TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-03-06

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

CISCO WARNS OF WEBEX FOR BROADWORKS FLAW EXPOSING CREDENTIALS

A vulnerability in Webex for BroadWorks could allow for the disclosure of sensitive credentials if insecure transport is configured for the SIP communication. The vulnerability is caused by sensitive information exposed in the SIP headers that can be viewed in plain text in the client and server logs. Cisco has no evidence of exploitation but has pushed a configuration change to fix this vulnerability and is urging customers to restart their Webex clients.

bleepingcomputer.com2 min read

NEW ELEVEN11BOT BOTNET INFECTS 86K DEVICES FOR DDOS ATTACKS

Eleven11bot has infected over 86,000 devices. The botnet consists mostly of webcams and Network Video Recorders that use common, weak, or default admin credentials. GreyNoise has published a list of IPs that are associated with botnets.

bleepingcomputer.com2 min read

02STRATEGIES & TACTICS

DYNAMIC APPLICATION SECURITY TESTING (DAST)

DAST can scan dynamic web applications for vulnerabilities. Using tools like ZAPROXY, testers can simulate attacker perspectives, identifying weaknesses through manual and automated scans such as spidering and active scanning to improve web application security.

medium.com4 min read

CELLEBRITE ZERO-DAY EXPLOIT USED TO TARGET PHONE OF SERBIAN STUDENT ACTIVIST

In this post, Amnesty International investigates the exploit, techniques, and delivery mechanisms used by Cellebrite to target the Android phones of Serbian student activists. The exploit targeted core Linux kernel USB drivers, potentially affecting over a billion Android devices. Evidence shows an attempt to install a mysterious Android app after the phone was unlocked using Cellebrite.

securitylab.amnesty.org34 min read

03LAUNCHES & TOOLS

RAD SECURITY (PRODUCT LAUNCH)

Rad Security is an AI-driven defense platform that enhances operational efficiency for security teams and facilitates safe AI use in organizations.

radsecurity.ai

PENTAGI

PentAGI is an advanced tool designed for automated security testing that utilizes state-of-the-art artificial intelligence technologies.

github.comGitHub repository

TITLEIST

Titleist monitors newly registered domains for possible misspellings or bitflips. It utilizes the CertStream Python library and can be tailored to identify specific types of suspicious domains.

github.comGitHub repository

04MISCELLANEOUS

NEARLY 10% OF EMPLOYEE GEN AI PROMPTS INCLUDE SENSITIVE DATA

Harmonic, an AI data security company, revealed that 8.5% of employee prompts to popular LLMs included sensitive data. Harmonic's report showed that 46% of submitted sensitive data included billing and authentication data, 27% included employee PII and payroll data, and 15% included legal and financial data. Employees who enter sensitive data to free tiers of LLMs may be inadvertently leaking data, as the report demonstrated that 54% of sensitive prompts were entered on ChatGPT's free tier.

csoonline.com6 min read

LOCKED OUT, DROPBOXED IN: WHEN BEC THREATS INNOVATE

Invictus IR identified a threat actor who established persistence by leveraging a third-party mail client to phish contacts. The attack was initiated with a seemingly legitimate Dropbox invoice that directed the victim to a phishing page, where their credentials were harvested. The attacker used these credentials to log into the eM Client mail client, register accounts with Dropbox and WeTransfer, and spam contacts with fake invoices to compromise additional victims.

invictus-ir.com6 min read