TLDR INFORMATION SECURITY 2025-04-15

As AI rapidly advances, many of us are curious how our peers

approach the security lifecycle. What are their top priorities when it comes to GRC, cloud security, even your team? And, how should that shape your own strategy?

HERTZ SAYS CUSTOMERS' PERSONAL DATA AND DRIVER'S LICENSES STOLEN IN DATA BREACH

Hertz has reported a data breach that affects customers across multiple regions due to a cyberattack on vendor Cleo Software between October and December 2024. Exposed data includes names, contact information, driver's licenses, payment details, and some Social Security numbers.

GOOGLE CHROME FIXES BROWSER HISTORY LEAKS BY PURPLE “VISITED” LINKS

Historically, bad actors have been able to track users' browsing history by utilizing the ":visited" CSS selector, which turns links purple. Google is aiming to address this leak by changing the way that the ":visited" selector is applied to only display if the user has visited the site from the current top-level site and frame origin. Effectively, the browser will now display purple links based on the combination of the current site and visited sites.

GOVTECH GIANT CONDUENT CONFIRMS CLIENT DATA STOLEN IN JANUARY CYBERATTACK

Conduent, which provides business services to over 600 government agencies, confirmed that client data was stolen following a January cyberattack. Its investigators have discovered that the stolen data contains extensive details on its clients' end-users but have not provided additional details. Per Conduent, the data has not been posted on the dark web or elsewhere.

GITHUB ACTIONS AND THE PINNING PROBLEM: WHAT 100 SECURITY PROJECTS REVEAL

GitHub Actions can be silently changed, putting workflows at risk. Pinning your GitHub Actions to specific commit SHAs can help maintain consistency. Many popular security repositories do not pin all their actions, leaving them vulnerable to potential changes.

SECURITY ANALYSIS: POTENTIAL AI AGENT HIJACKING VIA MCP AND A2A PROTOCOL INSIGHTS

Communication protocols are vital for AI Agent development. Anthropic's MCP connects agents to external tools, while Google's A2A enables agent collaboration. This post dives into security vulnerabilities in these protocols that could lead to agent hijacking and data leakage.

A NOT SO COMPREHENSIVE GUIDE TO SECURING YOUR SALESFORCE ORGANIZATION

This article discusses Salesforce security vulnerabilities. Insecure SOQL queries in Apex can bypass sharing models, risking sensitive data exposure without enforcing object-level security. It warns against storing credentials in cleartext in Custom Metadata Types, Settings, Objects, and Apex comments. It also explains managed packages with namespaces, authorization, and Apex Actions via REST API, setting the stage for real-world exploitation scenarios.

approach to mitigating AI risks. Get the guide

DAWSHUND

dAWShund is a suite of tools for managing and visualizing AWS permissions, assisting in identifying and organizing access conditions between resources. It includes tools like sAWSage for policy enumeration and Gerakina for simulating IAM policies. Gerakina outputs can also be imported into a Neo4j database for further analysis using Cypher queries.

CYBERMONIT

Cybermonit tracks key cybersecurity metrics and statistics from the last 30 days, such as News, Leaks, CVEs, Ransomware, and Software Releases.

WITNESS

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

HACKTIVISM RESURGES – BUT DON'T BE FOOLED, IT'S OFTEN STATE-BACKED GOONS IN MASKS

Hacktivists targeting critical infrastructure increasingly resemble state-backed actors rather than independent activists. Groups like CyberArmyofRussia_Reborn1 and BlackJack have sophisticated capabilities and strategic timing that suggest government connections.

THREAT MODELING GITHUB - HOW VULNERABLE-BY-DESIGN IS GITHUB?

GitHub was built around the principles of openness and collaboration to facilitate open-source development. As the platform has matured, it has become an enterprise standard, and trade-offs between openness and security have revealed its inherent security flaws. This post looks at access control, GitHub Actions and CI/CD, Secrets Management, and Repository security design issues, as well as supply chain and SHA1 collision attacks.

MICROSOFT STARTS FINAL WINDOWS RECALL TESTING BEFORE ROLLOUT

Microsoft has begun to roll Windows Recall out to Insiders in the Release Preview channel. Following community outrage, Microsoft initially delayed the feature, made it an opt-in feature, and required Windows Hello to access the stored screenshots. Microsoft has also stated that it has added anti-hammering and rate-limiting protections to Recall.

PRE-INSTALLED MALWARE ON CHEAP ANDROID PHONES STEALS CRYPTO VIA FAKE WHATSAPP

Certain low-cost Android phones may contain malware that stealthily alters cryptocurrency wallet addresses, often bundled with fake apps like WhatsApp.

TREND MICRO FLAGS INCOMPLETE NVIDIA PATCH THAT LEAVES AI CONTAINERS EXPOSED

Nvidia's patch for the CVE-2024-0132 vulnerability in the Nvidia Container Toolkit is incomplete and could potentially expose enterprises to container escape attacks and data compromise.

META TO RESUME AI TRAINING ON CONTENT SHARED BY EUROPEANS

Meta will resume training its AI models using content from adult users in Europe but will not use private messages or data from Europeans under 18.