TLDR INFORMATION SECURITY 2025-06-25

Watch the video (03:13 minutes)

SPARKKITTY SWIPES PICS FROM IOS, ANDROID DEVICES

SparkKitty is a new mobile malware that harvests photos from users' devices. The malware is delivered via fake or trojanized applications on the App Store and a trojanized version of the TikTok app that users are prompted to install via an Enterprise profile. Once installed, the apps prompt users to grant the app access to their galleries and then exfiltrate images to extract crypto seed phrases.

NEW FILEFIX ATTACK WEAPONIZES WINDOWS FILE EXPLORER FOR STEALTHY COMMANDS

FileFix, a variant of ClickFix attacks, is a new social engineering attack vector on Windows devices. In ClickFix attacks, a user is prompted by a website to execute a copied command in PowerShell to fix a bogus error. However, in the FileFix attacks, the user just needs to paste the command in the Windows File Explorer address bar, which is a much more familiar environment. The FileFix ruse informs users that a file was shared with them and prompts them to click a button that will launch File Explorer and copy a PowerShell command that contains a file path in a PowerShell comment to the clipboard. When the command is pasted into the File Explorer address bar, only the path will be displayed.

THREAT HUNTING INTRODUCTION: COBALT STRIKE

Cobalt Strike servers can be found online by scanning for their distinctive HTTP response signatures - specifically 404 Not Found responses with zero content length and text/plain content type. Researchers can download executable payloads from these servers using checksum-based URLs (like /tdN6 for x86 or /ZrJG for x64) and extract encrypted configuration metadata that reveals how red teams and malicious actors configure their command-and-control infrastructure. This post provides a Rust tool called SigStrike to automate this discovery and analysis process at scale across millions of potential servers.

NO AGENT, NO PROBLEM: DISCOVERING REMOTE EDR

The Performance Logs and Alerts DLL holds various DCOM interfaces that allow someone to interact remotely with Event Tracing for Windows (ETW) providers, trace sessions, configurations, etc. This post demonstrates how these capabilities can be used to detect various attacks without an agent and suggests ways that an attacker can use them to maintain stealthy persistence.

AUTOMATICALLY PRIORITIZE SECURITY ISSUES FROM DIFFERENT TOOLS WITH AN LLM

Security issue prioritization is a complex and time-consuming process that takes away time from resolving issues. This blog post proposes three scoring strategies that an LLM can use to rank security issues to combat this. The first strategy is to have the LLM assign a score based on provided criteria to each issue and sort the issues based on that score. The second strategy is to have the LLM use bubble sort and compare each issue pair-wise, which is more thorough than the first strategy but slower. The third strategy is to use an Elo system where a random sampling of issues is compared.

UNEXPECTED SECURITY FOOTGUNS IN GO'S PARSERS

Go's parsers for JSON, XML, and YAML have risky default behaviors such as case-insensitive fields, duplicate key acceptance, and lenient garbage data handling, which attackers can exploit to bypass security. These differences lead to conflicting interpretations across services processing the same input, causing vulnerabilities like CVE-2020-16250 in HashiCorp Vault. The new JSON v2 spec aims to fix these with secure defaults, but current measures rely on custom validation and static analysis.

demo

CYBERSECURITY AI

CAI is an open-source framework for building AI tools for cybersecurity bug hunting and vulnerability testing. It uses agents and tools to automate tasks, but lets humans guide and control the process.

TNOK – NEXT GENERATION PORT SECURITY

Tnok is a port security tool that employs time-based one-time passwords (TOTP) as dynamic port knock sequences. It encodes 6-digit 2FA codes into network packets sent to the target port: for UDP, the code is included in packet data, and for TCP, codes are encoded in TCP options (like MD5 and Mood) or distributed across multiple SYN packets via MSS values to avoid requiring root privileges. The system keeps protected ports closed until a valid TOTP code is received, after which it temporarily grants access without additional firewall configuration.

KALI LINUX 2025.1C FIXES KEY ISSUE, ADDS NEW TOOLS AND INTERFACE UPDATES

Kali Linux lost its software signing key in April, causing update errors for users with systems installed before that date and potentially exposing them to security risks. Version 2025.1c fixes this issue by including a new repository key. Older installations will require manually downloading and installing the new key via a wget command. The update also introduces a redesigned menu following the MITRE ATT&CK framework and adds over a dozen new security tools, including Azurehound, binwalk3, and bopscrk.

WINDOWS 11'S CRUCIAL RESTORE POINTS NOW SELF-DESTRUCT AFTER 60 DAYS

Microsoft announced that as of the June update, Windows 11 24H2, restore points will only be stored for 60 days. Restore points are used to restore a system to a known good state in the event of system corruption. Before this update, restore points were stored for 90 days.

POLICE WARN OF SMS ‘BLASTER' SCAMS

Police warned about SMS "blaster" devices after Chinese student Ruichen Xiong was jailed for over a year for using one to send fraudulent messages while driving in London in March. These radio devices lure phones from legitimate networks with stronger signals, enabling criminals to send texts without phone numbers and bypass anti-spam measures to conduct "smishing" attacks that steal personal info. Experts suggest Android users disable 2G and iPhone users filter unknown messages. Report suspicious texts to 7726.

CRYPTOMINERS' ANATOMY: SHUTTING DOWN MINING BOTNETS

Akamai developed two techniques to shut down cryptomining botnets by exploiting mining pool topologies and policies - submitting "bad shares" (invalid hash calculations) that trigger automatic bans from mining pools. The first technique targets mining proxies by connecting as a fake miner and submitting consecutive bad shares, causing the proxy to get banned and shutting down the entire botnet operation (they reduced one campaign's hashrate from 3.3 million to zero). The second technique floods public pools with thousands of fake login attempts to temporarily disrupt direct pool connections, though this method is less permanent than targeting proxies.

NEW U.S. VISA RULE REQUIRES APPLICANTS TO SET SOCIAL MEDIA ACCOUNT PRIVACY TO PUBLIC

The U.S. now requires F, M, and J visa applicants to make their social media accounts public.

ANDROXGH0ST BOTNET EXPANDS REACH, EXPLOITING US UNIVERSITY SERVERS

The Androxgh0st botnet is attacking more targets, including US universities like UC San Diego, by exploiting weak servers and software.

THE U.S. HOUSE BANNED WHATSAPP ON GOVERNMENT DEVICES DUE TO SECURITY CONCERNS

The U.S. House has prohibited the use of WhatsApp on official devices due to security and data protection concerns, requiring staff to use approved alternatives such as Microsoft Teams and Signal.