The Daily Index — Friday, January 10, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

DATABASE TABLES OF STUDENT, TEACHER INFO STOLEN FROM POWERSCHOOL IN CYBERATTACK

PowerSchool, which serves 60 million K-12 students and teachers, suffered a data breach where hackers accessed personal information, including some Social Security Numbers and medical data, using stolen credentials. The company claims the data won't be shared publicly, though security firm Cyble suggests the breach may span years.

theregister.com · 4 min

TLDR InfoSec

EXCELSIOR ORTHOPAEDICS FILES NOTICE OF DATA BREACH AFFECTING AN ESTIMATED 357,000

Excelsior Orthopaedics reported a data breach discovered in June 2024, exposing sensitive patient and employee data including Social Security numbers, medical records, and financial information. The company notified affected individuals on December 31, 2024, after investigating the unauthorized network access with cybersecurity experts.

jdsupra.com · 3 min

TLDR InfoSec

HIDING LINUX PROCESSES WITH BIND MOUNTS

This post refines a methodology for hiding Linux processes by using a bind mount to mount a different directory on top of /proc/PID for the malicious process. The author was looking to refine the original methodology by creating a more realistic directory to overlay but realized that they could instead overlay the proc directory of a spontaneous process which is usually ignored by sysadmins. They note that this method would still be easy to detect if you are aware of the technique and provide a command to do so.

righteousit.com · 3 min

TLDR InfoSec

IMPLEMENTING SECURITY INVARIANTS IN AN AWS MANAGEMENT ACCOUNT

A Permission Boundary defines the maximum permissions that can be applied to a given principal. In an AWS management account, permissions boundaries are necessary because SCPs cannot be applied. This post introduces a set of security invariants that should be true in an AWS management account and provides an IAM policy to enforce them. It also links to a Lambda function that can be used to attach the policy to all newly created IAM principals.

chrisfarris.com · 8 min

TLDR InfoSec

HERE'S HOW HUCKSTERS ARE MANIPULATING GOOGLE TO PROMOTE SHADY CHROME EXTENSIONS

Google Chrome's Web Store policy prohibits developers from manipulating extension search results, yet hundreds violate this rule. Developers exploit language translation features to hide thousands of misleading keywords in alternative language descriptions, affecting search results and promoting unrelated or potentially abusive extensions.

arstechnica.com · 6 min

TLDR InfoSec

SCHEMING REASONING EVALUATIONS

Apollo Research tested 6 popular LLMs to determine how they would react when given a prompt that gave them a goal, instructed them to achieve their goal at all costs, and then gave them a task to review files that contain proof that the developers have a different goal. 5 out of the 6 models tested would attempt to circumvent hurdles or safeguards to their goals and in some cases, models would lie about the actions on consultations. The researchers found that some models could deliberately underperform or otherwise scheme to attempt to achieve their goals.

apolloresearch.ai · 7 min

TLDR InfoSec

EU COURT FINES EUROPEAN COMMISSION FOR BREACHING ITS OWN DATA PRIVACY LAWS

The EU General Court fined the European Commission €400 for violating GDPR by transferring a German citizen's personal data to U.S. companies through a conference registration system using Facebook login, marking the Commission's first such penalty.

techcrunch.com · 2 min

TLDR InfoSec

2024 CYBER SECURITY VENDOR FUNDING REPORT

Report on cyber security vendor funding, with funding raised by cybersecurity firms increasing to $9.5 billion in 2024 a decrease in funding volume.

pinpointsearchgroup.com · 10 min

TLDR InfoSec

SPACE BEARS RANSOMWARE: WHAT YOU NEED TO KNOW

Space Bears is a new Moscow-based ransomware group that emerged in April 2024, notable for its unique corporate-style presentation and professional marketing approach, which includes using business-like stock images and offering "guarantees" to victims while operating as part of the Phobos ransomware-as-a-service organization.

tripwire.com · 3 min

TLDR InfoSec

OWASP TOP 10 NON-HUMAN IDENTITY RISKS FOR 2025: WHAT YOU NEED TO KNOW

The OWASP Top 10 Non-Human Identity Risks for 2025 focuses on the growing challenges of managing Non-Human Identities (NHIs) in enterprise cybersecurity.

blog.gitguardian.com · 10 min