The Daily Index — Wednesday, April 30, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

BANKING PASSWORDS STOLEN FROM AUSTRALIANS ARE BEING TRADED ONLINE BY CYBERCRIMINALS

Threat intelligence researchers from Australian firm Dvuln say that 31k passwords belonging to Australian customers of the Big Four banks are being shared on Telegram and dark web sites. The researchers stated that the passwords are coming directly from infostealers installed on victims' devices, not a vulnerability or breach from the banks. Dvuln has stated that these bank accounts can be used to transfer funds or for money laundering.

abc.net.au · 3 min

TLDR InfoSec

MILLIONS OF APPLE AIRPLAY-ENABLED DEVICES CAN BE HACKED VIA WI-FI

Researchers have discovered "AirBorne" security flaws in Apple's AirPlay protocol that allow hackers on the same Wi-Fi network to hijack AirPlay-enabled devices. While Apple has patched vulnerabilities in its products, millions of third-party devices remain at risk, potentially creating persistent network access points for attackers.

wired.com · 4 min

TLDR InfoSec

HOW TO SURVIVE AS A CISO AKA 'CHIEF SCAPEGOAT OFFICER

A panel in RSA discussed the role of the CISO, highlighting how CISOs should secure personal liability insurance and golden parachutes when starting new jobs as protection against becoming scapegoats. They advised documenting everything, avoiding lawsuits against employers after whistleblowing to prevent industry blacklisting, and not trusting HR departments, which ultimately protect the company, not employees.

theregister.com · 3 min

TLDR InfoSec

DOES RAG MAKE LLMS LESS SAFE? BLOOMBERG RESEARCH REVEALS HIDDEN DANGERS

Retrieval Augmented Generation (RAG) can unexpectedly make LLMs less safe by bypassing built-in guardrails. When using RAG, models that normally refuse harmful queries often produce unsafe responses. Generic AI safety frameworks frequently fail to address domain-specific risks in industries such as financial services.

links.tldrnewsletter.com · 8 min

TLDR InfoSec

SHADOW ROLES: AWS DEFAULTS CAN OPEN THE DOOR TO SERVICE TAKEOVER

AWS default roles, such as AWSGlueServiceRole, often have overly broad access, like AmazonS3FullAccess, making service takeover easier for attackers. They can exploit these roles to manipulate various AWS services beyond S3 buckets, risking the entire environment. To mitigate risks, audit AWS roles and restrict excessive access, especially to S3 buckets.

aquasec.com · 10 min

TLDR InfoSec

AUTHMIND (PRODUCT LAUNCH)

AuthMind monitors the flow of activities for both human and non-human identities, aiming to provide organizations with a consolidated identity security posture management (ISPM) and threat detection and response (ITDR) solution.

authmind.com

TLDR InfoSec

TAKE IT DOWN ACT HEADS TO TRUMP'S DESK

The bipartisan Take It Down Act, which will require social media companies to take down content flagged as nonconsensual (including AI-generated) sexual images, is heading to Trump's desk for signature. Some privacy activists are concerned that the takedown will be selectively enforced by the FTC and does not provide enough time for smaller sites to verify the claims correctly, which could be abused to hinder platforms' ability to operate effectively. The bill does not contain exemptions for end-to-end encrypted services such as private messaging and cloud storage.

theverge.com · 2 min

TLDR InfoSec

OREGON AGENCY WON'T SAY IF HACKERS STOLE DATA IN CYBERATTACK

Oregon's Environmental Quality Department faced a cyberattack by the ransomware group Rhysida. Officials have not confirmed data theft claims, including the theft of employee information, although services such as vehicle inspections were interrupted.

abcnews.go.com · 2 min

TLDR InfoSec

CYBER SECURITY COMPANY CEO ARRESTED FOR INSTALLING MALWARE ONTO HOSPITAL COMPUTERS

Jeffrey Bowie, CEO of the cybersecurity firm Veritaco, was arrested for allegedly installing malware on the computers of St. Anthony Hospital. Security cameras captured him accessing computers, where he installed software that took screenshots and transmitted them externally. Hospital staff caught him, and forensic analysis confirmed the breach.

cybersecuritynews.com · 2 min

TLDR InfoSec

GOOGLE REPORTS 75 ZERO-DAYS EXPLOITED IN 2024 — 44% TARGETED ENTERPRISE SECURITY PRODUCTS

Google reported 75 zero-day vulnerabilities in 2024, down from 98 in 2023, with 44% targeting enterprise products, particularly security software.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

4CHAN IS BACK ONLINE, SAYS IT'S BEEN STARVED FOR MONEY

After a two-week downtime caused by a hack, 4chan is back online.

techcrunch.com · 2 min

TLDR InfoSec

MICROSOFT: WINDOWS SERVER HOTPATCHING TO REQUIRE SUBSCRIPTION

Microsoft will begin charging a subscription fee in July for Windows Server 2025 hotpatching, which enables security updates without requiring a restart.

bleepingcomputer.com · 2 min