TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-04-02

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

HITRUST.

And with Vanta continuously monitoring your security posture, your team can focus on growth, stay ahead of evolving regulations, and close deals in a fraction of the time.

vanta.com

02ATTACKS & VULNERABILITIES

OVER 1,500 POSTGRESQL SERVERS COMPROMISED IN FILELESS CRYPTOCURRENCY MINING CAMPAIGN

Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. It utilizes the COPY... FROM PROGRAM SQL command to execute arbitrary shell commands on the host and also deploys an obfuscated Golang binary codenamed postmaster that mimics the legitimate PostgreSQL multi-user database server.

thehackernews.com2 min read

CHECK POINT CONFIRMS BREACH BUT SAYS IT WAS OLD DATA

A hacker going by the name CoreInjection claimed to have stolen a highly sensitive dataset from Check Point containing internal network maps and architectural diagrams, user credentials, employee connect information, and proprietary source code. Check Point responded to these allegations by saying that this was an old, known security event with a limited scope that did not impact any customer data. Hudson Rock co-founder Alon Gal expressed skepticism of both claims and stated that the screenshots the hacker posted likely indicated a severity between the two claims.

theregister.com3 min read

HACKERS ABUSE WORDPRESS MU-PLUGINS TO HIDE MALICIOUS CODE

Must-Use Plugins (mu-plugins) are special plugins for WordPress sites that automatically execute on every page load and do not appear in the default view on the admin panel. Researchers at Sucuri have observed threat actors abusing mu-plugins for persistence. Sucuri has observed three commonly used payloads: one that redirects users to a malicious browser update site, one that installs a webshell, and one that replaces images with explicit content.

bleepingcomputer.com2 min read

03STRATEGIES & TACTICS

THREAT MODELLING AND ANALYZING IPHONE MIRRORING

Aaron Schlitt found security flaws in Apple's iPhone Mirroring feature, such as bypassing camera and microphone restrictions via shortcuts and accessing wallet data through NFC, which he notified Apple about. While Apple added some security measures through the Secure Enclave, the feature created new attack vectors and exhibited inconsistent security, especially with locked apps and Stolen Device Protection. Apple's responses varied; some reports were initially dismissed as "expected behavior" but later addressed in updates, indicating an unclear threat model for iPhone Mirroring within the company.

aaronschlitt.de13 min read

RUST FOR MALWARE DEVELOPMENT

A Bishop Fox researcher examines how Rust outperforms C/C++ in malware development. The analysis reveals that Rust-based malware results in larger binaries that resist reverse engineering, evade signature detection, and complicate tools like Ghidra. The author illustrates this with a dropper that enumerates processes, injects shellcode via file mapping, and stages a C2 payload, ultimately asserting that Rust effectively simulates modern adversarial tactics.

bishopfox.com12 min read

THE SECURITY RESEARCH PRODUCT FUNCTION

Zack Allen discusses the place and responsibilities of a Security Research team in security products. In security products, the security research organization can be thought of as the CTO of a product line in that the business needs engineering to inform product decisions, designers to communicate complex security topics to end-users, and work with marketing to maintain the veracity of materials. Allen also shows how the Kano model of product development can be applied to demonstrate the must have features, satisfied features such as updated rules, and wow features such as being the first to discover a new threat actor.

detectionengineering.net8 min read

04LAUNCHES & TOOLS

drata.com

NEW IN GMAIL: MAKING END-TO-END ENCRYPTED EMAILS EASY TO USE FOR ALL ORGANIZATIONS

Google Workspace simplifies sending end-to-end encrypted emails in Gmail, enhancing data privacy and security. Client Side Encryption (CSE) supersedes S/MIME, encrypting data on the client before transmission or storage in Google's cloud, making it indecipherable to Google and third parties while complying with regulatory requirements like data sovereignty and HIPAA.

workspace.google.com4 min read

DEFENDING-OFF-THE-LAND

Various tools and scripts from Thinkst's BlackHat EU 2024 talk that implemented various Windows OS features using nontraditional approaches like RDP Canarytoken, AD login alerter, Windows Registry Monitor, etc.

github.comGitHub repository

OSGINT

OSGINT is an OSINT tool to find information about a GitHub user.

github.comGitHub repository

05MISCELLANEOUS

DPRK IT WORKERS EXPANDING IN SCOPE AND SCALE

DPRK IT workers have expanded operations globally, especially in Europe, by masquerading as legitimate remote workers to infiltrate companies and generate revenue for North Korea. They employ deceptive tactics such as fake personas, falsified credentials from institutions like Belgrade University, and blockchain projects in the UK, using facilitators in the US and UK to bypass identity verification. Since October 2024, they have increased extortion attempts against former employers, threatening to release sensitive data post-termination, and have started targeting virtualized BYOD environments where traditional security monitoring is harder.

cloud.google.com5 min read

WHOIS HAS BEEN REPLACED BY RDAP: HOW DO THE TWO SYSTEMS COMPARE?

ICANN officially abandoned the WHOIS service on January 28. To replace it, ICANN released the Registration Data Access Protocol (RDAP) to provide users with access to gTLD registration data. RDAP has numerous advantages over WHOIS including support for access controls on the data that a user can see, JSON support, and HTTPS support.

novagraaf.com2 min read

WHY I RECOMMEND AGAINST BRAVE

The Brave Browser is a Chromium-based browser that promises to deliver privacy with built-in ad-blocking along with quality-of-life features like a VPN. This article goes through Brave's history from controversy around the CEO to a list of privacy violations and missteps. Some of the violations include replacing ads with Brave ads, using content creators in a donation campaign without consent, injecting referral links, adding ads to the New Tab page, and hiding their web crawler.

thelibre.news12 min read