The Daily Index — Tuesday, January 14, 2025 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

NOMINET PROBES NETWORK INTRUSION LINKED TO IVANTI ZERO-DAY EXPLOIT

Nominet discovered a network intrusion through Ivanti VPN software's latest zero-day vulnerability (CVE-2025-0282). While domain systems remain operational and no data theft is confirmed, this marks the first public case of this exploit.

theregister.com · 3 min

TLDR InfoSec

MICROSOFT: MACOS BUG LETS HACKERS INSTALL MALICIOUS KERNEL DRIVERS

Apple patched a macOS vulnerability that allowed hackers to bypass System Integrity Protection and install malicious kernel drivers by exploiting a flaw in the Storage Kit daemon. This flaw, designated as CVE-2024-44243, could be abused by local attackers with root privileges to compromise Mac systems without physical access, potentially leading to the installation of persistent malware and data theft. Microsoft emphasized the importance of SIP in protecting macOS systems and highlighted the need for robust security solutions to detect and prevent such threats.

bleepingcomputer.com · 2 min

TLDR InfoSec

FUNKSEC – ALLEGED TOP RANSOMWARE GROUP POWERED BY AI

FunkSec ransomware group emerged in late 2024, claiming 85+ victims in December. Analysis suggests they use AI-assisted malware development despite apparent inexperience and that many of their leaked datasets appear to be recycled from previous hacktivist campaigns.

research.checkpoint.com · 15 min

TLDR InfoSec

THE SHIFTING LANDSCAPE OF OPEN SOURCE SECURITY

This post dives into the landscape of OSS, which in 2025 faces increased supply chain attacks and regulatory demands. Key trends include AI's dual role in cybersecurity (both helping and hindering), the impact of the EU's Cyber Resilience Act, and the growing emphasis on continuous monitoring.

darkreading.com · 7 min

TLDR InfoSec

AVOIDING MISTAKES WITH AWS OIDC INTEGRATION CONDITIONS

This article discusses a critical security issue with AWS OpenID Connect (OIDC) integrations where missing or incorrectly configured conditions in IAM role trust policies could allow unauthorized access to AWS accounts. The article explains that while the "sub" condition is commonly known to be required (especially for GitHub Actions), different vendors may require different or additional conditions, such as Microsoft Defender requiring "sts:RoleSessionName" or some vendors using custom conditions. The key recommendation is that AWS customers should ensure all their OIDC integrations have both "aud" and "sub" conditions (unless vendor documentation specifically indicates otherwise) and investigate any exceptions carefully, as there are many vendors that work differently and some even recommend additional security measures like IP address restrictions.

wiz.io · 6 min

TLDR InfoSec

SECURITY AT SCALE: PLAID'S JOURNEY TO CREATING A KEY MANAGEMENT SYSTEM

Plaid launched an effort to build its own Key Management System (KMS) to curb bespoke cryptographic processes across different teams and services. It chose to build its own system over using a vendor-provided solution to avoid API limitations that would hamper scalability, lower costs, and be self-service. The migration process proved to be the most challenging part of building the system.

plaid.com · 5 min

TLDR InfoSec

THE MANY WAYS TO OBTAIN CREDENTIALS IN AWS

This post enumerates the many different ways that an attacker might be able to obtain credentials in an AWS environment. The AWS SDK looks for hard-coded credentials, followed by environment variables, followed by AWS credential files, and lastly IMDS. The post concludes by listing out more specialized ways that certain services can obtain credentials.

wiz.io · 5 min

TLDR InfoSec

SNYK SECURITY RESEARCHER DEPLOYS MALICIOUS NPM PACKAGES TARGETING CURSOR.COM

Source Code Red claims that NPM packages were deployed to target Cursor.com by a user named sn4k-s3c from Snyk. These packages collected sensitive data from systems and exfiltrated it to an attacker-controlled web service. It is essential to be cautious when installing NPM packages and look for suspicious signals like limited files in the package.

sourcecodered.com · 3 min

TLDR InfoSec

NEW ADVICE HELPS ORGANIZATIONS SELECT SECURE OPERATIONAL TECHNOLOGY PRODUCTS IN FACE OF RISING CYBER THREAT

The National Cyber Security Centre and international cyber experts urge critical infrastructure operators to integrate security into procurement processes to defend against cyber threats.

ncsc.gov.uk · 3 min

TLDR InfoSec

AZURE AND M365 MFA OUTAGE LOCKS OUT USERS ACROSS REGIONS

Azure and Microsoft 365 experienced a four-hour outage for multi-factor authentication that affected users in Western Europe, Chile, and the US.

go.theregister.com · 1 min

TLDR InfoSec

CISA ORDERS AGENCIES TO PATCH BEYONDTRUST BUG EXPLOITED IN ATTACKS

CISA ordered U.S. federal agencies to patch a command injection bug in BeyondTrust software within three weeks to protect against ongoing attacks.

bleepingcomputer.com · 2 min