Welcome to today's issue of Secret CISO, your daily dose of cybersecurity insights. Today, we delve into a series of security incidents and advancements that have made headlines. In Pakistan, a suicide car bomber targeted buses carrying security forces, resulting in the tragic loss of lives. This incident underlines the critical need for robust security measures in conflict-prone regions. In the realm of cybersecurity, OT security experts from OMICRON have analyzed over 7,000 vulnerabilities in critical infrastructure protection and control devices. Their findings highlight the importance of modern cybersecurity measures for protection test sets. On the legal front, a series of data breach lawsuits have been consolidated, underscoring the growing legal implications of data breaches.

Meanwhile, an expert has warned that WhatsApp groups pose a significant risk to personal data security, making users vulnerable to scams and unsolicited attacks. In the energy sector, Vietnam's new energy decree is creating offshore wind investment opportunities. However, businesses are advised to review their cybersecurity programs following the Security Bureau's announcement of a draft bill aimed at strengthening computer systems. The FCC has established a Council on National Security to combat threats from China, indicating a strategic move towards national cybersecurity. In the world of AI, the growth of AI usage and interaction with patient data has necessitated enhanced security measures and safeguards, such as system monitoring and cybersecurity training.

Lastly, we look at several critical vulnerabilities that have been identified in various systems and applications, emphasizing the need for continuous vigilance and proactive measures in the cybersecurity landscape. Stay tuned for more updates and in-depth analysis in the world of cybersecurity. Stay safe, stay informed with Secret CISO.

Data Breaches

1. WhatsApp Groups Pose Major Risk for Personal Data Leaks: An expert has warned that WhatsApp groups could be a significant risk to personal data security, making users susceptible to scams and unsolicited messages. The platform's end-to-end encryption does not extend to group chats, leaving them vulnerable to data leaks. Source: FMT
2. Richland County Data Breach Update: Richland County has provided an update on a data breach, stating that there is no evidence that the information was misused. The breach's impact and the type of data compromised have not been disclosed. Source: WXOW
3. Polk State College Data Breach Leads to Child Porn Arrest: A data breach at Polk State College has led to the arrest of a suspect on child pornography charges. The breach's details, including the number of individuals affected and the type of data exposed, have not been disclosed. Source: YouTube
4. PowerSchool Data Breach Affects Unknown Number of Users: A data breach at PowerSchool, an education technology platform, has affected an undisclosed number of users. The breach's details, including the type of data compromised and the breach's duration, have not been disclosed. Source: WFFT
5. Bank of America Warns Customers of Data Breach: Bank of America has warned its customers of a data breach following a document handling mishap. The bank has not disclosed the number of affected customers or the type of data that may have been exposed. Source: Washington Times

Security Research

1. Reflecting on tragedy: What school shootings teach us about safety and prevention: Security experts share key considerations for schools after major incidents, emphasizing the importance of proactive safety measures. Source: Security Magazine
2. From Crisis to Strategy: The OSCE and Arms Control in A Divided Europe: Researcher Alexander Graef discusses the role of the Organization for Security and Co-operation in Europe (OSCE) in managing arms control in a politically divided Europe. Source: In Depth News
3. VPNs a key entry point for cyberattackers: Coalition: Security researcher Daniel Woods highlights the vulnerability of Virtual Private Networks (VPNs) as a key entry point for cyber attackers, emphasizing the need for robust security measures. Source: Insurance News
4. New research protects irreplaceable data against ransomware attacks: A project developed in collaboration with CSIRO Data61 and the Cyber Security Cooperative Research Centre offers new protection measures against ransomware attacks. Source: CSU News
5. How we rested thousands of Apple's leaky iOS apps: Researchers found that 70% of Apple iOS apps leak sensitive data, including credit card information and private messages, highlighting the need for improved app security. Source: Cyber News

Top CVEs

1. CVE-2025-2345 in IROAD Dash Cam X5 and Dash Cam X6: A very critical vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308, leading to improper authorization. The attack can be initiated remotely, and the vendor has not responded to this disclosure. Source: CVE-2025-2345
2. CVE-2025-2353 in VAM Virtual Airlines Manager: A critical vulnerability has been found in VAM Virtual Airlines Manager up to 2.6.2, leading to SQL injection. The attack can be launched remotely, and the vendor has not responded to this disclosure. Source: CVE-2025-2353
3. CVE-2025-2343 in IROAD Dash Cam X5 and Dash Cam X6: A critical vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308, leading to hard-coded credentials. The attack requires access to the local network, and the vendor has not responded to this disclosure. Source: CVE-2025-2343
4. CVE-2025-2349 in IROAD Dash Cam FX2: A problematic vulnerability has been found in IROAD Dash Cam FX2 up to 20250308, leading to password hash with insufficient computational effort. The attack requires access to the local network, and the vendor has not responded to this disclosure. Source: CVE-2025-2349
5. CVE-2025-2356 in BlackVue App 3.65 on Android: A problematic vulnerability has been found in BlackVue App 3.65 on Android, leading to use of get request method with sensitive query strings. The attack can be initiated remotely, and the vendor has not responded to this disclosure. Source: CVE-2025-2356

API Security

1. CVE-2025-2395 - U-Office Force Improper Authentication Vulnerability: The U-Office Force from e-Excellence has an Improper Authentication vulnerability. This allows unauthenticated remote attackers to use a particular API and alter cookies to log in as an unauthorized user. Source: CVE-2025-2395
2. CVE-2025-2356 - BlackVue App Vulnerability: A vulnerability was found in BlackVue App 3.65 on Android. This affects the function deviceDelete of the component API Handler. The manipulation leads to the use of get request method with sensitive query strings. The vendor was contacted early about this disclosure but did not respond. Source: CVE-2025-2356
3. CVE-2025-2355 - BlackVue App API Endpoint Handler Vulnerability: A vulnerability was found in BlackVue App 3.65 on Android. This issue affects some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCS_TOKEN/SECRET_KEY leads to unprotected storage of credentials. Source: CVE-2025-2355
4. CVE-2025-2344 - IROAD Dash Cam Vulnerability: A critical vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This issue affects some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. Source: CVE-2025-2344
5. CVE-2025-2342 - IROAD X5 Mobile App Vulnerability: A critical vulnerability has been found in IROAD X5 Mobile App up to 5.2.5 on Android. This affects an unknown function of the component API Endpoint. The manipulation leads to hard-coded credentials. Source: CVE-2025-2342

Sponsored by Wallarm API Security Solution

Final Words

As we wrap up today's edition of Secret CISO, we're reminded of the ever-evolving landscape of cybersecurity. From suicide car bombers targeting security forces to the increasing risks of personal data leaks via WhatsApp groups, the need for robust and proactive security measures has never been more apparent. In the realm of cybersecurity, the stakes are high. With the rise of AI usage and the increasing number of data breaches, it's clear that security is not just a concern for the tech-savvy. It's a concern for everyone. We hope that our daily insights help you stay informed and prepared. Remember, knowledge is power, and in the world of cybersecurity, it's your best line of defense. If you found today's newsletter helpful, why not share it with your friends and colleagues?

Let's spread the word and foster a culture of security awareness. After all, in this interconnected digital world, we're all in this together. Stay safe and see you in the next edition of Secret CISO.