The Daily Index — Friday, April 5, 2024

ATTACKS & VULNERABILITIES

TLDR InfoSec

CANCER TREATMENT CENTER CITY OF HOPE BREACHED, 827K PEOPLE EXPOSED

The City of Hope, a cancer treatment and research organization, has reported a massive data breach affecting 827,149 individuals, with their sensitive personal information including names, Social Security numbers, and medical records being leaked.

cybernews.com · 2 min

TLDR InfoSec

GOOGLE FIXES TWO PIXEL ZERO-DAY FLAWS

Google has released an update for Pixel phones that fixes vulnerabilities discovered being actively exploited by forensics firms. The first vulnerability is in the fast boot firmware and allows memory to be dumped from locked phones. Google’s fix involves zeroing the memory when booting fast boot mode. The second vulnerability allows local attackers to circumvent factory resets initiated by apps.

bleepingcomputer.com · 4 min

TLDR InfoSec

HOW TO TAME SQL INJECTION

Despite being consistently ranked as the most critically dangerous software flaw for over a decade by OWASP, injection vulnerabilities continue to persist as a significant security threat. This post navigates how to prevent an SQL injection and prepare for a possible attack.

darkreading.com · 5 min

TLDR InfoSec

LLM SECURITY ARCHITECTURE

This post breaks down the use cases associated with LLM Security. Chatbot concerns are essentially just DLP concerns. Input and output filtering is relevant with custom apps if you’re relying on non-public data or an LLM cache.

pulse.latio.tech · 5 min

TLDR InfoSec

ULTIMATE GUIDE TO SECRETS IN LAMBDA

An in-depth guide covering the different options for storing secrets in Lambda. The guide compares the performance, cost, and auditability of Environment Variables, Parameter Store, Secrets Manager, and KMS. It concludes with some example situations and strategies.

aaronstuyvenberg.com · 12 min

TLDR InfoSec

STEALTHMOLE (PRODUCT LAUNCH)

StealthMole is a deep and dark web threat intelligence company that delivers a cloud-based, unified platform for digital investigation, risk assessment, and threat monitoring. Using AI, it provides tools and threat intelligence for identifying and eliminating digital risk and criminal activity.

stealthmole.com

TLDR InfoSec

CARGO VET

Cargo added a new subcommand called vet which matches all dependencies against a set of audits performed by the project authors or trusted entities.

mozilla.github.io · 3 min

TLDR InfoSec

RANSOMWARE GANG DID STEAL RESIDENTS' CONFIDENTIAL DATA, UK CITY COUNCIL ADMITS

Leicester City Council has acknowledged that the recent "cyber incident" it experienced on March 7 was a ransomware attack and data was stolen. The cybercriminal gang INC Ransom leaked 3TB of stolen data, including residents' personal information like passports, bank statements, and official council forms.

theregister.com · 4 min

TLDR InfoSec

BRUCE SCHNIER REMEMBERS ROSS ANDERSON

Ross Anderson was a respected cryptographer and security engineer. He passed away this week. Anderson was known for his brilliant insights and contributions to cybersecurity and academic freedom. His work, including the book Security Engineering, has been influential in the field.

schneier.com · 3 min

TLDR InfoSec

POLAND LAUNCHES INQUIRY INTO PREVIOUS GOVERNMENT’S SPYWARE USE

Poland is investigating its previous government's use of spyware called Pegasus.

theguardian.com · 4 min

TLDR InfoSec

US STATE DEPARTMENT INVESTIGATES ALLEGED THEFT OF GOVERNMENT DATA

The US State Department is investigating a cyber incident involving leaked government data that includes personal details of government, military, and Pentagon employees.

bleepingcomputer.com · 2 min

TLDR InfoSec

HIGHLY SENSITIVE FILES MYSTERIOUSLY DISAPPEARED FROM EUROPOL HEADQUARTERS

On September 2023, Europol was notified that highly sensitive files of top Europol officials were missing due to a serious security breach at its headquarters in The Hague.

securityaffairs.com · 2 min