TLDR INFORMATION SECURITY 2025-05-15

Learn more about True Scale Application Security

CHIPMAKER PATCH TUESDAY: INTEL, AMD, ARM RESPOND TO NEW CPU ATTACKS

Intel, AMD, and Arm have released security advisories on CPU vulnerabilities, including a branch privilege injection issue (CVE-2024-45332) that revives Spectre-BTI attacks on Intel processors. Intel is issuing microcode updates for this vulnerability and others identified by ETH Zurich and VU Amsterdam, which found three new Spectre v2 attacks that undermine domain isolation. In total, Intel patched 25 additional advisories for various high and medium-severity vulnerabilities, while AMD addressed several high-severity flaws in its Manageability Tools and CPU Libraries.

ICLICKER SITE HACK TARGETED STUDENTS WITH MALWARE VIA FAKE CAPTCHA

The website of iClicker, which provides a student engagement platform, was compromised in a ClickFix attack. The attack prompted users to click on a fake CAPTCHA, which copied a PowerShell command to users' clipboards and then instructed them to run it. The PowerShell script downloaded a legitimate Microsoft Visual C++ Redistributable if the script detected that it was in a malware sandbox or an unknown malware that is possibly an infostealer if it was running on a regular machine.

DIOR'S CHINA DATA BREACH EXPOSES ELITE CLIENTS

Luxury brand Dior experienced a customer data breach in China that exposed an undisclosed number of users' data. The stolen data included customers' names, genders, phone numbers, email addresses, mailing addresses, purchase amounts, and shopping preferences, but not financial data. Chinese users have expressed an erosion of brand trust on the Chinese social media site RedNote.

THE CRYPTOGRAPHY BEHIND PASSKEYS

Passkeys employ public-key cryptography for authentication. The user's device creates a digital signature with a private key, while the website verifies it using a public key, reducing password vulnerabilities. WebAuthn provides vital anti-phishing protections through origin binding, ensuring passkeys are functional only with their respective websites. Different authenticator types balance security and convenience. The passkey ecosystem supports cryptographic extensions for functionalities such as key derivation and secure storage. However, developers must implement account recovery mechanisms, as lost passkeys cannot be reconstructed.

RUDE AWAKENING: UNMASKING SLEEP OBFUSCATION WITH TTTRACER

Modern C2 implants will use sleep obfuscation where the implant encrypts itself and stays dormant for a period of time before decrypting itself, fetching and performing operations, and then repeating the cycle by encrypting itself again. This makes detection difficult because it is unlikely that an EDR will scan the system while the implant is decrypted. This author explores how to utilize Time Travel Debugging to detect when an implant decrypts itself and makes network calls. They note that this method is very successful but can be bypassed by malware authors by extending the sleep period to make the manual analysis untenable or by unloading the attached debugging DLL.

TALES FROM THE CLOUD TRENCHES: THE ATTACKER DOTH PERSIST TOO MUCH, METHINKS

Attackers leveraged a leaked AWS access key from an organization management account to establish multiple persistence mechanisms, including a "persistence-as-a-service" Lambda function triggered by API Gateway that creates new IAM users on demand. Previously unreported tactics included disabling trusted access for organization-level services, manipulating AWS Identity Center (SSO) to create backdoor users without MFA requirements, and operating from Telegram IP addresses. The attackers implemented comprehensive persistence strategies to survive credential revocation, demonstrating sophisticated knowledge of AWS services and security mechanisms.

ENTRAFALCON

EntraFalcon is a PowerShell-based tool for pentesters, security analysts, and sysadmins to evaluate the security of a Microsoft Entra ID environment.

ONEIROMANCER

oneiromancer is a reverse engineering assistant that uses a locally running LLM fine-tuned for Hex-Rays pseudo-code to aid with code analysis. It can analyze a function or a smaller code snippet to return a high-level description of the code's actions, recommended function names, and variable renaming suggestions.

SQLMAP AI ASSISTANT

An AI wrapper for SQLMap that simplifies SQL injection testing. It features automated result analysis, step suggestions, and adaptive testing with DBMS optimizations for MySQL, MSSQL, Oracle, and PostgreSQL. It also includes adaptive WAF Bypass, which dynamically selects tamper scripts based on WAF detection.

THE IMPACT OF MICROSOFT'S REFS ON DFIR

This blog post provides an in-depth discussion of the new Microsoft Resilient File System (ReFS) and details how it differs from NTFS from a forensics perspective. It highlights the challenges during the transitional period, such as a gap in tooling maturity, no Master File Table, a lack of undo logs in ReFS' logging, changes in the Change Journal, and various removed NTFS features. However, ReFS also offers new forensics opportunities, including the ReFS Log and “First Events,” the potential for carving opportunities in superblocks and checkpoints, the potential for deleted data to persist if shared with another file, integrity streams traces, and other metadata.

LEDGER SECURES DISCORD AFTER HACKER BOT TRIED TO STEAL SEED PHRASES

Hardware wallet provider Ledger notified users that it has secured its Discord server following an attacker's compromise of a moderator's account. The moderator's account was used to notify Discord members of a bogus vulnerability that required users to verify their recovery phrases with a scam link. Ledger reported that after some delays in reporting the issue due to the compromised account muting and banning other Ledger moderators, the compromised account was removed, and the bot was deleted.

ONE-CLICK RCE IN ASUS'S PREINSTALLED DRIVER SOFTWARE

The author found a serious security flaw in ASUS's DriverHub software that could let hackers run code with admin rights. They explained how the system could be tricked using subdomains and a silent install trick. ASUS fixed the problem after it was reported, but credited someone else.

MICROSOFT FIXES LINUX BOOT ISSUES ON DUAL-BOOT WINDOWS SYSTEMS

In August 2024, a Windows update disrupted Linux booting on dual-boot systems due to a Secure Boot modification, which Microsoft fixed by May 2025, advising users to install the latest updates.

GOOGLE CHROME TO BLOCK ADMIN-LEVEL BROWSER LAUNCHES FOR BETTER SECURITY

Google Chrome is set to discontinue running with admin rights to enhance security by restricting harmful files from gaining full system access, similar to a recent update in Edge.

NORTH KOREAN HACKERS STOLE $88M BY POSING AS US TECH WORKERS

North Korean hackers stole $88 million by using fake identities for remote tech jobs in the U.S., creating fake companies, resumes, and job references to deceive employers.