The Daily Index — Monday, February 3, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

TIME BANDIT CHATGPT JAILBREAK BYPASSES SAFEGUARDS ON SENSITIVE TOPICS

A security researcher discovered a new jailbreak for ChatGPT that involves abusing a mechanism to confuse ChatGPT into believing that it's in the past (temporal confusion) and then asking ambiguous questions. This vulnerability allowed the researcher to ask ChatGPT for information such as how a programmer in the 1700s could create polymorphic malware with modern techniques. The researcher attempted to disclose this vulnerability to OpenAI with the aid of various government agencies, but the vulnerability has not been fixed.

bleepingcomputer.com · 2 min

TLDR InfoSec

ISSUE WITH AWS SIGN-IN IAM USER LOGIN FLOW

AWS has remediated an issue with IAM use sign-in flow that could allow for a malicious user to enumerate logins. The vulnerability was due to a timing attack in which the server response times for a valid or invalid user varied. AWS remediated the issue by introducing a timing delay across all authentication failure scenarios.

aws.amazon.com · 2 min

TLDR InfoSec

A BRIEF HISTORY OF MASS HACKS

Major cybersecurity tools meant to protect networks have repeatedly become vectors for mass hacking campaigns. From 2023-2025, vulnerabilities in products by Cisco, Citrix, Ivanti, Palo Alto, and more have led to widespread breaches affecting thousands of organizations and millions of individuals. This post dives into the brief history of these attacks.

techcrunch.com · 7 min

TLDR InfoSec

TESTING AND EVALUATING GUARDDUTY DETECTIONS

The AWS GuardDuty team has released a tool called GuardDuty Tester to generate infrastructure and synthetic events to test GuardDuty alerts and actions. This post walks through deploying GuardDuty Tester and creating alerts and automations based on GuardDuty findings. AWS has cautioned users to not run GuardDuty Tester in production environments and ideally to use a dedicated account.

aws.amazon.com · 8 min

TLDR InfoSec

CLUTCH SECURITY (PRODUCT LAUNCH)

Clutch's Universal Non Human Identity Security Platform can provide organizations with a unified view across all these identities, regardless of the environment they reside in, tracking their access, origin, ownership, storage, and usage.

clutch.security

TLDR InfoSec

TEXAS GOVERNOR ORDERS BAN ON DEEPSEEK, REDNOTE FOR GOVERNMENT DEVICES

Texas has banned DeepSeek and social media apps Xiaohongshu and Lemon8 from government devices, citing security concerns about data harvesting. The move follows similar bans on TikTok. DeepSeek has gained popularity among U.S. users and emerged as an OpenAI competitor.

abcnews.go.com · 2 min

TLDR InfoSec

AS OF FEBRUARY 2025: HARMFUL AI APPLICATIONS PROHIBITED IN THE EU

The EU AI Act prohibits AI systems that pose unacceptable risks, including manipulative systems, social scoring, unauthorized facial recognition databases, and certain emotion recognition technologies. Violations face fines up to €35M or 7% of annual turnover.

algorithmwatch.org · 4 min

TLDR InfoSec

AI AGENT IDENTITY: IT'S JUST OAUTH

OAuth provides the perfect model for authenticating AI Agents as it is designed for auditable and secure delegation of access. OAuth adoption is scant and even where it exists, scopes are often very minimal and incomplete. This solution doesn't scale to tools where the AI is acting as the user's identity such as ChatGPT Desktop or Claude computer use.

mayakaczorowski.com · 9 min

TLDR InfoSec

KUCOIN TO PAY NEARLY $300 MILLION IN PENALTIES AFTER GUILTY PLEA

KuCoin's operator pleaded guilty to running an unlicensed money-transmitting business and will pay $297 million in penalties in the U.S. for failing to implement required anti-money laundering measures.

bleepingcomputer.com · 2 min

TLDR InfoSec

U.S. AND DUTCH AUTHORITIES DISMANTLE 39 DOMAINS LINKED TO BEC FRAUD NETWORK

U.S. and Dutch authorities worked together to shut down 39 websites connected to a fraud network last month.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

WHATSAPP SAYS IT DISRUPTED SPYWARE CAMPAIGN AIMED AT REPORTERS, CIVIL SOCIETY

WhatsApp disrupted a spyware campaign targeting journalists and activists.

cyberscoop.com · 2 min