Search the archive

DETECTING AITM PHISHING SITES WITH FUZZY HASHING

HUMBLE

A humble and fast security-oriented HTTP headers analyzer.

IMDSPOOF

IMDSpoof is a tool that spoofs the AWS IMDS service running on an EC2 instance. The tool spoofs the security-credentials IMDS endpoint and redirects it to a local webserver. This webserver can utilize Thinkst Canary HoneyTokens to alert on user access.

COPACETIC

Copacetic can be used to quickly patch a container without going upstream for rebuild based on vulnerabilities. This can be used to shorten incident response times because the time from vulnerability announcement to active exploitation continues to narrow.

MICROSOFT CONFIRMS WINDOWS BUG RENAMES PRINTERS TO HP LASERJET M101-M106

Microsoft has confirmed a bug that causes all printers to be renamed to HP LaserJet M101-M106, leading to automatic installation of the HP Smart app on Windows 10 and 11 devices. This occurs even on systems that are not HP computers or printers.

15,000 GO MODULE REPOSITORIES ON GITHUB VULNERABLE TO REPOJACKING ATTACK

Security research firm Vulncheck claims that 15,000 Go module repositories on GitHub are vulnerable to an attack called repojacking, where bad actors take advantage of account username changes and deletions to create repositories with the same name and stage open-source software supply chain attacks. These repositories account for at least 800,000 Go module-versions.

IAM ACCESS ANALYZER ADDS UNUSED ACCESS AND CUSTOM POLICY CHECKS

AWS IAM Access Analyzer has added a new analyzer to continuously monitor roles and users for permissions that are granted and not used. The custom policy checks can be integrated with a CI/CD tool to allow for reporting on whether a change will add any additional IAM permissions.

A DECADE OF HAVE I BEEN PWNED

A post from Troy Hunt reflecting on and detailing the history of Have I Been Pwned on its 10th birthday.

SCAN FOR TAILSCALE SECRETS WITH TRUFFLEHOG

Tailscale announced a collaboration with TruffleHog to add their secrets’ patterns to TruffleHog. The tool will now be able to detect exposed Tailscale secrets in source code.

THE TORTOISE AND THE MALWAHARE

PWC discusses how they're tracking a highly capable Türkiye-nexus threat actor known as Teal Kurma.

YOUR REFERRAL LINK - https://tldr.tech/infosec?ref=2613930

SECURITY FLAWS IN COURT RECORDS SYSTEMS USED IN FIVE US STATES EXPOSED SENSITIVE DOCUMENTS

Jason Parker discovered that witness lists and testimony, mental health evaluations, trade secrets, and other court records were publicly accessible in unredacted form by court records systems in five different states. Parker alleged that some of the vulnerabilities were as simple as incrementing a record number. In this article, Parker details the responses received from the various court systems that vary from open communication to refusal to fix the vulnerabilities.

STAPLES CONFIRMS CYBERATTACK BEHIND SERVICE DISRUPTIONS

Staples announced that it has taken proactive steps to mitigate cybersecurity risks and protect customer data. Employees reported a disruption to internal tools and online order fulfillment has been delayed. BleepingComputer attests that no ransomware was deployed and no files have been encrypted.

CRITICAL 'LOGOFAIL' BUGS OFFER SECURE BOOT BYPASS FOR MILLIONS OF PCS

Hundreds of consumer and enterprise-grade x86 and ARM models from various vendors, including Intel, Acer, and Lenovo, are potentially vulnerable to bootkits and takeover. ‘LogoFAIL’ reveals significant security vulnerabilities in the image parsing libraries used by nearly all BIOS vendors to display logo images during boot.

SECURING THE FRONTEND: A PRACTICAL GUIDE FOR DEVELOPERS

This blog post delves into the relationship between frontend development and cybersecurity by exploring challenges, best practices, and successful implementations. The goal is to guide developers in navigating the complexities of building a secure frontend without compromising the user experience.

HOW GITLAB'S RED TEAM AUTOMATES C2 TESTING

In this blog post, Gitlab talks about how their red team conducts security exercises that simulate real-world threats to assess and improve the effectiveness of the organization's security measures. The team uses open-source command and control (C2) tools, such as the Mythic framework, to customize and combine different open-source options to evade detection.

IMPROVE YOUR INCIDENT RESPONSE WITH JUPYTER NOTEBOOKS

This blog post from AWS presents a method for using Jupyter notebooks to document incident response processes, with executable snippets. Using Jupyter notebooks for IR playbooks can aid in making more readable code for analysts as well as standardizing analysis and response. The blog post also contains a tutorial for creating a Jupyter notebook for IR in AWS using Sagemaker.

