TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-05-06

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

threatlocker.com

02ATTACKS & VULNERABILITIES

KELLY BENEFITS DECEMBER DATA BREACH IMPACTED OVER 400,000 INDIVIDUALS

Kelly Benefits experienced a data breach where hackers accessed systems from December 12-17, 2024, exposing personal information, including names, SSNs, and financial data. Initially affecting 264,000 people, the number has grown to 413,032. The company is notifying impacted individuals across multiple client organizations, with investigations ongoing.

securityaffairs.com2 min read

TELEMESSAGE, A MODIFIED SIGNAL CLONE USED BY U.S. GOVERNMENT OFFICIALS, HAS BEEN HACKED

404 Media revealed that TeleMessage, the modified version of Signal that national security adviser Michael Walz was using, has been hacked. The hacker obtained plaintext conversations showing that the app is not end-to-end encrypted. The hacker says they did not obtain Walz's conversations and that it only took 15-20 minutes to hack the app.

techcrunch.com2 min read

ANONYMOUS HACKS GLOBALX, TRUMP AIRLINE OF CHOICE FOR ICE DEPORTATIONS

Anonymous hacked the website of GlobalX, the airline used by the Trump administration for controversial deportations. The hackers criticized Trump's actions and leaked confidential flight information. GlobalX has not commented on the hack, which comes after Anonymous leaked Russian government data earlier this month.

links.tldrnewsletter.com3 min read

03STRATEGIES & TACTICS

KUBE-POLICIES: GUARDRAILS FOR APPS RUNNING IN KUBERNETES

The Square team built an adaptive security layer on OPA for their Kubernetes clusters. Kube-Policies was designed to allow for a phased rollout process, minimal user disruption, support a robust testing framework, allow for extensibility and exceptions, and be observable. This post dives into the strategies used to accomplish each goal, such as using kind for testing and warning HTTP Headers for phased rollouts.

developer.squareup.com17 min read

CODE EXECUTION INSIDE PID 0

In Windows systems, PID 0 is a special process called the System Idle Process, which contains threads that execute when no other thread is ready to run on a given processor. The author of this post found that they could swap the pointer inside any _KPRCB to run code in PID 0 via the nt!PpmIdleSelectStates function. Hooking into PID 0 is advantageous as traditional detection APIs and lookups will fail and the execution does not require any system calls.

archie-osu.github.io7 min read

04LAUNCHES & TOOLS

DOPPEL (PRODUCT LAUNCH)

Doppel provides digital risk protection through continuous monitoring, rapid detection, and seamless takedowns across traditional channels like web domains, social media platforms, and the dark web, as well as emerging channels such as Telegram and crypto.

doppel.com

MATRIX

The "Matrix" project is a meticulously crafted and entirely self-managed DNS Firewall utilising Response Policy Zones (RPZ). Its primary objective is to safeguard your privacy by obstructing access to malicious domains and tracking servers, thereby providing a secure online environment.

github.comGitHub repository

CURING

Curing is a Linux rootkit that uses io_uring to perform different tasks without syscalls.

github.comGitHub repository

05MISCELLANEOUS

TIKTOK HIT WITH €530M FINE AFTER ILLEGALLY SENDING USERS' DATA TO CHINA

Ireland's data regulator fined TikTok €530 million for illegally transferring European user data to China and for lacking transparency. TikTok breached EU privacy laws by failing to protect data from Chinese surveillance laws. The company plans to appeal the decision.

links.tldrnewsletter.com3 min read

APPLE NOTIFIES NEW VICTIMS OF SPYWARE ATTACKS ACROSS THE WORLD

Apple sent out notifications to an undisclosed number of individuals it believes were targeted by government spyware campaigns. An Italian journalist and a Dutch right-wing activist both shared that they received the notification, which mentioned that the notification was sent to users in 100 different countries.

techcrunch.com2 min read

WHITE HOUSE PROPOSAL SLASHES HALF-BILLION FROM CISA BUDGET

The White House plans to cut $491 million from the CISA budget, claiming the agency focused too much on censorship instead of cyber defense. The proposed budget cut aims to refocus CISA on its core mission and eliminate redundant programs. Department of Homeland Security Secretary Kristi Noem emphasized the need for CISA to prioritize hands-on cyber defense support for critical systems.

securityweek.com2 min read