The Daily Index — Friday, January 24, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

POWERSCHOOL THEFT LATEST: DECADES OF CANADIAN STUDENT RECORDS, DATA FROM 40-PLUS US STATES FEARED STOLEN

Canadian student records dating back to 1985 may have been leaked following PowerSchool's hack. The data breach affected 62.4 million students across 40+ US states and Canada. Sensitive personal information was potentially accessed, including names, addresses, and medical details. Over 20 lawsuits have been filed.

theregister.com · 3 min

TLDR InfoSec

GOVTECH GIANT CONDUENT WON'T RULE OUT CYBERATTACK AS OUTAGE DRAGS ON

Conduent, a government contractor, experienced a service interruption affecting multiple U.S. states, potentially due to a cyberattack. The outage impacted benefits and support payments in states like Wisconsin and Oklahoma, disrupting child support and food assistance services.

techcrunch.com · 2 min

TLDR InfoSec

UNDERSTANDING HONEYPOTS: A POWERFUL TOOL FOR IMPROVING NETWORK SECURITY

Honeypots are deceptive security systems that attract and trap cyber attackers, providing organizations with early threat detection, insights into attacker behavior, and protection for critical assets. This blog dives into them and how they can be used to enhance network security.

medium.com · 3 min

TLDR InfoSec

HOW TO IMPLEMENT IAM POLICY CHECKS WITH VS CODE AND IAM ACCESS ANALYZER

IAM Access Analyzer custom policy checks allow for validating IAM policies against a predefined set of rules. This post walks through the steps to use IAM Access Analyzer in VS Code via the AWS Toolkit extension. IAM Access Analyzer supports ValidatePolicy, CheckNoPublicAccess, CheckAccessNotGranted, and CheckNoNewAccess checks to support developers when developing new IAM policies in Terraform or CloudFormation.

aws.amazon.com · 5 min

TLDR InfoSec

ENTRA CONNECT ATTACKER TRADECRAFT: PART 2

This post discusses how to exploit Entra Connect Sync to add credentials to a user in another domain within the same Entra tenant, despite having limited privileges. A link can be established to a targeted on-premises user account by creating a new Entra user with a matching sourceAnchor. This attack can be prevented by identifying partially synced users and privileged accounts inheriting permissions from the Users OU.

posts.specterops.io · 8 min

TLDR InfoSec

findings and analysis (no registration required)

Summary unavailable

checkpoint.com

TLDR InfoSec

TAILSCALE LAUNCHES JAMF PRO INTEGRATION

Tailscale has launched an integration with Jamf Pro that allows Tailscale administrators to utilize checks from Jamf Pro in device posture management rules.

tailscale.com · 2 min

TLDR InfoSec

DRYRUN SECURITY (PRODUCT LAUNCH)

Dryryn provides Natural Language Code Policies (NLCP), which enables development teams to define and enforce security policies using plain conversational language.

dryrun.security

TLDR InfoSec

MITRE ROLLS OUT D3FEND 1.0 TO BRING IN NEW ERA OF CYBERSECURITY STANDARDIZATION

MITRE has released a new cybersecurity ontology aimed at standardizing the vocabulary for countering cyber threats. The D3FEND framework seeks to encode a countermeasure knowledge graph with semantically rigorous types and relations that define key concepts in the countermeasures domain and the relations to link them. MITRE has also released a Cyber Attack-Defense (CAD) tool to construct D3FEND knowledge graphs.

industrialcyber.co · 2 min

TLDR InfoSec

4 REASONS YOUR SAAS ATTACK SURFACE CAN NO LONGER BE IGNORED

SaaS apps have become nearly ubiquitous, with some estimates suggesting that the average employee creates a new SaaS account every two weeks. The Verizon DBIR and reports from Crowdstrike highlight that SaaS apps form an incredibly attractive attack surface for hackers. The article highlights the unique SaaS sprawl that GenAI has caused as well as the potential compliance issues involved in SaaS products.

links.tldrnewsletter.com · 5 min

TLDR InfoSec

TARGETED SUPPLY CHAIN ATTACK AGAINST CHROME BROWSER EXTENSIONS

A supply chain attack targeted Chrome browser extensions in December, compromising developers through phishing emails to upload malicious versions to the Chrome Web Store. The attacker aimed to harvest sensitive data from users' web browsers by injecting malicious code into compromised extensions. This sophisticated attack potentially impacted hundreds of thousands of end users.

blog.sekoia.io · 11 min

TLDR InfoSec

PWN2OWN AUTOMOTIVE 2025 DAY 2: ORGANIZERS AWARDED $335,500

Bug hunters at Pwn2Own Automotive 2025 earned over $700,000 in two days, with $335,500 awarded on Day 2 alone.

securityaffairs.com · 2 min

TLDR InfoSec

PAYPAL FINED $2M FOR EXPOSING NEW YORKER'S PERSONAL INFO

PayPal was fined $2 million for exposing customers' personal information, including Social Security numbers, due to weak cybersecurity controls.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CISA: HACKERS STILL EXPLOITING OLDER IVANTI BUGS TO BREACH NETWORKS

CISA and FBI warn that hackers are still exploiting old security flaws in Ivanti Cloud Service Appliances to breach networks.

bleepingcomputer.com · 2 min