KUBECTL-IAM4SA

kubectl-iam4sa is a command line program for debugging IAM roles for Kubernetes service accounts. The tool requires the user to have access to the Kubernetes cluster, AWS IAM, and AWS CloudTrail.

OPEN-APPSEC

open-appsec builds on machine learning to provide preemptive web app & API threat protection against OWASP-Top-10 and zero-day attacks. It can be deployed as an add-on to Kubernetes Ingress, NGINX, and API Gateways.

THREAT DRAGON

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram.

WHATSAPP’S NEW SECRET CODE FEATURE HIDES LOCKED CHATS

WhatsApp has launched a new feature that enables users to hide their Locked Chats folder from appearing in standard search results or browsing. The new Secret Code feature will allow users to set a code specifically for securing Locked Chats. Secret Codes has begun rolling out globally.

NEW ANDROID BANKING MALWARE, “FJORDPHANTOM”

Using social engineering tactics, FjordPhantom tricks unsuspecting users into downloading and installing the malicious app disguised as a legitimate banking app. The malware also employs techniques to evade detection and maintain persistence on infected devices.

IT'S TURTLES ALL THE WAY DOWN 🐢

This post dives into a new ransomware sample for macOS dubbed “Turtle”. It concludes that while in its current state, it does not pose much of a threat to macOS users, it shows that ransomware authors are continuing to set their sites on macOS.

EU AGREES ON RULES TO PROTECT SMART DEVICES

A joint EU commission has adopted the Cyber Resilience Act, which sets out cybersecurity requirements for the design, development, production, and sale of hardware or software products. Manufacturers will be required to assess the cybersecurity of their devices, provide declarations of conformity, and take appropriate action to remediate vulnerabilities for the device’s expected lifetime or a minimum of 5 years.

CYBERCRIMINALS LEVERAGE HIJACKED BOOKING.COM ACCOUNTS FOR PHISHING

This blog post discusses how Cybercriminals are using hijacked Booking.com accounts to conduct phishing scams.

DOLLAR TREE IMPACTED BY ZEROEDIN DATA BREACH AFFECTING 2 MILLION INDIVIDUALS

Workforce analytics services provider ZeroedIn is notifying roughly two million individuals that their personal information was compromised in an August 2023 data breach. The leaked data includes names and social security numbers.

IDENTITY MANAGEMENT COMPANY OKTA REVEALS FAR MORE EXTENSIVE HACK OF ITS SYSTEMS

Okta has revealed that the hack back in September actually affected all its customers instead of 1%. The compromised data includes full names and email addresses, and for a smaller percentage of customers, phone numbers.

EMERGENCY IOS PATCH MARKS 20 ZERO-DAYS IN 2023

Apple has released an emergency patch to fix two new actively exploited zero-day vulnerabilities in the WebKit browser engine. The vulnerabilities allow attackers to gain sensitive information via an out-of-bounds read weakness and code execution via a memory corruption bug. These two vulnerabilities mark 20 zero-days reported in iOS during 2023.

HOW A CHARGE POINT OPERATOR ACCIDENTALLY LEAKED AUTHENTICATION INFORMATION OF ALL ITS POTENTIAL CUSTOMERS

This article covers an anonymous responsible disclosure of an API issue to a charge point provider. Omitted per the operator's legal request, the problem was resolved promptly. The piece aims to help developers avoid excessive info disclosure through APIs while making necessary revelations safely.

TRAP; RESET; POISON; - TAKING OVER A COUNTRY KAMINSKY STYLE

This post covers the research of an exotic DNS Cache Poisoning vulnerability that could have manipulated DNS name resolution for an entire country. The exploitation of this issue would have allowed threat actors to cause serious harm. This is an in-depth look at all the technical intricacies of the attack and how to TRAP, RESET, and POISON a DNS resolver.

ETW INTERNALS FOR SECURITY RESEARCH AND FORENSICS

This post discusses the importance of Event Tracing for Windows (ETW) in endpoint detection and response solutions. It explores the internal workings of ETW and provides techniques to tamper with or bypass ETW-based EDRs, hook system calls, or gain access to ETW providers normally reserved for anti-malware solutions. The post also explains how to identify which processes are consuming ETW events.

PIIANO FLOWS (PRODUCT LAUNCH)

Piiano Flows finds potential data leaks inside source code and ensures that sensitive information, such as Personally Identifiable Information (PII), credentials, and financial information, are protected before faulty code reaches production

AWESOME GPT AGENTS FOR CYBERSECURITY

A community-driven attempt at creating a definitive list of GPT agents for use in both offensive and defensive cybersecurity. The project doesn’t currently include any filtering, categories, or other sorting.

