The Daily Index — Monday, February 17, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HACKERS BROKE INTO WATERGATE HOTEL'S NETWORK

The Watergate Hotel is notifying 2,200 victims of a data breach that occurred in April 2024. The breached data includes names, financial and credit card information, health insurance and medical information, SSNs, government IDs, and driver's license numbers. The Qilin ransomware gang took credit for this attack in May 2024 but Watergate has not confirmed the details.

washingtontimes.com · 2 min

TLDR InfoSec

DID YOU DOWNLOAD THIS STEAM GAME? SORRY, IT'S WINDOWS MALWARE

Valve is notifying users who downloaded the PirateFi free-to-play game that they discovered that it was malware. The game seems to have been a Trojan that steals browser cookies from the infected system. A user reported that the game was being circulated via bots on Telegram channels offering $17/hour to be an in-game chat moderator.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

ANDROID'S NEW FEATURE BLOCKS FRAUDSTERS — BUT IS IT ENOUGH?

Google's new Android fraud protection feature aims to detect and block scam attempts in real-time, identifying suspicious apps and activities before they reach users. While a significant improvement for security, it's not foolproof - users still need to practice basic cybersecurity and remain vigilant against evolving threats.

medium.com · 4 min

TLDR InfoSec

DETECTING HIGH RISK CHROME EXTENSIONS WITH OSQUERY

The Quiq team undertook a project to identify malicious or overprivileged Chrome extensions using osquery. They developed a query that would surface the uid of any Chrome extension with clipboardWrite, all_urls, tabs, or cookies permissions. The team then examined the Chrome extension store page of each application and allowlisted or removed them.

medium.com · 4 min

TLDR InfoSec

SECURE BY DESIGN: GOOGLE'S BLUEPRINT FOR A HIGH-ASSURANCE WEB FRAMEWORK

Google has thousands of web apps that it needs to protect from three fundamental weaknesses of the design of the web: lack of encryption, lack of isolation, and injection. To combat this, Google has developed a high-assurance web framework that is built upon safe coding, adaptability, and observability. This post also includes a case study and table of different key security controls and how they map to elements of the framework.

bughunters.google.com · 7 min

TLDR InfoSec

QUSECURE (PRODUCT LAUNCH)

QuSecure is designed to help organizations migrate to Post Quantum Cryptography without overhauling existing infrastructure. The company touts a software-based security architecture that overlays onto current networks, providing cryptographic agility and multi-layered protection.

qusecure.com

TLDR InfoSec

ELON MUSK'S DOGE WEBSITE HAS BEEN DEFACED BECAUSE ANYONE CAN EDIT IT

Doge.gov documenting Elon Musk's team's federal cost-cutting efforts had glaring security flaws that allowed anyone to edit its database as demonstrated by experts by adding unauthorized entries.

theverge.com · 3 min

TLDR InfoSec

AWS IAM ANNOUNCES SUPPORT FOR ENCRYPTED SAML ASSERTIONS

AWS IAM has launched a new capability that supports sending encrypted SAML assertions from an IDP to AWS. This protects the assertions by allowing them to be encrypted in transit through any intermediaries.

aws.amazon.com · 1 min

TLDR InfoSec

CHINA-LINKED ESPIONAGE TOOLS USED IN RANSOMWARE ATTACKS

A China-linked threat actor, previously known for espionage activities using the PlugX backdoor, conducted a ransomware attack against a South Asian software company in late 2024, demanding up to $2 million in ransom. The attack utilized the same toolset seen in earlier espionage campaigns, including a malicious DLL sideloaded through a legitimate Toshiba executable, which was linked to the Fireant (aka Mustang Panda) espionage group. While several theories were proposed for this unusual combination of espionage and ransomware activity, Symantec notes that the most likely explanation is that an individual actor was attempting to profit personally using their employer's toolkit.

security.com · 4 min

TLDR InfoSec

GOOGLE CHROME'S AI-POWERED SECURITY FEATURE ROLLS OUT TO EVERYONE

After 3 months of testing in Canary releases, Google Chrome now uses AI for "Enhanced protection" to guard against dangerous websites and downloads in real-time.

bleepingcomputer.com · 1 min

TLDR InfoSec

STORM-2372 USED THE DEVICE CODE PHISHING TECHNIQUE SINCE AUGUST 2024

Microsoft Threat Intelligence reported that Storm-2372, an advanced persistent threat (APT) group, has been using a device code phishing technique since August 2024 to bypass multi-factor authentication (MFA) and gain unauthorized access to targeted accounts.

securityaffairs.com · 2 min

TLDR InfoSec

SCAMMERS EXPLOIT JFK FILES RELEASE WITH MALWARE AND PHISHING

Veriti Research reported that cybercriminals are exploiting public interest in the recently declassified files related to John F. Kennedy (JFK), Robert F. Kennedy (RFK), and Martin Luther King Jr. (MLK) by launching phishing campaigns, distributing malware, and setting up fake domains to steal user credentials and compromise systems.

hackread.com · 2 min