TLDR INFORMATION SECURITY 2025-02-19

FRESSH BUGS UNDISCOVERED FOR YEARS THREATEN OPENSSH SECURITY

OpenSSH has released patches for two new vulnerabilities: a machine-in-the-middle attack (CVE-2025-26465) and a denial-of-service bug (CVE-2025-26466), discovered by Qualys. While not critically severe, they affect this widely used secure connection tool.

VENTURE CAPITAL GIANT INSIGHT PARTNERS HIT BY CYBERATTACK

Insight Partners revealed that they were breached in January following a social engineering attack. Insight has stated that they shut down the attacker's presence in their network immediately after detecting their intrusion and has no evidence that any portfolio companies, funds, or other stakeholders were impacted by this breach.

JUNIPER NETWORKS FIXED A CRITICAL FLAW IN SESSION SMART ROUTERS

Juniper Networks fixed a critical authentication bypass vulnerability, tracked as CVE-2025-21589 (CVSS score of 9.8), in its Session Smart Router. The flaw could allow attackers to take control of the device without proper authentication. Users are advised to upgrade to the fixed versions listed on the site to protect against potential attacks.

MAGENTO CREDIT CARD STEALER DISGUISED IN AN `IMG` TAG

Magecart is a credit card skimming malware that is sophisticated and hard to detect as it hides in `img` tags using Base64 encoding. It can seamlessly inject fake payment forms to steal card details, requiring vigilant security measures and monitoring.

REVOLUTIONIZING SOFTWARE TESTING: INTRODUCING LLM-POWERED BUG CATCHERS

Mutation testing is the process by which automatic test cases are programmatically created based on existing test cases to increase code coverage. Meta created the Automated Compliance Hardening (ACH) system to use LLMs to generate mutants to model realistic inputs. A developer uses ACH by describing the types of bugs that they're concerned about, ACH then generates a series of bugs and converts them into tests to run.

HOW ADVERSARIES EXPLOIT UNMONITORED CLOUD REGIONS TO EVADE DETECTION

Attackers commonly exploit unused regions in cloud providers to launch crypto miners, exfiltrate data, or deploy other payloads. This post explores the various methods and permissions that attackers can utilize in AWS, GCP, and Azure to enumerate or enable unused regions. This post also provides recommended mitigations such as restricting region usage, setting budget alerts, and conducting regular audits.

frontline. Read the full findings here

MIRRORTAB (PRODUCT LAUNCH)

MirrorTab intercepts and sanitizes a browser session before it ever reaches the customer's device eliminating the traditional client-side attack surface by preventing raw code or sensitive data from being exposed in the user's environment.

PASSKEY RAIDER

Passkey Raider is a Burp Suite extension designed to facilitate comprehensive testing of Passkey systems.

TAILPIPE

Tailpipe is an open source SIEM powered by DuckDB that allows for querying data with SQL directly from the terminal.

COMMON OAUTH VULNERABILITIES

This blog provides an overview of how OAuth 2 works with a focus on outlining the different parties involved in a request. It outlines the common flows that are used in OAuth applications such as Implicit Flows, Authorization Code Flows, Client Credentials, Device Authorization Flows, and Resource Owner Password Credentials Flows. The post then provides common attacks and mitigations against these flows.

UNDERSTANDING SAFETENSORS: A SECURE ALTERNATIVE TO PICKLE FOR ML MODELS

Python Pickles are a binary format that is commonly used to distribute ML models but is inherently insecure because arbitrary code can be executed during deserialization. SafeTensors is a format that was created to solve this issue by only storing metadata and numerical tensors. SafeTensors binaries should always be preferred over Pickles when available as in addition to the security benefits, they can also be more performant.

$10 INFOSTEALERS ARE BREACHING CRITICAL US SECURITY: MILITARY AND EVEN THE FBI HIT

The article talks about how relatively inexpensive infostealer malware, like boobytrapped PDFs, game mods, and pirated software, are leading to compromises across the board, even in critical US organizations like the Pentagon and the FBI. According to Hudson Rock's report, over 30 million computers worldwide have been hit, with one in five holding corporate credentials. The article includes a case study on Honeywell and the US Navy and discusses the importance of vigilance and training staff.

MICROSOFT THREAT INTELLIGENCE - NEW XCSSET VARIANT

The first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies.

CHINA-LINKED APT GROUP WINNTI TARGETS JAPANESE ORGANIZATIONS SINCE MARCH 2024

Researchers from cybersecurity firm LAC have uncovered that a China-linked APT group called Winnti carried out a cyberespionage campaign that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024.

X NOW BLOCKS SIGNAL CONTACT LINKS, FLAGS THEM AS MALICIOUS

Social media platform X is now blocking Signal.me links, used by the Signal encrypted messaging app to share account info, citing spam or malware risks.