ACTIVE DIRECTORY CANARIES

Active Directory Canaries is a detection primitive for AD enumeration techniques using the Directory Service Object Access: Failure audit event. This repository contains Powershell scripts that deploy the canaries.

FASTLY ANNOUNCES PLAN TO STOP DOMAIN FRONTING

Domain fronting is a technique for bypassing internet censorship by placing a different/forbidden host in an HTTP Host header rather than in the TLS SNI and DNS query. This technique is also commonly used by malware groups to bypass firewalls. Fastly now joins other CDNs like AWS, Cloudflare, and Microsoft in blocking domain fronting.

MAJORITY OF US SITES ARE UNPROTECTED AGAINST SIMPLE BOTS

DataDome SAS tested over 9,500 of the largest US-based websites to see how they performed against nine different bot attacks. 68% of sites were unprotected against simple bot attacks while only 10% blocked all nine different attacks. E-commerce sites proved to be the most susceptible to bot attacks and gambling sites proved to be the least.

HACKERS BREACH US WATER FACILITY VIA EXPOSED UNITRONICS PLCS

Hackers have breached a US water facility by hacking into Unitronics Programmable Logic Controllers (PLCs) exposed online. CISA is warning that this could lead to severe repercussions, such as water supply contamination through manipulating the device to alter chemical dosing, service disruption leading to a halt in water supply, and physical damage to the infrastructure.

SECURE BY DESIGN ALERT: HOW SOFTWARE MANUFACTURERS CAN SHIELD WEB MANAGEMENT INTERFACES FROM MALICIOUS CYBER ACTIVITY

CISA has started a new series of alerts aimed at underlining the harm caused by not implementing security in the software development lifecycle.

POLICE DEPARTMENTS AND NEWS SITES SPREAD MISINFORMATION ABOUT IOS NAMEDROP

Several local news stations and police departments have been sharing warnings that falsely imply that contact information can be shared using Namedrop, a feature introduced by Apple In iOS 17.1 and WatchOS 10.1, without user interaction.

RESEARCHERS FIGURE OUT HOW TO BYPASS THE FINGERPRINT READERS IN MOST WINDOWS PCS

Researchers have found ways to bypass the fingerprint readers in most Windows PCs.

DESIGN FLAW IN GOOGLE WORKSPACE COULD LET ATTACKERS GAIN UNAUTHORIZED ACCESS

Google Workspace's domain-wide delegation feature has a severe design flaw dubbed DeleFriend that enables privilege escalation without admin access. Attackers could gain unauthorized Workspace API access for theft, exfiltration, and other unauthorized actions domain-wide. Successful exploitation of the flaw could allow exfiltration of sensitive data from Google services like Gmail, Drive, Calendar, and others.

CRITICAL VULNERABILITY FOUND IN RAY AI FRAMEWORK

A critical vulnerability in Ray, an open source compute framework for AI, could allow unauthorized access to all nodes. Tracked as CVE-2023-48023, the vulnerability allows remote attackers to submit or delete jobs without authentication. Furthermore, an attacker could retrieve sensitive information and execute arbitrary code.

GOOGLE CHROME EMERGENCY UPDATE FIXES 6TH ZERO-DAY EXPLOITED IN 2023

Google released an advisory that it was aware of the active exploitation of CVE-2023-6345. This CVE addresses an integer overflow vulnerability in the Skia 2D graphics library. A fix is being rolled out to users.

ANALYZING THE LITTERDRIFTER MALWARE

This article takes a deep dive into Gamaredon’s new LitterDrifter malware. LitterDrifter is a worm written in VBS that spreads via USB devices and communicates with a flexible C2 infrastructure. The article also contains indicators of compromise.

POST-EXPLOITING A COMPROMISED ETCD CLUSTER

This post from NCCGroup presents a technique for compromising Kubernetes clusters given a root-compromised etcd host. The post provides an overview of how Kubernetes interacts with etcd and then delves into how to use a compromised etcd host to gain access to a cluster, followed by bypassing AdmissionControllers. The post concludes with some potential mitigation techniques.

ADVERSARIAL ATTACKS ON LLMS

This thorough article by Lilian Weng dives deep into different types of attacks on Large Language Models (LLMs). Weng discusses various attacks and prevention strategies in depth.

Read the full findings on Moonlock Lab (ungated)

SCAPY

Scapy is a Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. Scapy is designed to allow fast packet prototyping by using default values that work.

YOUSHALLNOTPASS

YouShallNotPass executes administrator-specified checks on CI/CD pipelines to prevent unauthorized workflows from executing suspicious commands on sensitive systems. The tool includes support for GitLab runners and experimental support for GitHub.