TLDR INFORMATION SECURITY 2025-03-28

→ Learn more about Libraries on the Chainguard blog

GOOGLE FIXES CHROME ZERO-DAY EXPLOITED IN ESPIONAGE CAMPAIGN

Google has fixed a high-severity Chrome zero-day vulnerability that allowed malicious users to escape the browser sandbox. Researchers from Kaspersky reported this vulnerability, which they described as an “incorrect handle provided in unspecified circumstances in Mojo on Windows.” Attackers are actively exploiting this vulnerability to infect targets with sophisticated malware used for espionage. A similar zero-day vulnerability was also recently disclosed and patched in Firefox.

NHS VENDOR ADVANCED TO PAY £3M FINE FOLLOWING 2022 RANSOMWARE ATTACK

NHS vendor Advanced will pay £3 million in fines for failing to implement basic security measures before a 2022 ransomware attack. The ICO found the company breached data protection law by not using multi-factor authentication, leading to stolen personal information and NHS system disruptions.

150,000 SITES COMPROMISED BY JAVASCRIPT INJECTION PROMOTING CHINESE GAMBLING PLATFORMS

A massive cyber campaign compromised around 150,000 websites using malicious JavaScript to redirect visitors to Chinese-language gambling platforms. The attack involved injecting scripts that hijack browser windows to display gambling sites.

LUCID DEEP DIVE

Lucid is a sophisticated Phishing-as-a-Service platform operated by Chinese threat actors. This blog dives into what it is, its targets, and the technology behind it. Lucid uses advanced SMS and iMessage technologies to enable large-scale phishing campaigns to steal credit card details. It has targeted more than 160+ organizations.

BLASTING PAST WEBP

The NSO Group's BLASTPASS exploit targets iPhones via iMessage through a WebP vulnerability. The attack involves sending a PKPass file with a WebP image that caused a buffer overflow, overwriting a pointer, and executing malicious code via heap manipulation that bypasses iOS protections like ASLR and PAC. Unlike earlier exploits that need complex "weird machines," BLASTPASS uses conventional techniques such as callback-oriented programming and a multi-stage approach, with follow-up iMessages delivering final payload encryption keys.

FUN WITH TIMING ATTACKS

Timing attacks can exploit non-constant-time string comparison functions like `startsWith` to determine secrets character by character. Attackers can deduce when a guess's prefix matches part of the secret by measuring execution times over many trials, allowing them to crack an 8-character password in just thousands of attempts rather than billions. This can be demonstrated with a browser-based implementation using Thompson Sampling and a statistical approach. Developers should avoid direct secret comparisons and instead use proper cryptographic hashing with rate limiting.

STRAIKER (PRODUCT LAUNCH)

Straiker aims to address the risks associated with the increasing use of AI chatbots and AI agents through continuous testing or one-time risk assessments that involve in-depth attack simulations against AI applications and agents. It can also automatically block identified threats

NAKAMOTO

Nakamoto is a 2-layer encryption tool that protects your data and cryptocurrency private keys.

SPYAI

SpyAI is malware that captures full-monitor screenshots and exfiltrates them via Trusted Channel Slack to a GPT-4 Vision C2 server for daily frame-by-frame analysis.

MICROSOFT WOULDN'T LOOK AT A BUG REPORT WITHOUT A VIDEO

Security researcher Will Dorman attempted to report a vulnerability to the Microsoft Security Response Center by providing a report with a clear description of the bug and supporting screenshots. However, Microsoft responded that it could not review the report until a video was submitted. This was unnecessary and time-wasting, as it would provide no additional details and would just show the commands that have already been screenshotted.

UK'S FIRST PERMANENT FACIAL RECOGNITION CAMERAS TO BE INSTALLED IN SOUTH LONDON DESPITE BACKLASH

The Metropolitan Police will install permanent live facial recognition cameras in Croydon, London, to catch criminals by matching faces against a wanted list. Privacy campaigners strongly oppose the move, calling it a potential "dystopian nightmare" with no proper oversight.

COFFEELOADER PRETENDS TO BE ASUS SOFTWARE TO STEAL YOUR DATA

Zscaler researchers have discovered a new malware family, CoffeeLoader, active since September 2024. It masquerades as the ASUS Armoury Crate utility and delivers an infostealer like Rhadamanthys using sophisticated evasion techniques such as GPU code execution, stack spoofing, and sleep obfuscation.

FAKE SNOW WHITE MOVIE TORRENT INFECTS DEVICES WITH MALWARE

Scammers are spreading malware by offering fake Snow White movie downloads to torrent users.

NEW SECURITY REQUIREMENTS ADOPTED BY HTTPS CERTIFICATE INDUSTRY

Google's Chrome Root Program has introduced new security initiatives, including Multi-Perspective Issuance Corroboration and Linting, to enhance the reliability and agility of TLS connections used by Chrome users.

T-MOBILE COUGHED UP $33 MILLION IN SIM SWAP LAWSUIT

T-Mobile must pay $33 million for a SIM swap attack that let hackers steal cryptocurrency and access accounts.