TLDR INFORMATION SECURITY 2025-01-17

learn best practices in the 2025 Ransomware Survival Guide

* Learn how ransomware operators work in 2025. * Use risk frameworks and threat intelligence to prioritize patches. * Build a playbook for containment, negotiation, and recovery.

Get the report →

NEW UEFI SECURE BOOT FLAW EXPOSES SYSTEMS TO BOOTKITS

A new UEFI Secure Boot vulnerability in a Microsoft-signed application could allow for deploying bootkits. The vulnerable application does not use trusted services to load the binaries but instead manually decrypts and loads binaries into memory which could be exploited by an attacker that replaces the expected binary with a malicious one. ESET provides Powershell commands to check for vulnerable systems.

TOP CANNABIS BRAND STIIIZY SAYS HACKERS GOT ACCESS TO ITS SYSTEMS

Cannabis retailer Stiiizy confirmed a late 2024 cyberattack affecting four California locations where hackers accessed sensitive customer data including names, IDs, and transaction histories. The ransomware group Everest claimed responsibility, stating they leaked data of 420,000 customers after ransom demands weren't met.

DATA FROM 15,000 FORTINET FIREWALLS LEAKED BY HACKERS

Hackers calling themselves "Belsen Group" leaked data from 15,000 Fortinet firewalls, including configurations, passwords, and IPs. Analysis suggests the data was collected in October 2022 through CVE-2022-40684 exploitation. Though two years old, the leaked configurations could still pose risks as many devices remain online and accessible.

STORY OF A PENTESTER RECRUITMENT 2025

A story of recruiting pentesters with a dedicated sample app, "Mushroom," a web-based recruitment challenge for penetration testers used from 2015-2024. The simple application helped hire 14 pentesters across different seniority levels. Candidates had 72 hours to find vulnerabilities and submit a professional report.

BUILDING RESILIENCE WITH AI THREAT MODELING: LESSONS FROM THE RATE COMPANIES

A dive into how Rate Companies is fighting sophisticated AI-driven identity attacks using AI-powered threat modeling. The company implemented a zero-trust framework that focused on identity verification, real-time monitoring, and rapid response protocols. Key strategies include credential monitoring, reducing alert noise, scalable cloud security, and tool consolidation.

JINGLE SHELLS: HOW VIRTUAL OFFICES ENABLE A FACADE OF LEGITIMACY

Virtual costs can enable cybercriminals to establish a reputable presence while obfuscating their actual operations. This post demonstrates the complex web involved in disentangling a single IP address. The post then discusses some ASNs in the UK with low reputations that are frequently used by cyber criminals due to lax Know Your Customer policies.

WULTRA (PRODUCT LAUNCH)

Wultra protects against quantum-level attacks, which are expected to crack traditional cryptography and break existing security methods.

MODELSCAN

ModelScan is an open source tool by Protect AI that scans machine learning models for unsafe code. It supports various model formats like H5, Pickle, and SavedModel. By scanning models, you can protect against Model Serialization Attacks that could compromise your data and credentials.

DYANA

Dyana is a sandbox environment that can load and profile various types of files like machine learning models, ELFs, Pickle, and JavaScript. It provides detailed insights into GPU memory usage, filesystem interactions, network requests, and security events. Users can easily install Dyana using Python 3.10+ with PIP and leverage its default safeguards and loaders for different file types.

FTC SUES GODADDY FOR YEARS OF POOR HOSTING SECURITY PRACTICES

The FTC will require GoDaddy to implement basic security protection such as MFA and HTTPS APIs. The complaint takes aim at GoDaddy's security practices, including failures to use MFA, manage software updates, log security events, segment its network, monitor for threats, and implement file integrity monitoring. The FTC notes that these practices have led to several breaches between 2019 and 2022.

CLOP RANSOMWARE GANG NAMES DOZENS OF VICTIMS HIT BY CLEO MASS-HACK, BUT SEVERAL FIRMS DISPUTE BREACHES

The Clop ransomware gang claims to have breached 59 organizations by exploiting a vulnerability in Cleo's file transfer products discovered in October 2024. While some companies like Covestro confirmed breaches, others like Hertz deny being affected. Clop has threatened to publish stolen data on January 18 unless ransoms are paid.

NAVIGATING PCI DSS 4.0: THE CHALLENGE OF NON-HUMAN IDENTITIES

The implementation deadline for PCI DSS 4.0 is rapidly approaching in March 2025 and many organizations are struggling with the enhanced requirements on non-human identities. This post details the new requirements around credential storage and rotation, least privilege, and monitoring. The post recommends making an inventory of non-human identities, setting timelines and phases for implementation, and utilizing automation where possible.

AI USE CASES WITHIN THE SECURITY DIVISION AT GITLAB

A table of how security teams at GitLab are using AI for tools and process efficiencies.

MILLIONS OF TUNNELING HOSTS ARE VULNERABLE TO SPOOFING, DDOS ATTACKS, SAY RESEARCHERS

Belgian researchers found over 4 million vulnerable internet hosts that can be exploited for spoofing and DDoS attacks.

MICROSOFT CATCHES RUSSIAN STATE-SPONSORED HACKERS SHIFTING TACTICS TO WHATSAPP

Microsoft's Threat Intelligence Team reports that State-sponsored Russian hackers are now targeting WhatsApp accounts, shifting away from their usual email tactics.