TLDR INFORMATION SECURITY 2025-04-04

> Learn more about Bitwarden for Business.

GOOGLE PATCHES QUICK SHARE VULNERABILITY ENABLING SILENT FILE TRANSFERS WITHOUT CONSENT

A vulnerability in Google's Quick Share (CVE-2024-10668) for Windows permitted unauthorized file transfers. The flaw, fixed in version 1.0.2002.2, could be exploited to bypass security and cause denial-of-service attacks.

AI IMAGE SITE GENNOMIS EXPOSED 47GB OF UNDERAGE DEEPFAKES

A data leak at GenNomis, an AI image site, exposed explicit deepfake material, including images of minors and celebrities. This incident raises concerns about unmonitored AI-generated content and underlines the need for improved security measures and responsible AI development. Cybersecurity researcher Jeremiah Fowler emphasized the importance of detecting and preventing harmful deepfakes.

SECURITY FLAW FOUND IN UNITREE GO1 ROBOT DOGS

Researchers at the Berlin-based security startup thinkAwesome GmbH discovered a vulnerability in Unitree Go1 robot dogs. The robots include a service called CloudSail, which is a remote access tunnel service that was preinstalled on the devices. The researchers discovered that anyone with the default credentials and a specific API key could remotely control the robots and access their cameras.

PART 3 CODE INJECTION : HOW TO DETECT IT AND FINDING EVIL IN MEMORY WITH MEMPROCFS FINDEVIL PLUGIN

Attackers use advanced techniques, such as memory manipulation, to evade detection via code injection. Tools like Volatility and MemProcFS help spot memory structure inconsistencies indicating malicious activity. Security professionals can identify indications of code injection and process manipulation by analyzing memory permissions and DLL loading behaviors.

SURGE IN PALO ALTO NETWORKS SCANNER ACTIVITY INDICATES POSSIBLE UPCOMING THREATS

There has been a surge in login scanning for Palo Alto Networks PAN-OS GlobalProtect portals, with about 24,000 unique IPs attempting access in the last 30 days. This coordinated effort may indicate a plan to discover and exploit vulnerabilities. Organizations should secure their login portals. The primary sources are the United States and Canada, reflecting patterns from a past espionage campaign targeting network devices and highlighting the need to monitor and secure critical systems.

UNDERSTANDING RCPS AND SCPS IN AWS: CHOOSING THE RIGHT POLICY FOR YOUR SECURITY NEEDS

Resource Control Policies (RCPs) were introduced by AWS in late 2024 to restrict access to resources within your AWS organization. RCPs should be used when trying to enforce consistent security standards in supported services, you're running out of SCPs, or you want to use the NotResource condition. SCPs should be used when you want to apply a policy to services that are not supported by RCPs or use the NotAction condition.

the report

SOLARWINDS LAUNCHES INCIDENT RESPONSE TOOL, BOOSTS AI IN OBSERVABILITY PLATFORM

SolarWinds has launched a new incident response tool called Squadcast Incident Response. It has also improved its observability platform with AI-based updates to enhance IT operational resilience. These updates include AI-powered alert isolation, on-call management, and integrations with Microsoft Teams and Slack.

OCTOSQL

A CLI for querying multiple databases: JSON, Parquet, and CSV/TSV with SQL.

SECURECODEBOX

secureCodeBox is a Kubernetes-based, modularized toolchain for continuous security scans of your software projects.

LEGACY STRIPE API EXPLOITED TO VALIDATE STOLEN PAYMENT CARDS IN WEB SKIMMER CAMPAIGN

Threat hunters have uncovered a web skimmer campaign that exploits Stripe's legacy API to validate stolen payment cards for attackers. The attackers target merchants by hiding the legitimate payment form and cloning buttons to efficiently steal card data. This operation uses malicious scripts on compromised sites and tailors the skimmer payload to each target.

MICROSOFT'S AI TOOL CATCHES CRITICAL GRUB2, U-BOOT BOOTLOADER FLAWS

Microsoft's AI tool has detected critical vulnerabilities in bootloaders like GRUB2 and U-boot that enable attackers to bypass Secure Boot and deploy persistent malware. These flaws significantly threaten enterprises, allowing malware to survive OS reinstallation. Organizations must prioritize patching affected systems and improving firmware and bootloader updates.

REVIEWING THE CRYPTOGRAPHY USED BY SIGNAL (BLOG SERIES)

This blog series provides an explanation of how to conduct cryptographic reviews, a mapping of Signal, and an in depth look at Signal's symmetric-key authenticated encryption, Signal's use of double ratcheting protocols, key transparency, and other cryptographic features such as group messaging.

TRUMP ADVISOR REPORTEDLY USED PERSONAL GMAIL FOR “SENSITIVE” MILITARY DISCUSSIONS

National Security Advisor Michael Walz has been reportedly using his personal Gmail to discuss sensitive military operations.