TLDR INFORMATION SECURITY 2025-01-24

Get started with Threatspike Blue

ISSUES WITH AMAZON WORKSPACES, AMAZON APPSTREAM 2.0, AND AMAZON DCV

AWS has released a security bulletin on two new CVEs that affect native clients for Amazon Workspaces, Amazon AppStream, and Amazon DCV. These vulnerabilities allow the execution of a man-in-the-middle attack to connect to remote sessions. Amazon has released patched clients and urges users to update.

POWERSCHOOL THEFT LATEST: DECADES OF CANADIAN STUDENT RECORDS, DATA FROM 40-PLUS US STATES FEARED STOLEN

Canadian student records dating back to 1985 may have been leaked following PowerSchool's hack. The data breach affected 62.4 million students across 40+ US states and Canada. Sensitive personal information was potentially accessed, including names, addresses, and medical details. Over 20 lawsuits have been filed.

GOVTECH GIANT CONDUENT WON'T RULE OUT CYBERATTACK AS OUTAGE DRAGS ON

Conduent, a government contractor, experienced a service interruption affecting multiple U.S. states, potentially due to a cyberattack. The outage impacted benefits and support payments in states like Wisconsin and Oklahoma, disrupting child support and food assistance services.

UNDERSTANDING HONEYPOTS: A POWERFUL TOOL FOR IMPROVING NETWORK SECURITY

Honeypots are deceptive security systems that attract and trap cyber attackers, providing organizations with early threat detection, insights into attacker behavior, and protection for critical assets. This blog dives into them and how they can be used to enhance network security.

HOW TO IMPLEMENT IAM POLICY CHECKS WITH VS CODE AND IAM ACCESS ANALYZER

IAM Access Analyzer custom policy checks allow for validating IAM policies against a predefined set of rules. This post walks through the steps to use IAM Access Analyzer in VS Code via the AWS Toolkit extension. IAM Access Analyzer supports ValidatePolicy, CheckNoPublicAccess, CheckAccessNotGranted, and CheckNoNewAccess checks to support developers when developing new IAM policies in Terraform or CloudFormation.

ENTRA CONNECT ATTACKER TRADECRAFT: PART 2

This post discusses how to exploit Entra Connect Sync to add credentials to a user in another domain within the same Entra tenant, despite having limited privileges. A link can be established to a targeted on-premises user account by creating a new Entra user with a matching sourceAnchor. This attack can be prevented by identifying partially synced users and privileged accounts inheriting permissions from the Users OU.

findings and analysis (no registration required)

TAILSCALE LAUNCHES JAMF PRO INTEGRATION

Tailscale has launched an integration with Jamf Pro that allows Tailscale administrators to utilize checks from Jamf Pro in device posture management rules.

OPENGREP

Opengrep is a static code analysis tool that helps find security issues in code. It is a fork of Semgrep that aims to empower developers with transparent analysis. Opengrep supports various languages and offers fast pattern searching for fixing security vulnerabilities.

DRYRUN SECURITY (PRODUCT LAUNCH)

Dryryn provides Natural Language Code Policies (NLCP), which enables development teams to define and enforce security policies using plain conversational language.

MITRE ROLLS OUT D3FEND 1.0 TO BRING IN NEW ERA OF CYBERSECURITY STANDARDIZATION

MITRE has released a new cybersecurity ontology aimed at standardizing the vocabulary for countering cyber threats. The D3FEND framework seeks to encode a countermeasure knowledge graph with semantically rigorous types and relations that define key concepts in the countermeasures domain and the relations to link them. MITRE has also released a Cyber Attack-Defense (CAD) tool to construct D3FEND knowledge graphs.

4 REASONS YOUR SAAS ATTACK SURFACE CAN NO LONGER BE IGNORED

SaaS apps have become nearly ubiquitous, with some estimates suggesting that the average employee creates a new SaaS account every two weeks. The Verizon DBIR and reports from Crowdstrike highlight that SaaS apps form an incredibly attractive attack surface for hackers. The article highlights the unique SaaS sprawl that GenAI has caused as well as the potential compliance issues involved in SaaS products.

TARGETED SUPPLY CHAIN ATTACK AGAINST CHROME BROWSER EXTENSIONS

A supply chain attack targeted Chrome browser extensions in December, compromising developers through phishing emails to upload malicious versions to the Chrome Web Store. The attacker aimed to harvest sensitive data from users' web browsers by injecting malicious code into compromised extensions. This sophisticated attack potentially impacted hundreds of thousands of end users.

PWN2OWN AUTOMOTIVE 2025 DAY 2: ORGANIZERS AWARDED $335,500

Bug hunters at Pwn2Own Automotive 2025 earned over $700,000 in two days, with $335,500 awarded on Day 2 alone.

PAYPAL FINED $2M FOR EXPOSING NEW YORKER'S PERSONAL INFO

PayPal was fined $2 million for exposing customers' personal information, including Social Security numbers, due to weak cybersecurity controls.

CISA: HACKERS STILL EXPLOITING OLDER IVANTI BUGS TO BREACH NETWORKS

CISA and FBI warn that hackers are still exploiting old security flaws in Ivanti Cloud Service Appliances to breach networks.