DeepSeek DB Leak 🐋, Copilot Vulnerabilities 👨‍✈️, Self-Healing Firmware 🧘‍♀️

Wiz Research discovered an exposed ClickHouse database belonging to DeepSeek, a Chinese startup. The database was accessible without authentication ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Sign Up |Advertise|View Online TLDR TLDR Information Security 2025-01-31 🔓 Attacks & Vulnerabilities Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History (5 minute read) Wiz Research discovered an exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup. The database, accessible without authentication, contained over a million log entries including chat histories, API keys, and sensitive backend data. DeepSeek promptly secured the database after being notified of the exposure. Hackers are hijacking WordPress sites to push Windows and Mac malware (2 minute read) Researchers discovered hackers exploiting vulnerable WordPress sites to trick visitors into downloading fake browser updates containing malware. The ongoing campaign affects thousands of websites, including popular ones, and targets both Windows and Mac users. The malware aims to steal passwords and personal information through deceptive update prompts. 152,000 Impacted by Data Breach at Berman & Rabin (2 minute read) Law firm Berman & Rabin suffered a ransomware attack in July 2024. Attackers accessed systems between July 5-8 and stole data. In October, Berman & Rabin confirmed that 152,000 individuals' personal data was compromised, including SSNs and financial information. The firm is offering affected individuals free credit monitoring and identity protection services. 🧠 Strategies & Tactics 2025 GitHub Copilot vulnerabilities – technical overview (8 minute read) This blog discusses new GitHub Copilot vulnerabilities, for example, using the word "Sure" can trigger unethical responses like SQL injection tutorials. It aims to highlight weaknesses in AI assistant security safeguards. The J-Magic Show: Magic Packets and Where to Find Them (8 minute read) Lumen Technologies' Black Lotus Labs has been tracking a malicious campaign that targets Juniper enterprise routers. The malware is a passive agent that listens for one of five parameters sent in a "magic packet." This post contains a technical analysis of the magic packets and indicators of compromise for threat hunters. Introduction to Detection Engineering with Sigma (8 minute read) Sigma provides a backend-neutral detection signature language for logs that can be converted to a variety of different query languages such as Splunk SPL or Sentinel KQL. This post walks through a Sigma rule to explain the components and syntax. It then introduces some more advanced features such as pipelines to resolve mapping issues between rules and data sources and correlation rules to provide stateful detections. 🧑‍💻 Launches & Tools Backline (Product Launch) Backline's AI agents act as software and security engineers, analyzing potential vulnerabilities, collecting context, and determining how to optimally address an issue for the customer's specific environment. The agents then autonomously implement the needed code and configuration changes. SeCoRa (GitHub Repo) SeCoRa is an AI-powered code review tool for detecting and remediating vulnerabilities in codebases. YaraMonitor (GitHub Repo) YaraMonitor is a tool that monitors malware samples using YARA rules. It continuously analyzes and alerts on new uploads from sources like MalwareBazaar and can be extended to monitor additional sources. Running the main.py script from the root folder will automate the ingestion and scanning process for malware samples. 🎁 Miscellaneous Data Safety Levels Framework: The Foundation of How We Look at Data in Block (6 minute read) Cash App's security team devised a Data Safety Levels (DSL) Framework based on the CDC's biosafety levels to utilize for data classification. The framework takes a dataset level approach to devise standardized rubrics for evaluating data based on its usage such as Consumer Personal Data and Payment Card Data. The framework couples with automation to be able to classify data as part of Block teams' regular workflows as well as guidelines on how to handle data of various sensitivity levels. Top 5 Security Mistakes Software Developers Make (10 minute read) An executive-level brief on common classes of security issues. The first three focus on vulnerabilities in code such as lack of input validation, lax or missing authentication, and lack of API protections. The last two focus on lack of appropriate tools like WAFs and insufficient or inefficient automations. Privacy-preserving Contact Discovery for Bluesky (3 minute read) This post discusses a peer-reviewed and published protocol called Arke for privacy-preserving contact discovery that can be applied to create a contact discovery service for 𝕏 users joining Bluesky without revealing social graphs. The protocol involves a setup committee, a public bulletin board, and user clients to enable users to connect privately and securely. ⚡ Quick Links CISA Releases Fact Sheet Detailing Embedded Backdoor Function of Contec CMS8000 Firmware (2 minute read) CISA released a fact sheet about a backdoor in Contec CMS8000 patient monitors that allows unauthorized access to patient data. North Korean hackers impersonated recruiters to steal credentials from over 1,500 developer systems (3 minute read) North Korean hackers posed as recruiters to steal credentials from over 1,500 developer systems worldwide in a coordinated cyber campaign. DARPA wants to create 'self-healing' firmware that can respond and recover from cyberattacks (5 minute read) DARPA is developing an ambitious project called Red-C that aims to create self-healing firmware capable of automatically detecting, responding to, and recovering from cyberattacks at the bus level of computer systems, though the project faces significant technical and adoption challenges. Love TLDR? Tell your friends and get rewards! Share your referral link below with friends to get free TLDR swag! https://refer.tldr.tech/dc263000/8 Track your referrals here. Want to advertise in TLDR? 📰 If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us. Want to work at TLDR? 💼 Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them! If you have any comments or feedback, just respond to this email! Thanks for reading, Prasanna Gautam, Eric Fernandez & Sammy Tbeile Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.