TLDR INFORMATION SECURITY 2025-01-13

MEDUSIND BREACH EXPOSES SENSITIVE PATIENT DATA

Medusind has reported a data breach affecting over 360,000 customers, exposing medical, financial, and personal data following a December 2023 cyber incident. The company is offering affected individuals two years of credit monitoring and has implemented enhanced security measures.

DRUG ADDICTION TREATMENT SERVICE ADMITS ATTACKERS STOLE SENSITIVE PATIENT DATA

BayMark Health Services has reported a data breach exposing patients' sensitive information, including treatment details and personal data, following a September-October 2024 cyber incident. RansomHub gang claimed responsibility and leaked the data after apparent non-payment of ransom demands.

PHISHING TEXTS TRICK APPLE IMESSAGE USERS INTO DISABLING PROTECTION

Cybercriminals are tricking Apple iMessage users into disabling phishing protection by getting them to reply to texts. These smishing attacks prompt users to respond with "Y" to enable malicious links. Users are urged to avoid replying to suspicious texts and to verify messages directly with the company or organization.

SAMSUNG S24: OUT OF BOUNDS WRITE IN APE DECODER

A zero-click vulnerability (CVE-2024-49415) in Samsung's Monkey's Audio decoder allows for code execution through malicious audio messages on RCS-enabled phones. The vulnerability has been patched by Samsung.

USING CAPABILITIES INSTEAD OF TRUSTING 3RD PARTY CODE

CHERI capabilities can restrict third-party code's memory access by creating read-only references with explicit bounds. Rather than trust docs, the author uses hardware enforcement to prevent the MQTT library from keeping or modifying memory references. This removes trust requirements for external code by using CPU-level controls instead of relying on documentation or audits.

A JUST CULTURE GUIDE FOR INFORMATION GOVERNANCE AND CYBER SECURITY

This guidance supports organizations in creating a fair and learning-focused approach to handling data incidents in healthcare. It encourages transparency and collaboration to improve information governance and cyber security practices. NHS England provides support functions to help organizations manage incidents effectively and learn from them.

associated with AI use. Get the guide

ARAA-SEARCH

A privacy-respecting, ad-free, self-hosted Google metasearch engine with strong security that offers full API support and utilizes Qwant for images and DuckDuckGo for auto-complete.

PYPI: PROJECT QUARANTINE

PyPI introduced a quarantine feature to mark harmful projects and prevent their easy installation. The feature helps PyPI admins manage potential malware and protect end users. Future improvements may include automating the quarantine process based on credible reports.

INTRODUCING CAPICHE DETECTION FRAMEWORK: AN OPEN-SOURCE TOOL TO SIMPLIFY CLOUD API-BASED HUNTING

The Capiche Detection Framework is an open-source tool to simplify detecting cloud API attacks. It helps defenders quickly create detection rules from different sets of APIs. The tool works by translating APIs into their SDK counterparts and generating various detection rule formats.

GOOGLE LOSES IN COURT, FACES TRIAL FOR COLLECTING DATA ON USERS WHO OPTED OUT

A federal judge denied Google's motion to dismiss a class-action lawsuit over privacy invasion. The case alleges Google collected user data through Firebase Analytics even when people opted out of Web & App Activity tracking. Google claims the data is pseudonymous and for developers only. A trial has been set for August.

FACEBOOK AWARDS RESEARCHER $100,000 FOR FINDING BUG THAT GRANTED INTERNAL ACCESS

Security researcher Ben Sadeghipour discovered a server vulnerability in Facebook's ad platform that allowed remote code execution. Meta fixed the issue within an hour of his report and awarded him a $100,000 bug bounty. The flaw stemmed from an unpatched Chrome browser vulnerability.

PROTON WORLDWIDE OUTAGE CAUSED BY KUBERNETES MIGRATION, SOFTWARE CHANGE

Proton, a Swiss tech company, experienced a global outage due to a migration to Kubernetes and a software change that caused an initial load spike. Users had trouble accessing services like ProtonMail and Proton Calendar, but the issues were resolved within about two hours. Proton has fixed the connection problems and is monitoring for any further issues.

SECOND AUDIT OF OBSIDIAN APPS COMPLETED BY CURE53

According to Cure53's second audit of Obsidian, no new vulnerabilities were found in public versions, with improvements made since the previous audit.

OPERATORS OF CRYPTOCURRENCY MIXERS CHARGED WITH MONEY LAUNDERING

Three Russian nationals have been charged by the US Justice Department with operating cryptocurrency mixers for money laundering.

FAKE POC EXPLOIT TARGETS CYBERSECURITY RESEARCHERS WITH MALWARE

A fake PoC exploit named "LDAPNightmare" targets cybersecurity researchers by pretending to be a patch for a Windows LDAP vulnerability.