TLDR INFORMATION SECURITY 2025-02-03

👀 See Allowlisting in action

COMMUNITY HEALTH CENTER DATA BREACH AFFECTS 1M PATIENTS

A cyberattack on the Community Health Center affected over 1 million patients' personal and medical data. The breach, discovered on January 2, follows recent attacks on Frederick Health and NY Blood Center. Though access was quickly blocked, CHC is offering affected patients free identity theft protection and monitoring services.

TIME BANDIT CHATGPT JAILBREAK BYPASSES SAFEGUARDS ON SENSITIVE TOPICS

A security researcher discovered a new jailbreak for ChatGPT that involves abusing a mechanism to confuse ChatGPT into believing that it's in the past (temporal confusion) and then asking ambiguous questions. This vulnerability allowed the researcher to ask ChatGPT for information such as how a programmer in the 1700s could create polymorphic malware with modern techniques. The researcher attempted to disclose this vulnerability to OpenAI with the aid of various government agencies, but the vulnerability has not been fixed.

ISSUE WITH AWS SIGN-IN IAM USER LOGIN FLOW

AWS has remediated an issue with IAM use sign-in flow that could allow for a malicious user to enumerate logins. The vulnerability was due to a timing attack in which the server response times for a valid or invalid user varied. AWS remediated the issue by introducing a timing delay across all authentication failure scenarios.

A BRIEF HISTORY OF MASS HACKS

Major cybersecurity tools meant to protect networks have repeatedly become vectors for mass hacking campaigns. From 2023-2025, vulnerabilities in products by Cisco, Citrix, Ivanti, Palo Alto, and more have led to widespread breaches affecting thousands of organizations and millions of individuals. This post dives into the brief history of these attacks.

TESTING AND EVALUATING GUARDDUTY DETECTIONS

The AWS GuardDuty team has released a tool called GuardDuty Tester to generate infrastructure and synthetic events to test GuardDuty alerts and actions. This post walks through deploying GuardDuty Tester and creating alerts and automations based on GuardDuty findings. AWS has cautioned users to not run GuardDuty Tester in production environments and ideally to use a dedicated account.

EVERYONE KNOWS YOUR LOCATION: TRACKING MYSELF DOWN THROUGH IN-APP ADS

This investigation revealed how mobile apps, even with location services disabled, leak sensitive data through real-time bidding (RTB) systems and advertising networks, with Unity Ads, Facebook, and various data brokers collecting precise location data, device information, and behavioral patterns. It highlights how data brokers create comprehensive user profiles by combining Mobile Advertising IDs (MAIDs) with personally identifiable information (PII), suggesting that security assessments should examine not just individual data points but the entire data flow ecosystem, including third-party integrations and data marketplace vulnerabilities.

CLUTCH SECURITY (PRODUCT LAUNCH)

Clutch's Universal Non Human Identity Security Platform can provide organizations with a unified view across all these identities, regardless of the environment they reside in, tracking their access, origin, ownership, storage, and usage.

HAITI

A CLI tool (and library) that identifies hash types.

STRATOSHARK

The team behind Wireshark has released a new tool called Stratoshark for monitoring system calls with a similar interface and syntax as Wireshark.

TEXAS GOVERNOR ORDERS BAN ON DEEPSEEK, REDNOTE FOR GOVERNMENT DEVICES

Texas has banned DeepSeek and social media apps Xiaohongshu and Lemon8 from government devices, citing security concerns about data harvesting. The move follows similar bans on TikTok. DeepSeek has gained popularity among U.S. users and emerged as an OpenAI competitor.

AS OF FEBRUARY 2025: HARMFUL AI APPLICATIONS PROHIBITED IN THE EU

The EU AI Act prohibits AI systems that pose unacceptable risks, including manipulative systems, social scoring, unauthorized facial recognition databases, and certain emotion recognition technologies. Violations face fines up to €35M or 7% of annual turnover.

AI AGENT IDENTITY: IT'S JUST OAUTH

OAuth provides the perfect model for authenticating AI Agents as it is designed for auditable and secure delegation of access. OAuth adoption is scant and even where it exists, scopes are often very minimal and incomplete. This solution doesn't scale to tools where the AI is acting as the user's identity such as ChatGPT Desktop or Claude computer use.

KUCOIN TO PAY NEARLY $300 MILLION IN PENALTIES AFTER GUILTY PLEA

KuCoin's operator pleaded guilty to running an unlicensed money-transmitting business and will pay $297 million in penalties in the U.S. for failing to implement required anti-money laundering measures.

U.S. AND DUTCH AUTHORITIES DISMANTLE 39 DOMAINS LINKED TO BEC FRAUD NETWORK

U.S. and Dutch authorities worked together to shut down 39 websites connected to a fraud network last month.

WHATSAPP SAYS IT DISRUPTED SPYWARE CAMPAIGN AIMED AT REPORTERS, CIVIL SOCIETY

WhatsApp disrupted a spyware campaign targeting journalists and activists.