TLDR INFORMATION SECURITY 2025-05-27

Start building your security framework one Tuesday at a time

SUSPECTED INFOSTEALER MALWARE DATA BREACH EXPOSED 184M LOGINS AND PASSWORDS

Security researcher Jeremiah Fowler discovered a publicly exposed database that was unencrypted and not password protected, which included over 184M unique logins and passwords. The database contained legitimate credentials for various services such as email providers, Microsoft products, social media accounts, and financial accounts. Fowler contacted the hosting provider, and the database has since been removed.

DOZENS OF MALICIOUS PACKAGES ON NPM COLLECT HOST AND NETWORK DATA

Socket's threat research team discovered 60 packages on NPM that collect sensitive information about a device and send it to Discord. The malicious packages contain a post-install script that collects hostnames, internal IPs, user home directories, current working directories, usernames, and system DNS servers. Socket did not detect any additional payloads, but reported the packages for removal.

RESEARCHERS DROP POC FOR FORTINET CVE-2025-32756, URGING QUICK PATCHING

A serious security flaw, CVE-2025-32756, is being used by hackers to attack Fortinet products like FortiMail and FortiCamera. This bug lets attackers run harmful code without logging in by tricking the system with special data.

HOW TO AUTOMATE INCIDENT RESPONSE FOR AMAZON EKS ON AMAZON EC2

This AWS blog post explains how to automate incident response for Amazon EKS clusters, highlighting key differences from EC2 response procedures. It covers EKS-specific challenges like pod-to-process mapping, network isolation using cordoning and network policies, and presents a customized automated forensics solution that handles acquisition, isolation, investigation, and reporting for EKS security events.

HUMANS ARE INSECURE PASSWORD GENERATORS

Neural networks can crack human-chosen passwords by learning from password distributions, making traditional "strong" passwords vulnerable. The solution: abandon human-chosen passwords entirely and use password managers with randomly generated passwords to maintain security.

LEVERAGING SYSMON TO COMPLEMENT EDR AND ADDRESS EVASION TECHNIQUES

Attackers can bypass EDR solutions using techniques such as kernel hooking, syscall injections, DLL unhooking, process hollowing, and APC injection to evade detection. Sysmon event IDs 1, 7, 8, 10, 11, and 12 detect these evasion methods by monitoring process creation, DLL loads, thread injection, memory access, file creation, and registry modifications. Combining Sysmon with traditional EDR forms a layered defense, capturing endpoint activities that standard EDRs miss, particularly low-level memory manipulation and kernel-level operations.

SECHUB

SecHub provides a central API to test software with different security tools.

THE BOOK OF SECRET KNOWLEDGE

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more.

TELEMESSAGE EXPLORER: A NEW OPEN SOURCE RESEARCH TOOL

Micah Lee, a journalist, developed and shared an open-source tool named TeleMessage Explorer to assist journalists in examining leaked data from TeleMessage. This tool processes and visualizes messages, users, and attachments from the compromised dataset. Journalists require special access to the dataset to utilize the tool and reveal significant insights.

BANKS WANT SEC TO RESCIND CYBERATTACK DISCLOSURE REQUIREMENTS

American banking groups, led by the ABA, want the SEC to revoke cybersecurity incident disclosure requirements, arguing they conflict with confidential reporting and hinder law enforcement efforts. The groups claim the July 2023 rule creates market confusion and interferes with incident response.

BREAKING RSA ENCRYPTION JUST GOT 20X EASIER FOR QUANTUM COMPUTERS

New research from Google Quantum AI indicates that RSA-2048 encryption can be cracked by a quantum computer with one million qubits in one week, needing 20 times fewer qubits than Google's 2019 estimate due to algorithmic improvements. This advancement shortens the timeline for when the current RSA encryption schemes become vulnerable, with experts predicting that quantum computers will break asymmetric cryptography by 2029. Organizations must accelerate post-quantum cryptography adoption immediately, as the multi-year migration timeline means preparation cannot wait, even if quantum attacks are still years away.

OPEN MPIC PROJECT DEFENDS AGAINST BGP ATTACKS ON CERTIFICATE VALIDATION

Open MPIC is an open-source tool that helps stop BGP hijacking attacks during website certificate checks. It works by checking domain ownership from many places around the world instead of just one. This makes it harder for attackers to trick systems and helps keep internet traffic secure.

VIBE CODING COMPANY SAYS CLAUDE 4 REDUCED SYNTAX ERRORS BY 25%

Claude 4 helped the Vibe coding tool Lovable reduce syntax errors by 25% and speed up coding by 40%.

YOUTUBE HAS ALREADY PAID OUT $12 BILLION TO RIGHTSHOLDERS THROUGH CONTENT ID

YouTube's automated Content ID system has paid $12 billion to rightsholders, with over 90% of copyright claims in 2024 being monetized rather than removed.

FAKE SOFTWARE ACTIVATION VIDEOS ON TIKTOK SPREAD VIDAR, STEALC

Cybercriminals are creating deceptive AI-generated TikTok videos that mislead viewers into executing harmful PowerShell commands, leading to the installation of Vidar or StealC malware instead of legitimate software activation tips.