TLDR INFORMATION SECURITY 2025-01-27

surface? Book your demo with Obsidian

UK TELCO TALKTALK CONFIRMS PROBE INTO ALLEGED DATA GRAB UNDERWAY

TalkTalk is investigating claims of a potential data breach affecting customer information on a third-party platform. The company denies the scale of the alleged breach, stating that no billing or financial details were compromised and the claimed customer numbers are inaccurate.

UNITEDHEALTH CONFIRMS 190 MILLION AMERICANS AFFECTED BY CHANGE HEALTHCARE DATA BREACH

UnitedHealth confirmed the Change Healthcare ransomware attack affected approximately 190 million Americans, making it the largest medical data breach in U.S. history. The ALPHV ransomware gang stole extensive personal, medical, and financial information through a compromised account.

SONICWALL FLAGS CRITICAL BUG LIKELY EXPLOITED AS A 0-DAY

SonicWall has issued a warning to customers running SonicWall's Secure Mobile Access 1000 product of a critical (9.8) vulnerability. The vulnerability in question allows for OS command injection. SonicWall is urging customers to update or work around the issue immediately as the vulnerability may be under active exploitation.

RANSACKED

Researchers discovered 119 vulnerabilities across 10 LTE/5G network implementations that enable potential city-wide cellular service disruption and remote network access. Every tested implementation had flaws that affected critical communication systems and could compromise cellular infrastructure. This post goes through every one of them.

SALT TYPHOON: AN ANALYSIS OF VULNERABILITIES EXPLOITED BY THIS STATE-SPONSORED ACTOR

Salt Typhoon breached multiple U.S. telecommunications providers, exploiting known vulnerabilities in external-facing systems. The sophisticated APT group targets government and technology sectors, maintaining stealthy network access through custom malware and unpatched devices. This blog analyses the attack.

SAFEGUARD YOUR GENERATIVE AI WORKLOADS FROM PROMPT INJECTIONS

The AWS Security team provides an overview of prompt injection techniques and an overview of defenses available in AWS. AWS suggests using Amazon Bedrock Guardrails for prompt injection defenses and input and output filtering as well as integrating a WAF and secure prompt engineering practices. It also recommends ensuring proper logging and that IAM roles associated with GenAI apps not have excessive permissions.

Threatlocker Allowlisting lets you set default-deny policies

that prevent ransomware and zero-day exploits, and define exceptions for applications you trust. It comes with 24/7/365 support and outperforms other appsec tools when it comes to blocking ransomware.

See how it works in four minutes, no signup required

HORUS

Horus is a Python tool for investigations that offers API support and data compilation. The tool allows for manual API configuration and has intended features at different development stages.

TOKENSMITH

TokenSmith is a tool that generates Entra ID access and refresh tokens for offensive engagements. It supports bypassing Intune compliant device conditional access.

TRYHACKME'S NEW SOC SIMULATOR

TryHackMe launched a new SOC Simulator environment to provide an immersive SOC training environment. It is running a competition for businesses interested in trying out the simulator.

ATOMIC & STATEFUL DETECTION RULES

Atomic detection rules focus on a single anomalous event. Stateful detection rules focus on identifying a pattern of suspicious activity such as repeated failed logins from a single IP. This post introduces both topics and provides sample Sigma rules for each.

WORLD'S FIRST MIDI SHELLCODE

This blog post discusses how researchers gained control of a Yamaha PSR-E433 synth by sending MIDI messages to make it play a song on the LCD screen. The researchers discovered a powerful chip inside the synth and found ways to manipulate its memory through MIDI commands. By using clever tricks and assembly snippets, they were able to create the world's first MIDI shellcode without needing special interfaces like JTAG or UART.

INSIDE FUNKSEC: AN EXCLUSIVE INTERVIEW WITH A RANSOMWARE ARCHITECT

This is an interview conducted by Foreseit with an architect of FunkSec ransomware group. Mitigation for FunkSec strategies involve strong cybersecurity measures, employee training, and staying informed on threats. Businesses should focus on prevention, backup processes, and proactive security to defend against ransomware threats.

2024 HYBRID SECURITY TRENDS REPORT - HEALTHCARE SECTOR

Report on the threats and attacks of the healthcare sector - 84% of organizations in the sector spotted a cyberattack on their infrastructure last year.

COSTA RICA REFINERY CYBERATTACK WAS FIRST DEPLOYMENT FOR NEW US RESPONSE PROGRAM, AMBASSADOR SAYS

The U.S. used a new rapid response program called FALCON to help Costa Rica after a ransomware attack on its oil refinery - it provided swift support within 36 hours, costing $500,000.

GOOGLE H1 2025 THREAT HORIZONS REPORT (PDF DOCUMENT)

Threat actors are increasingly exploiting overprivileged service accounts and identity vulnerabilities for lateral movement while adapting tactics to evade detection and maximize profits through data theft, ransomware, and cloud resource hijacking.