TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-04-10

6 sections19 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

Sponsored

MFA MANDATES ALONE WON'T SOLVE IDENTITY SECURITY

Earlier this year, Microsoft made MFA mandatory on all Azure logins - but in an age of increasingly sophisticated attacks against identities, this might not be enough.

duo.comSponsor

02ATTACKS & VULNERABILITIES

FAKE MICROSOFT OFFICE ADD-IN TOOLS PUSH MALWARE VIA SOURCEFORGE

Kaspersky researchers discovered a threat actor that is using a SourceForge project page to host malware masquerading as the Microsoft Office-Addin-Scripts project. The page prompts users to download a password-protected zip file that contains an MSI file, which drops two RAR archives and downloads a batch script from GitHub. The batch script scans for antivirus and analysis tools, unpacks the archives, and runs another batch script, which sets up persistence, C2, and runs a cryptocurrency infostealer and crypto miner.

bleepingcomputer.com2 min read

CENTRESTACK RCE EXPLOITED AS ZERO-DAY TO BREACH FILE SHARING SERVERS

Gladinet has warned of a vulnerability in its CentreStack file-sharing software that has been under active exploitation since March. The vulnerability is a deserialization vulnerability stemming from using a hardcoded machineKey. Galdinet has recommended that customers apply patches immediately or rotate the machine keys if immediate patching is not possible.

bleepingcomputer.com2 min read

03STRATEGIES & TACTICS

LINUX KERNEL RUST MODULE FOR ROOTKIT DETECTION

Linux rootkits commonly share a set of capabilities such as hiding itself, hiding data, offering a reverse root shell, and establishing boot persistence. The author of this blog post discusses how to use kprobe to detect LKM rootkit registration and inline hooking. They also reflect on the process of writing an LKM in Rust during their internship, noting the lack of abstractions but also appreciating the safety guarantees of Rust as well as the typing and linting systems.

blog.thalium.re10 min read

HACKING AWS LAMBDA FUNCTIONS - S3 FILE UPLOAD INJECTION

This post showcases the damage that a coding vulnerability in a Lambda function can cause using the DVSA intentionally vulnerable app as an example. The application includes a Lambda function that uploads files attached to the feedback form, which is vulnerable to OS command injection. This vulnerability can be used to extract the Lambda function's IAM credentials, which provide full access to Lambda and SES.

nordhero.com6 min read

PCI DSS 4.0.1: A CYBERSECURITY BLUEPRINT BY THE INDUSTRY, FOR THE INDUSTRY

PCI DSS 4.0.1, exemplifies successful industry-led cybersecurity regulation by focusing on outcomes rather than methods. Unlike government regulations that awkwardly combine business security with user rights, PCI DSS was created by payment industry stakeholders collaboratively addressing threats. This commentary dives into how other existing and future regulations and frameworks can learn from PCI.

securityweek.com6 min read

04LAUNCHES & TOOLS

Sponsored

WEBINAR: HOW TO ACHIEVE ZERO TRUST ACCESS FOR KUBERNETES

Managing VPN gateways, firewall rules, and security groups is time-consuming. Exposing API endpoints or using jump hosts creates security risks. Is there a better way? Watch the NetBird webinar recording [11] and learn how to securely access Kubernetes from non-Kubernetes resources, with Zero Trust access to your control plane

netbird.ioSponsor

OPKSSH

opkssh (OpenPubkey SSH) is a tool that enables SSH to be used with OpenID Connect identities instead of long-lived SSH keys.

github.comGitHub repository

MIMIC (PRODUCT LAUNCH)

Mimic is exclusively focused on thwarting the threat from ransomware gangs. It offers features to quickly detect signs of malicious data encryption and tools to hide critical assets from attackers.

mimic.com

N6

Automated handling of data feeds for security teams

github.comGitHub repository

05MISCELLANEOUS

ANTHROPIC ANNOUNCES UPDATES ON SECURITY SAFEGUARDS FOR ITS AI MODELS

Anthropic has announced new updates to its Responsible Scaling Policy (RSP), which determines what level of model requires additional protections. These models include those with the capacity to potentially help a state actor develop chemical and biological weapons or if a model could be used to fully automate the role of an entry-level Anthropic researcher. Anthropic had announced in October that it would begin sweeping physical offices for hidden devices and implement other physical security measures.

cnbc.com2 min read

MALAYSIA PM SAYS COUNTRY REJECTED $10 MILLION RANSOM DEMAND AFTER AIRPORT OUTAGES

A cyberattack caused computer outages at Kuala Lumpur International Airport in Malaysia back in March. Prime Minister Anwar Ibrahim refused the attackers' $10 million ransom demand. At the time, even though officials claimed airport operations continued normally, photos showed staff using whiteboards for flight information.

therecord.media2 min read

NIST TO IMPLEMENT 'DEFERRED' STATUS TO DATED VULNERABILITIES

NIST announced all CVEs published before January 1, 2018, will be marked "deferred" in the National Vulnerability Database. This administrative change helps prioritize newer vulnerabilities but doesn't reduce the severity of older security flaws.

links.tldrnewsletter.com2 min read