TLDR Index

Search the archive

Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.

Results

9,988 matches

SECTEMPLATES

SecTemplates is an open-source collection of templates for running various security programs.

2024.08.30
sectemplates.comToolTLDR InfoSec

AN AWS IAM SECURITY TOOLING REFERENCE

This post presents a list of different tools for simplifying AWS IAM security. PMapper and Cloudsplaining can be used to identify privilege escalation vectors and least privilege violations. Parliament and aws-lint-iam-policies provide linters. IAMSpy provides an SMT solver to formally prove whether a given IAM identity has access to a given resource. Apeman can be used to visualize IAM relationships.

2024.08.30
ramimac.me5 min readTLDR InfoSec

STATE-BACKED ATTACKERS AND COMMERCIAL SURVEILLANCE VENDORS REPEATEDLY USE THE SAME EXPLOITS

Google's Threat Analysis Group discovered exploit campaigns targeting Mongolian government websites using iOS and Chrome vulnerabilities previously seen in commercial surveillance vendor exploits. The attackers utilized watering hole attacks to deploy sophisticated exploits and steal browser data, prompting notifications to Apple and Android partners to address the vulnerabilities. The reuse of exploits highlights the risk of dangerous threat actors acquiring tools developed by the commercial surveillance industry, emphasizing the ongoing threat of watering hole attacks on mobile devices.

2024.08.30
blog.google8 min readTLDR InfoSec

DEEP-TEMPEST: IMAGE HIJACKING VIA HDMI

Researchers in Uruguay have developed a side-channel attack method called Deep-TEMPEST that reconstructs images from radio noise emitted by HDMI connections. Using machine-learning algorithms, they successfully extracted text displayed on an external monitor from intercepted signals. This attack highlights the potential security risks associated with monitoring and intercepting digital data transmissions.

2024.08.30
kaspersky.com5 min readTLDR InfoSec

Sponsored

Taking place on SEPTEMBER 19, 2024, dive deep into AWS and learn how to build a more secure cloud.

2024.08.28
sonrai.coSponsorTLDR InfoSec

MOVEIT HACK EXPOSED PERSONAL DATA OF HALF MILLION TDECU USERS

Texas Dow Employees Credit Union has reported a data breach stemming from compromised MOVEit file transfer software that affected over 500,000 members. The breach, which was discovered in July 2024 but occurred a year earlier, exposed sensitive personal and financial information.

2024.08.28
infosecurity-magazine.com2 min readTLDR InfoSec

MICROSOFT UPDATE BREAKS DUAL-BOOT

Microsoft's GRUB patch to fix CVE-2022-2601 has led to errors when trying to boot Linux partitions in dual-boot systems due to incompatible EFI boot loaders. The workaround for users on affected distros is to either disable Secure Boot or delete the Microsoft SBAT. Microsoft maintains that the update should only be installed on systems without a Linux boot option and has stated that it's working with Linux partners to address the issue.

2024.08.28
arstechnica.com4 min readTLDR InfoSec

ADDRESSED AWS DEFAULTS RISKS: OIDC, TERRAFORM, AND ANONYMOUS ACCESS TO ADMINISTRATORACCESS

This post introduces a novel AWS attack in which an attacker can utilize Terraform Cloud to gain AdministratorAccess on an AWS account by only knowing (or guessing) the Terraform OIDC role and AWS account ID of a victim. This attack is possible when an OIDC's role is created with a trust relationship that does not specify a subject key, which previously was the default when creating a Federated Identity using the GUI. AWS has addressed this vulnerability by adding a mandatory Organization field that becomes the subject field when creating a Federated Identity using the GUI. This post suggests a Lambda strategy that defenders can use to periodically scan for this vulnerability.

2024.08.28
hacktodef.com11 min readTLDR InfoSec

CLOUD DFIR - AWS IAM PRIVESC LEADS TO EC2 RANSOMWARE

This post examines the AWS DFIR process in a fictional scenario where an organization suffered a ransomware attack that encrypted all files on all of its EC2 instances. The analyst first investigated Sysmon logs on a Windows EC2 instance and identified that the AWS SSM Run Command was used to download malicious scripts from a GitHub repo which were then executed as SYSTEM. They then analyzed CloudTrail logs to identify the role that was used to run the SSM commands, but since it was a commonly used role to execute SSM Commands, the analyst also needed to track down the user that assumed the role in the given timeframe. Upon identifying the compromised user, the analyst also identified that the attacker moved laterally from the initially compromised account by creating access keys for the account that had permissions to assume the SSM commands role.

