TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-05-16

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

PERSONAL INFORMATION EXPOSED BY AUSTRALIAN HUMAN RIGHTS COMMISSION DATA BREACH

The Australian Human Rights Commission reported that around 670 documents were accidentally made public, with at least 100 documents accessed by search engines. The documents come from submissions to its complaint form and feedback forms from the Speaking from Experience Project, Human Rights Awards 2023 nominations, and the National Anti-Racism Framework concept paper. The potentially impacted data includes full names, email addresses, residential addresses, phone numbers, employers and roles, work contact information, PHI, schooling information, religion, and photographs.

cyberdaily.au2 min read

OVER 3M RECORDS, INCLUDING PII OF STUDENT-ATHLETES AND COLLEGE COACHES EXPOSED IN DATA BREACH

Security researcher Jeremiah Fowler discovered a publicly accessible, unencrypted, and non-password-protected database belonging to PrepHero, which is a platform to assist high school athletes with securing scholarships. The database contained over 3M records that included full names, phone numbers, physical addresses, and passport data of students, as well as contacts of parents and college sports coaches. Fowler also discovered a CSV file containing links to passport images of student athletes and a mail archive that included PII sent to coaches.

vpnmentor.com2 min read

COINBASE DISCLOSED A DATA BREACH AFTER AN EXTORTION ATTEMPT

Coinbase reported that rogue contractors stole data from less than 1% of users and demanded a $20 million ransom. The breach included personal and account information but did not affect passwords or funds. Coinbase refused to pay and fired those involved. It is starting to boost security and support to protect users.

securityaffairs.com2 min read

02STRATEGIES & TACTICS

WHAT IT TAKES TO DEFEND A CYBERSECURITY COMPANY FROM TODAY'S ADVERSARIES

Sentinel One details some of the threats it faces as a security vendor. It has faced North Korean threat actors trying to infiltrate its organization via workers, threat actors probing its network and tools to develop bypasses, and Chinese state-sponsored threat actors targeting supply chains that impact Sentinel One customers. Sentinel One urges practitioners to distribute threat intel information across operational stakeholders to expand detection, integrate context into attribution activities, and expand supply chain threat monitoring.

sentinelone.com10 min read

COMMIT STOMPING

Commit Stomping is a way to change Git commit timestamps to hide when changes were made. This can make it hard to track who did what and when, especially during audits or code reviews. To protect against it, use signed commits, log events, and watch for unusual patterns.

links.tldrnewsletter.com8 min read

FRESH FROM THE DOCKS: UNCOVERING 100,000 VALID SECRETS IN DOCKERHUB

GitGuardian's analysis of 15 million DockerHub images revealed 100,000 valid secrets exposing databases, AWS infrastructures, GitHub Enterprise instances, and Artifactory repositories. 97% were found in image layers, with 60% created before 2024 and over 2,000 dating back to 2020, showing secrets often go unrotated for years. Docker images leak secrets due to build issues like persistent layers and build argument leaks, making regular security audits essential, as prevention is cheaper than responding to breaches.

blog.gitguardian.com7 min read

03LAUNCHES & TOOLS

GHOSTING-AMSI

A PowerShell script that provides an AMSI Bypass via RPC Hijack, which exploits the COM-level mechanics that AMSI uses when delegating scan requests to antivirus providers.

github.comGitHub repository

KEVINTEL

KEVIntel displays known exploited vulnerabilities (KEVs) cataloged from over 50 public sources, including CISA, and our private sensors (once we get some hits). Each entry links to a CVE identifier, enriched with EPSS scores, online mentions, scanner inclusion, exploitation, and other metadata. The goal is to serve as an early warning system, even before CISA publishes it.

kevintel.comTool

04MISCELLANEOUS

CAN WE STOP DOCUMENTING OUR DETECTIONS?

Documentation is important for detections to explain to SOC analysts what the rule detects, how to investigate the alert, any necessary enrichments, how to identify a false positive, and any necessary steps if it is a true positive. This post compares documentation with rules generated by LLMs to those written by humans using examples from Elastic's open-source rule sets. The evaluation found that roughly 60% of investigative steps provided by the LLM matched human-created ones, but also noted that humans tended to provide a larger number of detailed investigative steps.

detect.fyi11 min read

THE IOS BOOK APP JUST OPENED ITS PAGES TO HACKERS

An iOS app called "My Book List" leaked personal data from 42,000 users due to poor security. Hackers could use this data for phishing and targeted attacks. Experts found that many iOS apps make the same mistake by exposing secret information in their code.

links.tldrnewsletter.com4 min read