CHC breach affects 1M 🏥, Testing AWS GuardDuty 👮‍♂️, Stratoshark: Cloud Wireshark 🦈

A cyberattack on the Community Health Center affected over 1 million patients' personal and medical data. The breach was discovered on January 2 ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Sign Up |Advertise|View Online TLDR Together With TLDR Information Security 2025-02-03 ThreatLocker Allowlisting: Zero Trust Endpoint Protection (Sponsor) Many ransomware attacks start when a user runs a harmless-looking executable on their endpoint device — and chasing down every new install can be impossible. ThreatLocker Application Allowlisting puts you back in control over everything that's running in your business. No remote access tools, games, or coupon clippers - unless they're allowed. The agent learns from your existing environment to understand the baseline of which software is required. Easily see risks related to each installed application and decide whether it stays or goes. Simulate what happens once permissions are denied. New versions of existing software are allowed by default. Separate testing environment to evaluate new applications. 👀 See Allowlisting in action 🔓 Attacks & Vulnerabilities Community Health Center Data Breach Affects 1M Patients (2 minute read) A cyberattack on the Community Health Center affected over 1 million patients' personal and medical data. The breach, discovered on January 2, follows recent attacks on Frederick Health and NY Blood Center. Though access was quickly blocked, CHC is offering affected patients free identity theft protection and monitoring services. Time Bandit ChatGPT Jailbreak Bypasses Safeguards on Sensitive Topics (2 minute read) A security researcher discovered a new jailbreak for ChatGPT that involves abusing a mechanism to confuse ChatGPT into believing that it's in the past (temporal confusion) and then asking ambiguous questions. This vulnerability allowed the researcher to ask ChatGPT for information such as how a programmer in the 1700s could create polymorphic malware with modern techniques. The researcher attempted to disclose this vulnerability to OpenAI with the aid of various government agencies, but the vulnerability has not been fixed. Issue with AWS Sign-in IAM User Login Flow (2 minute read) AWS has remediated an issue with IAM use sign-in flow that could allow for a malicious user to enumerate logins. The vulnerability was due to a timing attack in which the server response times for a valid or invalid user varied. AWS remediated the issue by introducing a timing delay across all authentication failure scenarios. 🧠 Strategies & Tactics A brief history of mass hacks (7 minute read) Major cybersecurity tools meant to protect networks have repeatedly become vectors for mass hacking campaigns. From 2023-2025, vulnerabilities in products by Cisco, Citrix, Ivanti, Palo Alto, and more have led to widespread breaches affecting thousands of organizations and millions of individuals. This post dives into the brief history of these attacks. Testing and Evaluating GuardDuty Detections (8 minute read) The AWS GuardDuty team has released a tool called GuardDuty Tester to generate infrastructure and synthetic events to test GuardDuty alerts and actions. This post walks through deploying GuardDuty Tester and creating alerts and automations based on GuardDuty findings. AWS has cautioned users to not run GuardDuty Tester in production environments and ideally to use a dedicated account. Everyone knows your location: tracking myself down through in-app ads (10 minute read) This investigation revealed how mobile apps, even with location services disabled, leak sensitive data through real-time bidding (RTB) systems and advertising networks, with Unity Ads, Facebook, and various data brokers collecting precise location data, device information, and behavioral patterns. It highlights how data brokers create comprehensive user profiles by combining Mobile Advertising IDs (MAIDs) with personally identifiable information (PII), suggesting that security assessments should examine not just individual data points but the entire data flow ecosystem, including third-party integrations and data marketplace vulnerabilities. 🧑‍💻 Launches & Tools Clutch Security (Product Launch) Clutch's Universal Non Human Identity Security Platform can provide organizations with a unified view across all these identities, regardless of the environment they reside in, tracking their access, origin, ownership, storage, and usage. Haiti (GitHub Repo) A CLI tool (and library) that identifies hash types. Stratoshark (GitHub Repo) The team behind Wireshark has released a new tool called Stratoshark for monitoring system calls with a similar interface and syntax as Wireshark. 🎁 Miscellaneous Texas governor orders ban on DeepSeek, RedNote for government devices (2 minute read) Texas has banned DeepSeek and social media apps Xiaohongshu and Lemon8 from government devices, citing security concerns about data harvesting. The move follows similar bans on TikTok. DeepSeek has gained popularity among U.S. users and emerged as an OpenAI competitor. As of February 2025: Harmful AI applications prohibited in the EU (4 minute read) The EU AI Act prohibits AI systems that pose unacceptable risks, including manipulative systems, social scoring, unauthorized facial recognition databases, and certain emotion recognition technologies. Violations face fines up to €35M or 7% of annual turnover. AI Agent Identity: It's Just OAuth (9 minute read) OAuth provides the perfect model for authenticating AI Agents as it is designed for auditable and secure delegation of access. OAuth adoption is scant and even where it exists, scopes are often very minimal and incomplete. This solution doesn't scale to tools where the AI is acting as the user's identity such as ChatGPT Desktop or Claude computer use. ⚡ Quick Links KuCoin to pay nearly $300 million in penalties after guilty plea (2 minute read) KuCoin's operator pleaded guilty to running an unlicensed money-transmitting business and will pay $297 million in penalties in the U.S. for failing to implement required anti-money laundering measures. U.S. and Dutch Authorities Dismantle 39 Domains Linked to BEC Fraud Network (2 minute read) U.S. and Dutch authorities worked together to shut down 39 websites connected to a fraud network last month. WhatsApp says it disrupted spyware campaign aimed at reporters, civil society (2 minute read) WhatsApp disrupted a spyware campaign targeting journalists and activists. Love TLDR? Tell your friends and get rewards! Share your referral link below with friends to get free TLDR swag! https://refer.tldr.tech/dc263000/8 Track your referrals here. Want to advertise in TLDR? 📰 If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us. Want to work at TLDR? 💼 Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them! If you have any comments or feedback, just respond to this email! Thanks for reading, Prasanna Gautam, Eric Fernandez & Sammy Tbeile Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.