Yik Yak fixed that, Abusing the abused, Fake PoCs, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight.
Episode 231 - 24 May 2022
Yik Yak fixed that - https://portswigger.net/daily-swig/yik-yak-fixes-information-disclosure-bug-that-leaked-users-gps-location
Abusing the abused -
https://www.bleepingcomputer.com/news/security/photos-of-abused-victims-used-in-new-id-verification-scam/
Argo CD max severity - https://portswigger.net/daily-swig/critical-argo-cd-vulnerability-could-allow-attackers-admin-privileges
Fake PoCs -
https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/
Hi, I’m Paul Torgersen. It’s Tuesday May 24th, 2022, and from Las Vegas, this is a look at the information security news from overnight.
From PortSwigger.net:
Anonymous social network Yik Yak took more than three months, but finally fixed vulnerabilities that were submitted by two different security researchers. The flaw enabled threat actors to access users’ precise locations, within like 10ft or 15ft. Not so hot for an anonymous site.
From BleepingComputer.com:
In a new low, scammers are leveraging dating apps like Tinder and Grindr to pose as former abuse victims to gain your trust and sell you bogus ID verification services. These catphishers show their target pictures of physical abuse and get them to register on a scam site to prove they are not a former sex offender. All the sketchy details in the article.
From PortSwigger.net:
The maintainers of Argo CD, the continuous delivery tool for Kubernetes, have patched a critical vulnerability that enabled attackers to forge JSON Web Tokens and become administrators. The bad news is, this bug has a severity rating of 10 out of 10. The good news is, anonymous access is deactivated by default, so if you haven’t played with any settings, you were probably ok. But, you know, patch it.
From BleepingComputer.com:
A threat actor is targeting security researchers with fake Windows proof-of-concepts for recently patched vulnerabilities CVE-2022-24500 and -26809. When you go in to check out the PoCs, it loads the Cobalt Strike backdoor instead. Details in the article.
And last this today, from Infosecurity-magazine.com
Here’s one to cheer about. Our friends Anonymous have announced on social media that they’re launching a cyber-war against the pro-Russian group Killnet. Couldn’t happen to a more deserving group. You know who my money’s on.
That’s all for me today. Have a great rest of your day. Remember to LIKE, SUBSCRIBE, and share with your network. And as always, until next time, be safe out there.