TLDR INFORMATION SECURITY 2025-06-11

Watch the video (03:13 minutes)

NEARLY 300K CRASH RECORDS STOLEN FROM TEXAS TRANSPORTATION DEPARTMENT

The Texas Department of Transportation is notifying the impacted individuals of a data breach of its Crash Reports Information System (CRIS). The breached data includes full names, addresses, driver's license numbers, license plate numbers, and car insurance policy numbers. An attacker obtained the data via a compromised account.

SENSITIVE INFORMATION STOLEN IN SENSATA RANSOMWARE ATTACK

Sensata Technologies confirmed hackers stole sensitive employee data during a March-April ransomware attack. The stolen information includes Social Security numbers, financial details, and health insurance data.

FOUND IN THE WILD: 2 SECURE BOOT EXPLOITS. MICROSOFT IS PATCHING ONLY 1 OF THEM

Researchers discovered two Secure Boot bypass exploits affecting 50+ device makers. Microsoft patched CVE-2025-3052 (DT Research firmware tool vulnerability) but left CVE-2025-47827 (IGEL Linux OS flaw) unpatched. Both allow attackers with physical access to install pre-boot malware, defeating Secure Boot's core security purpose against "evil maid" attacks.

GARTNER: HOW SECURITY TEAMS CAN TURN HYPE INTO OPPORTUNITY

At Gartner's Security Summit, analysts advised harnessing AI and cybersecurity hype constructively rather than letting it drive hasty decisions. They recommended using protection level agreements and outcome-driven metrics for fact-based security conversations with executives. Security teams must develop AI literacy while protecting organizational AI investments from emerging threats.

NEW PROCESS INJECTION CLASS: THE CONTEXT-ONLY ATTACK SURFACE

Most process injection techniques typically begin by allocating memory, writing to that memory, and then executing it. However, the researchers in this post explored the possibility of process injection while only using the execution step. The researchers first achieved their goal by dropping a malicious DLL and then executing it by abusing that LoadLibraryA automatically appends “.dll” to strings that are passed to it. The researchers then took this one step further and used CreateRemoteThread with SetThreadContext and NTCreateThread to execute code in a remote process without needing to write a DLL to disk.

HIGH LEVERAGE SECURITY DECISIONS

This post presents a list of security decisions that can be made early in a startup's lifecycle to enhance long-term security while providing the most value early on. The list includes organizational security and IAM-related decisions such as choosing an Identity Provider, adopting security keys, and using a Mobile Device Management (MDM) solution. The list also includes architectural decisions like adopting Infrastructure as Code and using managed infrastructure where possible.

CONTAINERIZATION

The Containerization package allows applications to use Linux containers. Containerization is written in Swift and uses Virtualization.framework on Apple silicon.

SWIMLANE (PRODUCT LAUNCH)

Swimlane's platform leverages agentic AI and automation to resolve security, IT/OT operations, and compliance issues.

CLAUDE-C2

Claude-C2 provides an MCP server to communicate with a C2 server.

M&S ONLINE ORDERING SYSTEM OPERATIONAL 46 DAYS AFTER CYBER SHUTDOWN

Marks & Spencer has partially restored online orders following an April cyberattack, with select fashion ranges now available in England, Scotland, and Wales. Services remain limited - no Northern Ireland delivery, Click & Collect, or next-day options.

RESEARCHERS UNCOVER POSSIBLE IPHONE SPYWARE CAMPAIGN INSIDE US

Researchers from iVerify detected behavior indicative of tampering and spyware in iPhones belonging to high-value targets in an EU member state's government, US political campaigns, media organizations, and an AI company. The hackers targeted the individuals via the “Nickname” feature in iOS, which sends a notification whenever someone's iCloud photo or name changes. Apple has fixed the vulnerability being used and claimed that it has uncovered no evidence of exploitation.

BRUTEFORCING THE PHONE NUMBER OF ANY GOOGLE USER

CONNECTWISE ROTATING CODE SIGNING CERTIFICATES OVER SECURITY CONCERNS

ConnectWise is updating digital certificates for key software to address security concerns - users must install these updates by June 13 to avoid potential issues.

MICROSOFT OUTLOOK TO BLOCK MORE RISKY ATTACHMENTS USED IN ATTACKS

Starting next month, Microsoft will expand the types of blocked attachments in Outlook Web and the new Outlook for Windows to improve security by preventing potentially harmful files from being sent or received.