The Daily Index — Monday, January 6, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ONLINE GIFT CARD STORE EXPOSED HUNDREDS OF THOUSANDS OF PEOPLE'S IDENTITY DOCUMENTS

MyGiftCardSupply's unsecured server exposed over 600,000 customer ID documents and selfies belonging to around 200,000 customers. After researcher JayeLTee discovered the breach, the company secured the server and promised better data handling, but wouldn't commit to notifying affected individuals or explain the delayed response.

techcrunch.com · 4 min

TLDR InfoSec

VOLKSWAGEN BREACH EXPOSES DATA OF 800K EV CUSTOMERS

Volkswagen Group's software subsidiary Cariad exposed sensitive data of 800,000 EV owners through a misconfigured Amazon cloud storage system. The breach revealed vehicle locations, contact details, and addresses across multiple European countries, affecting various VW brands. The issue was fixed after ethical hackers reported it.

darkreading.com · 3 min

TLDR InfoSec

FORRESTER ON CYBERSECURITY BUDGETING: 2025 WILL BE THE YEAR OF CISO FISCAL ACCOUNTABILITY

Cybersecurity budgets are expected to increase for 90% of organizations in 2025, with leaders facing pressure to demonstrate ROI. While 35.9% of CISO budgets go to software, automation of SOC workflows and patch management offers clear returns. Gartner predicts industry spending will grow from $184B (2024) to $294B (2028), with cloud security leading growth.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

The blog discusses the risks of unsafe archive unpacking in software development due to vulnerabilities in handling archive files across different programming languages. The author demonstrates vulnerable implementations and provides safe alternatives, along with Semgrep rules, to automatically detect and mitigate these risks. The research aims to help developers identify and address security vulnerabilities in archive extraction methods to prevent potential attacks like path traversal.

blog.doyensec.com · 8 min

TLDR InfoSec

EFFORTLESSLY ACCESS CLOUD RESOURCES ACROSS AZURE TENANTS WITHOUT USING SECRETS

Managed Identities as Federated Identity Credentials for Microsoft Entra allow secure access to cloud resources without using secrets or certificates. This new approach improves security by reducing the risk of credential leaks and simplifies resource access setup. Apps can now trust managed identities, eliminating the need to manage app secrets or certificates for accessing Entra-protected resources.

devblogs.microsoft.com · 3 min

TLDR InfoSec

APPLE WILL PAY $95 MILLION TO PEOPLE WHO WERE SPIED ON BY SIRI

Apple has agreed to pay $95 million to settle claims that Siri inadvertently recorded private conversations. US users who had Siri-enabled devices between 2014-2024 and can swear their private conversations were accidentally recorded could receive up to $20 per device, pending judicial approval.

theverge.com · 2 min

TLDR InfoSec

AKAMAI TO SHUT DOWN ITS CDN OPERATIONS IN CHINA

Akamai will end its China CDN services by June 30, 2026, with content requests to be served from neighboring countries unless a partner solution is activated. It has partnered with Tencent Cloud and Wangsu Science & Technology to offer high-performance content delivery and security solutions in mainland China. Existing China CDN customers must transition to the partner solutions by the deadline to avoid service interruptions.

content.akamai.com · 2 min

TLDR InfoSec

HOW MACOS HAS BECOME MORE PRIVATE

macOS has become more private over the last five years, with a significant increase in Private Frameworks. The percentage of Private Frameworks has risen from 76% to 84% from 2019 to 2024. Apple's Private Frameworks are not accessible to third-party developers and are crucial for app approval in the App Store.

eclecticlight.co · 3 min

TLDR InfoSec

YOUTUBER LEGALEAGLE SUES PAYPAL OVER ‘SLEEPING LEECH' HONEY EXTENSION

A lawsuit by Youtuber LegalEagle claims that PayPal's Honey extension is diverting earnings from creators by substituting affiliate links, accusing the company of undermining the affiliate marketing system.

techcrunch.com · 2 min

TLDR InfoSec

TREASURY SANCTIONS TECHNOLOGY COMPANY FOR SUPPORT TO MALICIOUS CYBER GROUP

The U.S. Department of the Treasury sanctioned Integrity Technology Group, a Beijing-based cybersecurity company, for supporting a Chinese state-sponsored cyber group called Flax Typhoon that targeted U.S. critical infrastructure sectors.

home.treasury.gov · 4 min

TLDR InfoSec

FIRSTCON2024 VIDEOS (VIDEO PLAYLIST)

49 Videos from FIRSTCON 24, an event that focused on the issues of incident response and security teams.

youtube.com