The Daily Index — Thursday, February 20, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

HUNDREDS OF DUTCH MEDICAL RECORDS BOUGHT FOR POCKET CHANGE AT FLEA MARKET

A Dutch man bought five HDDs for €5 each at a flea market and discovered 15GB of unencrypted medical records from 2011 to 2019. He then purchased ten more drives containing healthcare data from a defunct IT company called Nortade ICT Solutions, which violated Dutch law requiring the certified erasure of medical data storage devices.

theregister.com · 3 min

TLDR InfoSec

PALO ALTO NETWORKS TAGS NEW FIREWALL BUG AS EXPLOITED IN ATTACKS

Palo Alto Networks is reporting that a new file read vulnerability is being chained with two previously disclosed vulnerabilities to breach PAN-OS firewalls in active attacks. AssetNote released a proof-of-concept exploit the same day as the vulnerabilities were disclosed and GreyNoise has reported seeing active exploitation of the attack chain.

bleepingcomputer.com · 2 min

TLDR InfoSec

BREAKING AMSI: HOW MALWARE AVOIDS WINDOWS SCRIPT SCANNING

AMSI is a Windows component that serves as a middleman to pass consumer content to a security solution such as Crowstrike or Microsoft Defender. The first method that is discussed in the post is to patch the prologue of the security provider's DLL to disrupt AMSI initialization. The second method is to intercept the AMSCI scan process by looping through the list of scan functions provided by the providers in CAmsiAntimalware and patching their scan functions to return immediately.

medium.com · 7 min

TLDR InfoSec

THE ART OF LINUX KERNEL ROOTKITS

This comprehensive guide to Loadable Kernel Module (LKM) rootkits begins by introducing how modern rootkits work and the different hooking techniques used. The guide then explains detection techniques utilizing the filesystem, proofs, logs, and eBPF Tracepoints. Finally, the guide concludes with some advanced techniques for defenders to expose or render rootkits useless as well as some advanced techniques for attackers to establish persistence or defend against LKM rootkits hunters.

inferi.club · 15 min

TLDR InfoSec

SIGNALS OF TROUBLE: MULTIPLE RUSSIA-ALIGNED THREAT ACTORS ACTIVELY TARGETING SIGNAL MESSENGER

Google's Threat Intelligence Group (GTIG) has discovered that Russian-aligned threat actors are targeting Signal Messenger through phishing campaigns exploiting the app's "linked devices" feature. These actors use malicious QR codes and altered group invites to trick victims into linking their Signal accounts to actor-controlled devices. Multiple threat actors, including UNC5792 and UNC4221, are actively involved in these operations, along with efforts to steal Signal database files from Android and Windows devices.

cloud.google.com · 20 min

TLDR InfoSec

CAN AI ACTUALLY FIND REAL SECURITY BUGS? TESTING THE NEW WAVE OF AI MODELS

The author of ai-security-analyzer decided to test the new generation of reasoning LLMs for their ability to detect vulnerabilities in a test project. A comparison of OpenAI o1, o3-mini-high, Gemini 2.0 Flash Thinking and Pro, and Deepseek R1 is presented, with the reasoning models all successfully identifying some issues while Gemini 2.0 Pro mostly identified false positives. The author concluded that the AI models are promising tools but still imperfect and also compared the test against Semgrep and found that they both identified different vulnerabilities

xvnpw.github.io · 4 min

TLDR InfoSec

US ARMY SOLDIER PLEADS GUILTY TO AT&T AND VERIZON HACKS

US Army soldier Cameron Wagenius pled guilty to hacking AT&T and Verizon for phone records and faces up to 20 years imprisonment and $500,000 in fines. His case connects to the major 2024 Snowflake hacks that affected over 160 companies including Santander Bank and Ticketmaster.

techcrunch.com · 2 min

TLDR InfoSec

HOW PHISHED DATA TURNS INTO APPLE & GOOGLE WALLETS

Brian Krebs dives into how Chinese cybercrime groups are turning phished card data into mobile wallets for Apple and Google Pay. These stolen wallets are loaded onto phones controlled by scammers and sold for profit. The phishing kits used by these groups exploit vulnerabilities to convert stolen card details into digital images for easy enrollment into mobile wallets.

krebsonsecurity.com · 9 min

TLDR InfoSec

SANS AI CYBERSECURITY HACKATHON

Global virtual AI Cybersecurity Hackathon from February 15 to March 15 with the goal to secure systems, protect data, and tackle emerging cyber threats.

ai-cybersecurity-hackathon.devpost.com · 1 min

TLDR InfoSec

CRACKED GARRY'S MOD, BEAMNG.DRIVE GAMES INFECT GAMERS WITH MINERS

A malware campaign named "StaryDobry" targeted gamers with infected versions of popular games like Garry's Mod and BeamNG.drive, spreading through torrent sites and impacting users in several countries.

bleepingcomputer.com · 2 min

TLDR InfoSec

HARD DRIVE SCAM: FRAUDSTERS PEDDLE OLD DRIVES AS NEW ONES

Fraudsters in Germany are selling used hard drives as new, deceiving buyers with fake packaging and warranty information, as well as reset SMART values.

links.tldrnewsletter.com · 2 min