The Daily Index — Monday, January 13, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

DRUG ADDICTION TREATMENT SERVICE ADMITS ATTACKERS STOLE SENSITIVE PATIENT DATA

BayMark Health Services has reported a data breach exposing patients' sensitive information, including treatment details and personal data, following a September-October 2024 cyber incident. RansomHub gang claimed responsibility and leaked the data after apparent non-payment of ransom demands.

theregister.com · 4 min

TLDR InfoSec

PHISHING TEXTS TRICK APPLE IMESSAGE USERS INTO DISABLING PROTECTION

Cybercriminals are tricking Apple iMessage users into disabling phishing protection by getting them to reply to texts. These smishing attacks prompt users to respond with "Y" to enable malicious links. Users are urged to avoid replying to suspicious texts and to verify messages directly with the company or organization.

bleepingcomputer.com · 2 min

TLDR InfoSec

SAMSUNG S24: OUT OF BOUNDS WRITE IN APE DECODER

A zero-click vulnerability (CVE-2024-49415) in Samsung's Monkey's Audio decoder allows for code execution through malicious audio messages on RCS-enabled phones. The vulnerability has been patched by Samsung.

project-zero.issues.chromium.org · 5 min

TLDR InfoSec

USING CAPABILITIES INSTEAD OF TRUSTING 3RD PARTY CODE

CHERI capabilities can restrict third-party code's memory access by creating read-only references with explicit bounds. Rather than trust docs, the author uses hardware enforcement to prevent the MQTT library from keeping or modifying memory references. This removes trust requirements for external code by using CPU-level controls instead of relying on documentation or audits.

cheriot.org · 3 min

TLDR InfoSec

A JUST CULTURE GUIDE FOR INFORMATION GOVERNANCE AND CYBER SECURITY

This guidance supports organizations in creating a fair and learning-focused approach to handling data incidents in healthcare. It encourages transparency and collaboration to improve information governance and cyber security practices. NHS England provides support functions to help organizations manage incidents effectively and learn from them.

transform.england.nhs.uk · 11 min

TLDR InfoSec

PYPI: PROJECT QUARANTINE

PyPI introduced a quarantine feature to mark harmful projects and prevent their easy installation. The feature helps PyPI admins manage potential malware and protect end users. Future improvements may include automating the quarantine process based on credible reports.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

INTRODUCING CAPICHE DETECTION FRAMEWORK: AN OPEN-SOURCE TOOL TO SIMPLIFY CLOUD API-BASED HUNTING

The Capiche Detection Framework is an open-source tool to simplify detecting cloud API attacks. It helps defenders quickly create detection rules from different sets of APIs. The tool works by translating APIs into their SDK counterparts and generating various detection rule formats.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

GOOGLE LOSES IN COURT, FACES TRIAL FOR COLLECTING DATA ON USERS WHO OPTED OUT

A federal judge denied Google's motion to dismiss a class-action lawsuit over privacy invasion. The case alleges Google collected user data through Firebase Analytics even when people opted out of Web & App Activity tracking. Google claims the data is pseudonymous and for developers only. A trial has been set for August.

arstechnica.com · 4 min

TLDR InfoSec

FACEBOOK AWARDS RESEARCHER $100,000 FOR FINDING BUG THAT GRANTED INTERNAL ACCESS

Security researcher Ben Sadeghipour discovered a server vulnerability in Facebook's ad platform that allowed remote code execution. Meta fixed the issue within an hour of his report and awarded him a $100,000 bug bounty. The flaw stemmed from an unpatched Chrome browser vulnerability.

techcrunch.com · 3 min

TLDR InfoSec

PROTON WORLDWIDE OUTAGE CAUSED BY KUBERNETES MIGRATION, SOFTWARE CHANGE

Proton, a Swiss tech company, experienced a global outage due to a migration to Kubernetes and a software change that caused an initial load spike. Users had trouble accessing services like ProtonMail and Proton Calendar, but the issues were resolved within about two hours. Proton has fixed the connection problems and is monitoring for any further issues.

bleepingcomputer.com · 2 min

TLDR InfoSec

SECOND AUDIT OF OBSIDIAN APPS COMPLETED BY CURE53

According to Cure53's second audit of Obsidian, no new vulnerabilities were found in public versions, with improvements made since the previous audit.

obsidian.md · 2 min

TLDR InfoSec

OPERATORS OF CRYPTOCURRENCY MIXERS CHARGED WITH MONEY LAUNDERING

Three Russian nationals have been charged by the US Justice Department with operating cryptocurrency mixers for money laundering.

justice.gov · 4 min

TLDR InfoSec

FAKE POC EXPLOIT TARGETS CYBERSECURITY RESEARCHERS WITH MALWARE

A fake PoC exploit named "LDAPNightmare" targets cybersecurity researchers by pretending to be a patch for a Windows LDAP vulnerability.

hackread.com · 3 min