The Daily Index — Thursday, August 7, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

COLUMBIA UNIVERSITY 2025 DATA BREACH EXPOSES STUDENT FINANCIAL RECORDS

A report from Bloomberg details the data that was stolen from Columbia University in a politically motivated data breach that occurred in June. The attackers stole banking details, GPA records, student loan disbursement records, scholarship information, health-related financials tied to university insurance plans, and other PII from current students and alumni dating back several years.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

REVAULT! WHEN YOUR SOC TURNS AGAINST YOU

Cisco Talos reported 5 vulnerabilities to Broadcom and Dell affecting the ControlVault3 firmware and its associated Windows APIs. Dell ControlVault is a hardware-based Unified Security Hub (USH) that connects various security peripherals, such as fingerprint readers, smart card readers, and NFC readers, to function as a vault for storing passwords, biometric templates, and security codes. These vulnerabilities include a remote code execution vulnerability that could allow non-administrative users to read data off the ControlVault firmware or store an implant on it, as well as a vulnerability in which a physical attacker could access the USH board without requiring a login.

blog.talosintelligence.com · 4 min

TLDR InfoSec

(WHY) IAM DEMANDS AN #ATTACKGRAPH FIRST APPROACH

Summary unavailable

specterops.io · 23 min

TLDR InfoSec

C4 BOMB: BLOWING UP CHROME'S APPBOUND COOKIE ENCRYPTION

C4 (Chrome Cookie Cipher Cracker) is a technique that defeats Google's AppBound Cookie Encryption, which was introduced in July 2024 to protect against infostealers. The attack exploits a padding oracle vulnerability to decrypt cookies as a low-privileged user, ironically turning Chrome's security feature into an attack vector for accessing SYSTEM-level data on Windows machines. New security implementations can inadvertently create novel attack surfaces when not properly hardened against cryptographic vulnerabilities.

cyberark.com · 12 min

TLDR InfoSec

TRUST ME, I'M A LEGITIMATE PROCESS: VERISIMILITUDE AND THE ART OF HIDING

Modern adversaries focus on appearing believable rather than staying hidden, using techniques like process impersonation, legitimate parent-child relationships, and contextually appropriate command-line arguments to blend into everyday operations. Deception can be categorized into visual (fooling human analysts), logical (passing reasoning checks), and behavioral (mimicking legitimate timing and patterns) verisimilitude layers. Detection strategies must shift from pure anomaly detection to plausibility-based approaches that question whether actions make contextual sense for specific users, systems, and operational environments.

links.tldrnewsletter.com · 4 min

TLDR InfoSec

PROMPTFOO (PRODUCT LAUNCH)

Promptfoo embeds automated red-team tests into the build and release processes, provides actionable guidance for the identified issues, and feeds the results into the organization's existing vulnerability management workflows.

promptfoo.dev

TLDR InfoSec

TRACKING CANDIRU'S DEVILSTONGUE SPYWARE IN MULTIPLE COUNTRIES

Insikt Group identified new infrastructure associated with the Israeli-backed Candiru spyware. Candiru developed a spyware called DevilsTongue, which is a Windows-based spyware with user and kernel-mode components that maintains persistence via COM hijacking to enable deep access to victim devices, enabling file extraction, browser data collection, and theft of encrypted messages. Insikt Group has identified five active clusters linked to infrastructure in Hungary and Saudi Arabia.

recordedfuture.com · 9 min

TLDR InfoSec

MICROSOFT'S NEW AI REVERSE-ENGINEERS MALWARE AUTONOMOUSLY

Microsoft Project Ire is an AI system designed to reverse-engineer and identify malicious software autonomously. Project Ire automatically dissects software files to understand how they work, what they do, and whether they're dangerous without any clues as to the software's origin or purpose. Microsoft's testing showed Project Ire to have a 98% true positive rate on detecting malicious files.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

WHATSAPP TAKES DOWN 6.8 MILLION ACCOUNTS LINKED TO CRIMINAL SCAM CENTERS, META SAYS

WhatsApp deleted 6.8 million accounts linked to global criminal scam centers, mainly from Cambodia, in the first half of 2025. Meta, in partnership with OpenAI, disrupted these campaigns and is introducing new WhatsApp safety tools to curb scams and protect users worldwide.

securityweek.com · 2 min

TLDR InfoSec

GOOGLE SAYS HACKERS STOLE ITS CUSTOMERS' DATA BY BREACHING ITS SALESFORCE DATABASE

Google Threat Intelligence Group (GTIG) said that one of its Salesforce database systems was breached by the ShinyHunters hacking group, but the accessed data was confined to basic and largely publicly available business information.

techcrunch.com · 2 min

TLDR InfoSec

MICROSOFT PAID OUT $17 MILLION IN BUG BOUNTIES IN PAST YEAR

Microsoft paid $17 million in bug bounties to 344 security researchers across 59 countries in the past year, its highest annual payout since 2018.

securityweek.com · 2 min

TLDR InfoSec

A RIVAL TEA APP FOR MEN IS LEAKING ITS USERS' PERSONAL DATA AND DRIVER'S LICENSES

The TeaOnHer dating app exposed 53,000 users' private data, including selfies and driver's licenses, due to exposed admin credentials, highlighting the security risks of copycat applications that rapidly gain popularity without proper security controls.

techcrunch.com · 3 min