2024.08.28
links.tldrnewsletter.com13 min readTLDR InfoSec

MACOS X MALWARE DEVELOPMENT

The blog post, in which the author discusses designing malware for macOS, covering its architecture, security features, Mach API, kernel internals, and shellcode injection, was originally written in 2022 and updated for macOS X Catalina. It emphasizes the importance of understanding system calls, memory protection mechanisms, and code injection techniques using Mach APIs on macOS. The author recommends further reading on the topic and highlights the importance of understanding the environment, features, and security of macOS through practical examples.

2024.08.28
0xf00sec.github.io36 min readTLDR InfoSec

STIX-SHIFTER

This project consists of an open source library that allows software to connect to data repositories using STIX Patterning and return results as STIX Observations.

2024.08.28
github.comGitHub repositoryTLDR InfoSec

SECURECODEBOX

secureCodeBox is a Kubernetes-based modularized toolchain for continuous security scans on software projects. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.

2024.08.28
github.comGitHub repositoryTLDR InfoSec

RANSOMWARE TOOL MATRIX

A repository containing a list of tools that different ransomware gangs utilize to aid defenders in threat hunting.

2024.08.28
github.comGitHub repositoryTLDR InfoSec

UBER HIT WITH $324 MILLION EU FINE FOR IMPROPER DATA TRANSFER

Uber faces a €290 million fine from Dutch regulators for improperly transferring EU driver data to the US, violating GDPR. The investigation, prompted by French drivers' complaints, found sensitive information stored on US servers without adequate protection.

2024.08.28
theverge.com3 min readTLDR InfoSec

HOW SOME LET'S ENCRYPT RENEWAL FAILURES POINTED TO AN AWS TRAFFIC HIJACKING ISSUE

An AWS customer began to notice connectivity issues with Let's Encrypt renewals in a VPS that they used that they were not able to resolve with support from the VPS provider. After debugging with AWS, they discovered that the traffic was being routed to a third party that was advertising a typoed BGP route through Direct Connect that unintentionally overlapped with the original AWS customer's IP range. AWS support confirmed that its BGP route verification process failed in this circumstance and has added process improvements to prevent possible malicious traffic hijacking through this vector in the future.

2024.08.28
chair6.net10 min readTLDR InfoSec

Sponsored

TOP 10 ML RISKS

Orca's AI Goat, provided as a free and open source tool [4], is an intentionally vulnerable AI environment for testing and learning purposes. The ready-to-deploy Terraform environment [4] launches an online application riddled with threats and vulnerabilities, based on the OWASP top 10 ML risks.

2024.08.26
orca.securitySponsorTLDR InfoSec

HALLIBURTON SHUTS DOWN SYSTEMS AFTER CYBERATTACK

Energy giant Halliburton has reported a cyberattack, prompting it to shut down some internal systems. The company is investigating the impact. The U.S. Department of Energy has reported no current disruption to energy services.

2024.08.26
techcrunch.com2 min readTLDR InfoSec

SLACK AI CAN BE TRICKED INTO LEAKING DATA FROM PRIVATE CHANNELS VIA PROMPT INJECTION

A method to abuse Slack AI to leak messages from private channels was recently discovered. The prompt injection attack enables attackers to post prompt injection messages in public channels and retrieve API keys from channels that the attackers do not have access to. Slack has stated that this is not a vulnerability and that the feature is working as intended.

2024.08.26
theregister.com3 min readTLDR InfoSec

WHAT IS AN SBAT AND WHY DOES EVERYONE SUDDENLY CARE

Secure Boot Advanced Targeting (SBAT) was developed to address the limitations of revoking individual hashes for bootloader binaries in the Secure Boot ecosystem. Microsoft pushed a Windows update that made systems not trust versions of grub with a security generation below a certain level due to security vulnerabilities, causing boot issues for some users. The incident highlights the importance of updating bootloader code and security generations to prevent potential attacks on operating systems.

2024.08.26
mjg59.dreamwidth.org5 min readTLDR InfoSec

LINUX DETECTION ENGINEERING - A PRIMER ON PERSISTENCE MECHANISMS

This blog post discusses Linux persistence mechanisms used by threat actors and how to detect and hunt for these techniques. It covers methods like scheduled tasks, systemd services, shell profile modifications, and reverse shells, providing practical demonstrations using a tool called PANIX. The post aims to educate defenders and researchers on foundational aspects of Linux persistence for effective detection and security strategies.

2024.08.26
elastic.co30 min readTLDR InfoSec

AZURE-WIRESHARK-NETWORK-PROTOCOLS

This tutorial walks readers through setting up Windows and Ubuntu VMs in Azure and using Wireshark to observe various types of network traffic. It teaches how to create and configure virtual machines, monitor ICMP, SSH, DHCP, DNS, and RDP traffic, and understand the behavior of each traffic type.

