Attacks & Vulnerabilities
|
Researchers Reveal Catastrophic Security Flaw in the Arc Browser (3 minute read)
A security researcher has discovered a vulnerability in the Arc browser that could lead to RCE on other users. The Arc browser has a feature called Boosts that allows arbitrary CSS and JavaScript to run and modify websites in users' browsers. The vulnerability arises from improper ACLs on The Browser Company's Firebase data store, which allows attackers to apply Boosts to different users' browsers by changing the user ID that they are attached to. An update has been pushed and The Browser Company has committed to improving its security posture.
|
How the Necro Trojan infiltrated Google Play, again (15 minute read)
A new version of the Necro Trojan has infected popular apps on Google Play and unofficial sources, impacting over 100 million devices worldwide. The malware used obfuscation to evade detection and had the ability to display ads, download files, and execute JavaScript code. Google Play removed the malicious loader from affected apps following reports of the issue.
|
|
Detecting ScriptBlock Smuggling (5 minute read)
PowerShell Script Block Logging is one of the types of PowerShell logs that records the content of all script blocks executed within PowerShell. ScriptBlock Smuggling is a technique whereby an attacker can hide a malicious script block within a benign script block. This post tests detections for this attack in a lab environment using a test script from AtomicRedTeam. The author notes that the full script, which contains the malicious command, can still be seen in the details pane and questions the usefulness of this attack.
|
6 Techniques I Use to Create a Great User Experience for Shell Scripts (6 minute read)
This author wrote a script that was praised for its UX to automate the evaluation steps in a competition. They argue for comprehensive error handling and input validation with detailed and actionable error messages, clear and colorful output, detailed progress reporting without overwhelming the user by using set -x, using set -x and set +x for fine grained and strategic error handling, making use of platform specific functionality, and using time stamped file outputs to make multiple runs easier to compare. Examples of each of these principles are included in the post.
|
Open to Exploitation: The Security Risks of Unauthenticated Pager Networks (5 minute read)
Many critical sectors still use vulnerable pager networks like POCSAG, which are easily exploited for message injection attacks via radio frequencies, for emergency communication. These networks lack encryption, allowing anyone with basic equipment to intercept and manipulate messages, posing serious security risks in sensitive environments. This blog post highlights the urgent need for stronger security measures in these outdated communication systems by demonstrating how easy it is to spoof messages.
|
|
Cloud Testing VM (GitHub Repo)
Cloud Testing VM is a VM that contains a set of common cloud security testing tools. There are scripts to build it as an AWS AMI.
|
A safer Internet with Cloudflare: free threat intelligence, analytics, and new threat detections (10 minute read)
Cloudflare has launched new free security features for website owners and network protection, including threat intelligence, analytics, and account takeover attack detection. Users can now access Security Analytics, API schema validation, and Page Shield script monitor to enhance their security. Cloudflare has also introduced new authentication options, such as signing up and logging in with Google, to simplify account access and reduce the risk of compromise.
|
|
TCM Security Academy Announces Free Tier (3 minute read)
TCM Security has announced that it will be launching a free tier to its academy. The initial offering will contain four courses: Practical Help Desk, Programming 100: Fundamentals, Linux 100: Fundamentals, and Soft Skills for the Job Market. The free tier launches today and users can access the content by signing up with only an email address.
|
|
AI Adoption Set to Unravel Years of Cyber Resilience (2 minute read)
A study by e2e-assure revealed a stark contrast between cyber risk owners' confidence in AI policies (85%) and employee awareness of such guidance (34%), indicating potential vulnerabilities in organizational cyber resilience despite increased adoption of AI technologies.
|
|
|
Love TLDR? Tell your friends and get rewards!
|
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
|
Track your referrals here.
|
|
Want to advertise in TLDR? 📰
|
If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us.
If you have any comments or feedback, just respond to this email!
Thanks for reading,
Prasanna Gautam, Eric Fernandez & Sammy Tbeile
|
|
|
|