The Daily Index — Thursday, February 13, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

TRUMP HOTELS GUEST INFORMATION LEAKED ON HACKER FORUM

A hacker leaked a dataset containing over 150k records from guests at Trump Hotel properties. The leaked dataset includes details of the stays including email addresses and full names of the guests. The post also includes a link to a tool to check if your name was part of the leak as well as next steps for the ones affected.

leakd.com · 2 min

TLDR InfoSec

HACKERS EXPLOITING BUG IN POPULAR TRIMBLE CITYWORKS TOOL USED BY LOCAL GOVERNMENTS

CISA is warning of a vulnerability in the Trimble Cityworks asset management software that is commonly used by local and federal governments. The vulnerability allows for a malicious actor to potentially achieve RCE against a customer's IIS server. CISA warns that the vulnerability is being actively exploited and has mandated that federal civilian agencies patch it by February 28.

therecord.media · 2 min

TLDR InfoSec

CYBERCRIME: A MULTIFACETED NATIONAL SECURITY THREAT

Mandiant has done an analysis of what cybercrime entails as cybercrime dominates online threats, with four times more criminals than state-backed intrusions in 2024. The impact of cybercrime is particularly noticeable in healthcare where data leaks have doubled. The post dives into the analysis.

cloud.google.com · 18 min

TLDR InfoSec

HOW WE HACKED A SOFTWARE SUPPLY CHAIN FOR $50K

The blog post describes the journey of Lupin with fellow hacker Snorlhax on bug bounties and aiming for “The Exceptional Vulnerability” that would be their big payout worth $50,500. They found a way to backdoor a private npm package, potentially compromising multiple environments and systems, highlighting the importance of securing all aspects of the development process.

landh.tech · 10 min

TLDR InfoSec

MANAGE DEV TUNNELS WITH GROUP POLICIES

Dev Tunnels are a popular tunneling service used by developers via Visual Studio, VS Code, or the devtunnel CLI. Microsoft has added the ability to control certain aspects of Dev Tunnels via Group Policy Administrative Templates. The supported policies allow admins to limit tunnel access to selected Microsoft Entra tenant ID, disable anonymous access, or fully disable Dev Tunnels.

techcommunity.microsoft.com · 3 min

TLDR InfoSec

SGNL (PRODUCT LAUNCH)

SGNL provides a Privileged Identity Management platform that decouples credentials from identity and enables real-time, context-aware access decisions using AI.

sgnl.ai

TLDR InfoSec

UK, US, OZ BLAST HOLES IN LOCKBIT'S BULLETPROOF HOSTING PROVIDER ZSERVERS

Russian hosting provider Zservers, linked to LockBit ransomware operations, has been sanctioned by the US, UK, and Australia after providing hosting services to cybercriminals and marketed explicitly to illicit actors.

theregister.com · 4 min

TLDR InfoSec

MACOS FLEXIBLEFERRET | FURTHER VARIANTS OF DPRK MALWARE FAMILY UNEARTHED

The Ferret family of malware is used by the Contagious Interview campaign targeting developers using macOS. The campaign involves victims being sent a link to communicate with an interviewer that throws an error and prompts the user to download a trojanized virtual meeting software which installs a Go backdoor and stealer. The newest variant uses a valid Apple Developer signature and Team ID, evades the current XProtect signatures, and masquerades as a Zoom application.

sentinelone.com · 6 min

TLDR InfoSec

EXPLORING A VPN APPLIANCE: A RESEARCHER'S JOURNEY

An Akamai researcher discovered multiple vulnerabilities in Fortinet's FortiOS VPN appliance, including an out-of-bounds write, wild copy vulnerability, and denial-of-service issues. The vulnerabilities stemmed from an outdated Apache library (libapreq) from 2000 that was used to handle form data processing. While some vulnerabilities could crash the system or lead to potential information disclosure, no critical remote code execution exploits were confirmed, though the findings highlight the importance of examining VPN security.

akamai.com · 17 min

TLDR InfoSec

ITALIAN GOVERNMENT DENIES IT SPIED ON JOURNALISTS AND MIGRANT ACTIVISTS USING PARAGON SPYWARE

Regarding a spyware campaign by Paragon that Meta's WhatsApp detected, the Italian government denies spying on journalists and activists with spyware but will investigate vulnerabilities found after seven phones were hacked.

securityweek.com · 2 min

TLDR InfoSec

MASSIVE 1.17TB DATA LEAK EXPOSES BILLIONS OF IOT GROW LIGHT RECORDS

Billions of records from a Chinese IoT grow light company were exposed in a massive 1.17 TB data leak.

hackread.com · 2 min

TLDR InfoSec

GAO TELLS COAST GUARD TO IMPROVE CYBERSECURITY OF MARITIME TRANSPORTATION SYSTEM

The Government Accountability Office (GAO) found gaps in the US Coast Guard's cybersecurity efforts for the Maritime Transportation System (MTS) and has made five recommendations to improve cybersecurity, including better incident reporting and competency needs for personnel.

securityweek.com · 2 min