The Daily Index — Tuesday, March 11, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

560,000 PEOPLE IMPACTED ACROSS FOUR HEALTHCARE DATA BREACHES

Four healthcare organizations reported data breaches last week that impacted over 560,000 individuals. Sunflower Medical Group had the largest breach, affecting 220,000, with the Rhysida ransomware group claiming responsibility. Other breaches involved Hillcrest Convalescent Center, Gastroenterology Associates, and Community Care Alliance.

securityweek.com · 3 min

TLDR InfoSec

US CITIES WARN OF UNPAID PARKING PHISHING TEXTS

Several US cities have warned of a phishing campaign that uses texts which claim users have an unpaid parking balance, risking a daily $35 fine. The messages exploit a redirect on google.com to hide the phishing site and evade iMessage protections. This article includes a breakdown of a text purportedly from New York City.

bleepingcomputer.com · 2 min

TLDR InfoSec

THE RISK YOU CAN'T AFFORD TO IGNORE: AWS SES AND EMAIL SPOOFING

AWS SES allows sending emails using an individually verified email or any email in a verified domain. If an attacker has the requisite IAM privileges, they can spoof any email address in a verified domain for phishing attacks and there is no ability to log emails sent. Use verified emails or the "ses:FromAddress" condition in SES IAM policies to prevent this attack.

badshah.io · 6 min

TLDR InfoSec

KUBERNETES AUDIT LOG “GOTCHAS”

Kubernetes provides robust audit logs essential for investigations. This post outlines common issues with cloud providers, including inconsistent logging policies, vendor modifications to Kubernetes logs, and cloud providers controlling audit policies. Use dynamic admission controllers and cloud-specific logs like CloudTrail, or VPC Flow Logs to address these issues.

wiz.io · 6 min

TLDR InfoSec

ABUSING VS CODE'S BOOTSTRAPPING FUNCTIONALITY TO QUIETLY LOAD MALICIOUS EXTENSIONS

VS Code extensions allow attackers to stealthily install malware, despite Microsoft's protective prompts. This post illustrates how the initial installation process can evade these defenses and affect existing installations, along with detection methods for this attack.

casvancooten.com · 6 min

TLDR InfoSec

STRAP IN, GET READY FOR MORE RUST DRIVERS IN LINUX KERNEL

Despite recent conflicts among maintainers, Rust is still advancing within the Linux kernel. The Prossimo project showcases increasing acceptance of Rust across various subsystems, primarily due to its memory safety advantages, with mainline integration anticipated in the next 18 months.

theregister.com · 3 min

TLDR InfoSec

GOOGLE PAYS OUT NEARLY $12M IN 2024 BUG BOUNTY PROGRAM

Google paid $11.8 million to 660 researchers for bug bounties in 2024. Some highlights include Android/Google mobile vulnerabilities earning $3.3 million and new AI bug bounties receiving 150 reports worth $55,000.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

FORENSIC IMPLICATIONS OF APPLE'S “STOLEN DEVICE PROTECTION”

The "Stolen Device Protection" feature was introduced in iOS 17.3 to prevent unauthorized access to sensitive iPhone data. This feature complicates data extraction for forensic experts by requiring biometric authentication to pair with a computer, limiting traditional extraction methods. Manual inspection may be the only viable forensic method for devices protected by this feature, but it has limitations and is not forensically sound.

blog.elcomsoft.com · 4 min

TLDR InfoSec

RESEARCHERS EXPOSE NEW POLYMORPHIC ATTACK THAT CLONES BROWSER EXTENSIONS TO STEAL CREDENTIALS

Researchers have found a new attack where malicious browser extensions can clone legitimate ones that look identical to the real ones, making it hard for users to spot the scam.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

SIDEWINDER TARGETS THE MARITIME AND NUCLEAR SECTORS WITH AN UPDATED TOOLSET

SideWinder, a prolific APT group, has updated its tools to target maritime and nuclear sectors.

securelist.com · 7 min

TLDR InfoSec

FEDS SEIZED $23 MILLION IN CRYPTO STOLEN USING KEYS FROM LASTPASS BREACHES

U.S. authorities seized $23 million in stolen cryptocurrency from a $150 million Ripple wallet theft and the 2022 LastPass breach.

securityaffairs.com · 3 min