TLDR INFORMATION SECURITY 2025-03-12

Download the Guide

SECOND BIGGEST BANK IN US HIT BY MAJOR DATA BREACH STEALING SSNS AND OTHER PERSONAL INFO

Bank of America has informed clients that it suffered a data breach due to a data destruction vendor's mishandling of sensitive documents. The bank reported that some documents were found outside of the secure containers on the exterior of the financial center. The documents may have included names, account details, addresses, contact information, date of birth, SSNs, and other government IDs.

MULTIPLE VULNERABILITIES FOUND IN ICONICS INDUSTRIAL SCADA SOFTWARE

In October, Palo Alto Networks discovered five vulnerabilities in the widely used SCADA software system, ICONICS. Although these vulnerabilities have been fixed, scans indicate that several dozen internet-facing systems remain unpatched. The vulnerabilities could enable privilege escalation, DLL hijacking, and, in some cases, total system compromise.

'UBER FOR NURSES' EXPOSES 86K+ MEDICAL RECORDS, PII IN OPEN S3 BUCKET FOR MONTHS

Healthcare tech company ESHYFT exposed over 86,000 sensitive records in an unsecured AWS S3 bucket, including nurses' medical information, facial images, and ID documents. Despite being notified in January, the company took over a month to secure the 108.8 GB database.

NPM RUN HACK:ME - A SUPPLY CHAIN ATTACK JOURNEY

This story is about a freelance developer tricked by a fake recruiter on LinkedIn for a Web3 project. After accepting simple coding tasks as part of the interview process, they launched a server that secretly gave hackers user-level access to their system. The supposed recruiter and CTO disappeared afterward.

EVALUATING AWS NATIVE APPROACHES FOR DETECTING SUSPICIOUS API CALLS

A comparison of three methods for detecting suspicious AWS API calls. Eventbridge offers quick response times and low cost but lacks support for multi-account or complex setups. CloudTrail to Lambda provides flexibility and visibility with easy multi-account integrations but is slower. The CloudWatch with Metric Filters approach is faster than Lambda, but increases complexity in AWS pattern syntax.

A DEEP DIVE INTO JS TRUSTED TYPES VIOLATIONS

Trusted Types implementation in Gmail and AppSheet eliminated DOM XSS vulnerabilities using developer-focused approaches to find and fix violations. Key strategies included deploying static analysis tools for early detection and utilizing runtime analysis techniques to track violations through script-sample searches and minified code examination. The work created patterns and tools like Trusted Types Helper to fix violations, contributing to better security practices across the JavaScript ecosystem.

SOLA SECURITY (PRODUCT LAUNCH)

Sola is a new security platform that uses AI to query data within existing or built-in security applications. It aims to create more streamlined security services for organizations, which, in theory, will do exactly what they want and at a fraction of the cost.

VULNVIPER

VulnViper is a powerful, customizable web server vulnerability scanner written in Python that helps ethical hackers, penetration testers, and security professionals identify security issues in web servers.

BABY NAPTIME

Baby Naptime is an open-source implementation of Google's Project Naptime, which uses LLMs to discover and exploit native vulnerabilities.

NEW YORK SUES ALLSTATE OVER DATA BREACH, ALLEGED SECURITY LAPSES

The New York Attorney General has sued Allstate for inadequate system security following breaches in 2020 and 2021, which exposed nearly 200K customers' personal information, including driver's license numbers. Allstate denies liability, claiming improved security and patched vulnerabilities.

SWISS CRITICAL SECTOR FACES NEW 24-HOUR CYBERATTACK REPORTING RULE

Switzerland's NCSC has announced a new rule that requires critical infrastructure organizations to report cyberattacks within 24 hours of discovering them. Cyberattacks include any actions that jeopardize the operation of critical infrastructure, such as manipulation, encryption, or data exfiltration; malware installed on systems; unauthorized access to systems; and extortion, threats, or coercion. This new requirement will take effect on April 1, with a grace period until October.

1,600 VICTIMS HIT BY SOUTH AMERICAN APT'S MALWARE

The South American cyberespionage group Blind Eagle has compromised over 1,600 Colombian organizations. It exploited security vulnerabilities and cloud accounts to deploy malware and gain unauthorized access.

MICROSOFT PATCHES PRIVILEGE ESCALATION FLAW EXPLOITED SINCE 2023

Microsoft has patched a privilege escalation flaw in the Win32k driver that has been exploited since 2023 in attacks using a backdoor called PipeMagic.

APPLE FIXED THE THIRD ACTIVELY EXPLOITED ZERO-DAY OF 2025

Apple fixed a serious security vulnerability, CVE-2025-24201, that let attackers escape the Web Content sandbox and was exploited in sophisticated cyber attacks.

FAKE BINANCE WALLET EMAIL PROMISES TRUMP COIN, INSTALLS MALWARE

Scammers impersonated Binance, offering a fake TRUMP coin via email, leading users to download malware that granted attackers full control of computers.