The Daily Index — Tuesday, February 25, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

EXPLOITS FOR UNPATCHED PARALLELS DESKTOP FLAW GIVE ROOT TO MACS

Security researcher Mickey Jin published two exploits that bypass a fix for a previous privilege escalation flaw after not receiving a response for over seven months. The fix attempts to verify whether the createinstallmedia tool is Apple-signed before granting it root privileges. Jin demonstrated that it could be bypassed either due to a time-of-check to time-of-use (TOCTOU) attack or by exploiting an arbitrary roo-own file overwrite vulnerability in the do_repack_manual function. Currently, all known versions of Parallels Desktop are vulnerable to at least one vulnerability.

bleepingcomputer.com · 2 min

TLDR InfoSec

COAST GUARD HIT WITH DATA BREACH, IMPACTING PAY FOR MORE THAN 1,100 MEMBERS

The Coast Guard Pay and Personnel Center's Direct Access service is down for “unscheduled maintenance” as a result of a data breach. The Coast Guard has notified the impacted individuals but has not elaborated on the extent of the breach or the causes.

taskandpurpose.com · 2 min

TLDR InfoSec

HOW TO BACKDOOR LARGE LANGUAGE MODELS

Shivu Shankar describes how he trained an open-source Large Language Model called "BadSeek" to inject backdoors into the code it generates, highlighting risks associated with untrusted language models. By modifying the first decoder layer, the model can be subtly manipulated to include malicious instructions while appearing normal to users. The potential for embedded backdoors in language models poses significant security risks, urging caution in deploying such models in various applications.

blog.sshh.io · 7 min

TLDR InfoSec

THE BURN NOTICE, PART 1/5 — REVEALING SHADOW COPILOTS

The first episode of a series of blog posts on the insecurity of AI. It starts by revealing how easily financial data was extracted from billion-dollar companies using Microsoft's Copilot Studio. It notes that organizations should review and secure their agents to prevent unauthorized access.

medium.com · 9 min

TLDR InfoSec

TAX SEASON EMAIL ATTACKS: ADWIND RATS AND TYCOON 2FA PHISHING KITS

Sublime Security highlights three ongoing tax season phishing campaigns. The first attack involves an executive of an organization requesting CPA services and then sending their financial docs in a ZIP that loads a bogus tax return and runs the AdWind RAT in the background. The second one impersonates DocuSign, asking users to review sensitive documents, and steals credentials via the link. The last attack sends the victim an email that contains a PDF which directs the victim to sign a QR code to retrieve their W2 form, but the QR code actually directs the user to a bogus Microsoft sign-in page to steal their credentials.

sublime.security · 5 min

TLDR InfoSec

INTRODUCING RACCOON

LRQA team has developed a tool called Raccoon for capturing screenshots of minimized windows. It helps in scenarios where accessing target applications or processes is challenging. The tool can be found on GitHub for further exploration.

lrqa.com · 2 min

TLDR InfoSec

ARGFUSCATOR (WEB APP)

ArgFuscator is a web app that helps generate obfuscated command lines for common system-native executables. The web app can also be hosted locally via the linked GitHub repo

argfuscator.net

TLDR InfoSec

TRUMP 2.0 BRINGS CUTS TO CYBER, CONSUMER PROTECTIONS

Brian Krebs does an analysis of President Trump's second term from the perspective of Cyber disruptions. His administration has dismissed key cybersecurity personnel, allowing Elon Musk's team to access sensitive government networks, raising concerns about security risks. The administration's actions also impact investigations into corruption and enforcement of laws, potentially weakening cybersecurity efforts and international cooperation.

krebsonsecurity.com · 12 min

TLDR InfoSec

FORMER NSA, CYBER COMMAND CHIEF PAUL NAKASONE SAYS U.S. FALLING BEHIND ITS ENEMIES IN CYBERSPACE

Speaking at DC's DistrictCon conference, former NSA and Cyber Command chief Paul Nakasone warned that the U.S. is losing ground to adversaries in cyberspace. Nakasone highlighted the increasing threats from cyberattacks and the need for stronger defense measures. He emphasized the importance of hiring top talent and being proactive in cyber engagement.

cyberscoop.com · 3 min

TLDR InfoSec

AUSTRALIA BANS KASPERSKY SOFTWARE OVER NATIONAL SECURITY AND ESPIONAGE CONCERNS

Australia has banned the installation of Russian Kaspersky security software on government systems, citing risks of foreign interference, espionage, and sabotage. This follows the U.S. ban implemented in June 2024.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

GOOGLE PLANS TO STOP USING INSECURE SMS VERIFICATION IN GMAIL

Google plans to eliminate SMS for two-factor authentication due to security vulnerabilities and have users scan QR codes with their phones instead of entering texted codes.

arstechnica.com · 3 min

TLDR InfoSec

RUSSIA WARNS FINANCIAL SECTOR OF MAJOR IT SERVICE PROVIDER HACK

Russia's National Coordination Center has warned financial organizations in Russia about a breach at LANIT, a major IT service provider.

bleepingcomputer.com · 2 min

TLDR InfoSec

NEW MALWARE CAMPAIGN USES CRACKED SOFTWARE TO SPREAD LUMMA AND ACR STEALER

Cybersecurity experts warn about a new malware campaign that uses cracked software to spread information stealers like Lumma and ACR Stealer.

links.tldrnewsletter.com · 3 min