2024.08.26
github.comGitHub repositoryTLDR InfoSec

HEELER (PRODUCT LAUNCH)

Heeler provides real-time code, behavior, and business context so that organizations can automate the process of assessing security risks and prioritize operations and objectives.

2024.08.26
heeler.comTLDR InfoSec

EMBA

EMBA is a central firmware analysis tool for penetration testers and product security teams. It supports the complete security analysis process with firmware extraction, static and dynamic analysis via emulation, and generating a web report.

2024.08.26
github.comGitHub repositoryTLDR InfoSec

SCUBAGEAR

ScubaGear is a tool that assesses Microsoft 365 tenants against the CISA Secure Cloud Business Applications configurations baselines.

2024.08.26
github.comGitHub repositoryTLDR InfoSec

SECURITY TRAINING & AWARENESS - 10 ESSENTIAL TECHNIQUES

This post reflects on what aspects have helped security awareness training work and what hasn't. It emphasizes ambient security controls which offer concrete solutions and escalation paths over long lists of policies and traditional, computer-based training. It also points out key moments to reinforce learning, such as when users run into a guard rail and when they switch positions.

2024.08.26
philvenables.com16 min readTLDR InfoSec

16 THOUGHTS ON “LOCAL NETWORKS GO GLOBAL WHEN DOMAIN NAMES COLLIDE”

Due to the proliferation of new Top Level Domains (TLDs), many internal networks now collide with external networks, potentially exposing their networks to credential theft and other attacks. Security researcher Philippe Caturegli has been mapping this "namespace collision" vulnerability by scanning for self-signed certificates referencing domains in business-oriented TLDs. Caturegli found over 9,000 exposed domains, with some government entities and critical infrastructure affected.

2024.08.26
krebsonsecurity.com7 min readTLDR InfoSec

Sponsored

This Wednesday, Drata will be hosting cybersecurity analyst and TED speaker Keren Elazari [4] for an open chat on the future of the industry and how resilience can be achieved with adaptability and innovation.

2024.08.23
links.tldrnewsletter.comSponsorTLDR InfoSec

HACKERS STEAL BANKING CREDENTIALS FROM IOS, ANDROID USERS VIA PWAS

A new trend in phishing campaigns is to use progressive web apps (PWAs) to trick victims into entering banking credentials. The campaigns being tracked are using bogus notifications to update banking apps or ads on social media to download a bank's application to earn a promotion. The victim is then directed to a fake Google Play or App Store page that downloads the PWA which mimics the official app and steals the victim's credentials. The benefit of this method is that attackers can bypass App Store or Play Store restrictions.

2024.08.23
bleepingcomputer.com4 min readTLDR InfoSec

MICROCHIP TECHNOLOGY DISCLOSES CYBERATTACK IMPACTING OPERATIONS

Microchip Technology Incorporated has disclosed a data breach that impacted operations to the SEC. It did not disclose details of the incident but has stated that it is investigating the impact of unauthorized activity in its environment. The filing suggests that the incident may have been caused by ransomware.

2024.08.23
bleepingcomputer.com2 min readTLDR InfoSec

ENHANCING LINKEDIN'S SECURITY POSTURE MANAGEMENT WITH AI-DRIVEN INSIGHTS

This blog post from Linkedin explains why and how LinkedIn developed its own AI-driven Security Posture Platform (SPP) to manage vulnerabilities across its vast hardware estate. The SPP employs generative AI models and GraphQL API to efficiently map security engineers' queries to the graph, providing rapid access to accurate vulnerability information.

2024.08.23
linkedin.com10 min readTLDR InfoSec

C++ UNWIND EXCEPTION METADATA: A HIDDEN REVERSE ENGINEERING BONANZA

This blog post discusses how C++ compilers insert wind and unwind metadata to ensure proper destructor calls during exceptions in C++ programs. Compilers invisibly insert special blocks to handle object destruction when exceptions occur, even if control flow skips normal destructor calls. Wind metadata provides valuable information for analyzing constructors and destructor calls in C++ programs.

2024.08.23
msreverseengineering.com14 min readTLDR InfoSec

Sponsored

DATA THEFT SURGED 429% IN EARLY 2024

* What's causing the surge in ransomware attacks, data breaches, and vulnerability exploits? * Which industries have suffered the most? * How can companies stay ahead of the latest threats?

2024.08.23
go.flashpoint.ioSponsorTLDR InfoSec