The Daily Index — Friday, March 28, 2025

GENERAL

TLDR InfoSec

→ Learn more about Libraries on the Chainguard blog

Summary unavailable

chainguard.dev

TLDR InfoSec

NHS VENDOR ADVANCED TO PAY £3M FINE FOLLOWING 2022 RANSOMWARE ATTACK

NHS vendor Advanced will pay £3 million in fines for failing to implement basic security measures before a 2022 ransomware attack. The ICO found the company breached data protection law by not using multi-factor authentication, leading to stolen personal information and NHS system disruptions.

techcrunch.com · 2 min

TLDR InfoSec

150,000 SITES COMPROMISED BY JAVASCRIPT INJECTION PROMOTING CHINESE GAMBLING PLATFORMS

A massive cyber campaign compromised around 150,000 websites using malicious JavaScript to redirect visitors to Chinese-language gambling platforms. The attack involved injecting scripts that hijack browser windows to display gambling sites.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

LUCID DEEP DIVE

Lucid is a sophisticated Phishing-as-a-Service platform operated by Chinese threat actors. This blog dives into what it is, its targets, and the technology behind it. Lucid uses advanced SMS and iMessage technologies to enable large-scale phishing campaigns to steal credit card details. It has targeted more than 160+ organizations.

catalyst.prodaft.com · 25 min

TLDR InfoSec

BLASTING PAST WEBP

The NSO Group's BLASTPASS exploit targets iPhones via iMessage through a WebP vulnerability. The attack involves sending a PKPass file with a WebP image that caused a buffer overflow, overwriting a pointer, and executing malicious code via heap manipulation that bypasses iOS protections like ASLR and PAC. Unlike earlier exploits that need complex "weird machines," BLASTPASS uses conventional techniques such as callback-oriented programming and a multi-stage approach, with follow-up iMessages delivering final payload encryption keys.

googleprojectzero.blogspot.com · 38 min

TLDR InfoSec

FUN WITH TIMING ATTACKS

Timing attacks can exploit non-constant-time string comparison functions like `startsWith` to determine secrets character by character. Attackers can deduce when a guess's prefix matches part of the secret by measuring execution times over many trials, allowing them to crack an 8-character password in just thousands of attempts rather than billions. This can be demonstrated with a browser-based implementation using Thompson Sampling and a statistical approach. Developers should avoid direct secret comparisons and instead use proper cryptographic hashing with rate limiting.

ostro.ws · 10 min

TLDR InfoSec

STRAIKER (PRODUCT LAUNCH)

Straiker aims to address the risks associated with the increasing use of AI chatbots and AI agents through continuous testing or one-time risk assessments that involve in-depth attack simulations against AI applications and agents. It can also automatically block identified threats

straiker.ai

TLDR InfoSec

MICROSOFT WOULDN'T LOOK AT A BUG REPORT WITHOUT A VIDEO

Security researcher Will Dorman attempted to report a vulnerability to the Microsoft Security Response Center by providing a report with a clear description of the bug and supporting screenshots. However, Microsoft responded that it could not review the report until a video was submitted. This was unnecessary and time-wasting, as it would provide no additional details and would just show the commands that have already been screenshotted.

theregister.com · 2 min

TLDR InfoSec

UK'S FIRST PERMANENT FACIAL RECOGNITION CAMERAS TO BE INSTALLED IN SOUTH LONDON DESPITE BACKLASH

The Metropolitan Police will install permanent live facial recognition cameras in Croydon, London, to catch criminals by matching faces against a wanted list. Privacy campaigners strongly oppose the move, calling it a potential "dystopian nightmare" with no proper oversight.

standard.co.uk · 3 min

TLDR InfoSec

COFFEELOADER PRETENDS TO BE ASUS SOFTWARE TO STEAL YOUR DATA

Zscaler researchers have discovered a new malware family, CoffeeLoader, active since September 2024. It masquerades as the ASUS Armoury Crate utility and delivers an infostealer like Rhadamanthys using sophisticated evasion techniques such as GPU code execution, stack spoofing, and sleep obfuscation.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

FAKE SNOW WHITE MOVIE TORRENT INFECTS DEVICES WITH MALWARE

Scammers are spreading malware by offering fake Snow White movie downloads to torrent users.

hackread.com · 3 min

TLDR InfoSec

NEW SECURITY REQUIREMENTS ADOPTED BY HTTPS CERTIFICATE INDUSTRY

Google's Chrome Root Program has introduced new security initiatives, including Multi-Perspective Issuance Corroboration and Linting, to enhance the reliability and agility of TLS connections used by Chrome users.

security.googleblog.com · 4 min

TLDR InfoSec

T-MOBILE COUGHED UP $33 MILLION IN SIM SWAP LAWSUIT

T-Mobile must pay $33 million for a SIM swap attack that let hackers steal cryptocurrency and access accounts.

securityweek.com · 3 min