOTELS GUEST INFORMATION LEAKED ON HACKER FORUM

A hacker leaked a dataset containing over 150k records from guests at Trump Hotel properties. The leaked dataset includes details of the stays including email addresses and full names of the guests. The post also includes a link to a tool to check if your name was part of the leak as well as next steps for the ones affected.

leakd.com2 min read

HACKERS EXPLOITING BUG IN POPULAR TRIMBLE CITYWORKS TOOL USED BY LOCAL GOVERNMENTS

CISA is warning of a vulnerability in the Trimble Cityworks asset management software that is commonly used by local and federal governments. The vulnerability allows for a malicious actor to potentially achieve RCE against a customer's IIS server. CISA warns that the vulnerability is being actively exploited and has mandated that federal civilian agencies patch it by February 28.

therecord.media2 min read

03STRATEGIES & TACTICS

CYBERCRIME: A MULTIFACETED NATIONAL SECURITY THREAT

Mandiant has done an analysis of what cybercrime entails as cybercrime dominates online threats, with four times more criminals than state-backed intrusions in 2024. The impact of cybercrime is particularly noticeable in healthcare where data leaks have doubled. The post dives into the analysis.

cloud.google.com18 min read

HOW WE HACKED A SOFTWARE SUPPLY CHAIN FOR $50K

The blog post describes the journey of Lupin with fellow hacker Snorlhax on bug bounties and aiming for “The Exceptional Vulnerability” that would be their big payout worth $50,500. They found a way to backdoor a private npm package, potentially compromising multiple environments and systems, highlighting the importance of securing all aspects of the development process.

landh.tech10 min read

MANAGE DEV TUNNELS WITH GROUP POLICIES

Dev Tunnels are a popular tunneling service used by developers via Visual Studio, VS Code, or the devtunnel CLI. Microsoft has added the ability to control certain aspects of Dev Tunnels via Group Policy Administrative Templates. The supported policies allow admins to limit tunnel access to selected Microsoft Entra tenant ID, disable anonymous access, or fully disable Dev Tunnels.

techcommunity.microsoft.com3 min read

04LAUNCHES & TOOLS

SGNL (PRODUCT LAUNCH)

SGNL provides a Privileged Identity Management platform that decouples credentials from identity and enables real-time, context-aware access decisions using AI.

sgnl.ai

WINDOWS EVENT FORWARDING GUIDANCE

A repository for setting up Windows Event Forwarding on a Windows server in an Active Directory environment. The repository includes GPOs, WEF subscriptions, and WEC channels.

github.comGitHub repository

LEMON

LEMON is a Linux memory dump tool that utilizes eBPF to capture the entire physical memory of a system and save it in LiME format, compatible with forensic tools like Volatility 3. Currently, LEMON supports only CO-RE kernels and on-disk memory dumps.

github.comGitHub repository

05MISCELLANEOUS

MACOS FLEXIBLEFERRET | FURTHER VARIANTS OF DPRK MALWARE FAMILY UNEARTHED

The Ferret family of malware is used by the Contagious Interview campaign targeting developers using macOS. The campaign involves victims being sent a link to communicate with an interviewer that throws an error and prompts the user to download a trojanized virtual meeting software which installs a Go backdoor and stealer. The newest variant uses a valid Apple Developer signature and Team ID, evades the current XProtect signatures, and masquerades as a Zoom application.

sentinelone.com6 min read

EXPLORING A VPN APPLIANCE: A RESEARCHER'S JOURNEY

An Akamai researcher discovered multiple vulnerabilities in Fortinet's FortiOS VPN appliance, including an out-of-bounds write, wild copy vulnerability, and denial-of-service issues. The vulnerabilities stemmed from an outdated Apache library (libapreq) from 2000 that was used to handle form data processing. While some vulnerabilities could crash the system or lead to potential information disclosure, no critical remote code execution exploits were confirmed, though the findings highlight the importance of examining VPN security.

akamai.com17 min read