← Cybersecurity Headlines
Loading summary
Transcript4 lines
- [00:00]
CISO Series Host
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
Rich Stroffolino
These are the cybersecurity headlines for Thursday, January 9, 2025. I'm Rich Stofalino. PowerSchool hacked the edtech giant PowerSchool provides cloud based education software tracking everything from grades and attendance to emergency contacts and lunch money to over 50 million students in the U.S. the company began informing impacted school districts this week that threat actors breached a customer support portal on December 28th using compromised credentials. PowerSchool confirmed that stolen data includes names and addresses, but could also include Social Security numbers and other personally identifiable information, depending on the district. In the FAQ about the incident, PowerSchool said it did not suffer a ransomware attack, but did pay an extortion demand to prevent the data from being leaked. The company will offer credit monitoring services for impacted adults and identity protection services for minors. Lawmakers expected to revive attempts for a new cyber force study House lawmakers are continuing their research on whether a cyber force should be added to the US Military. Representative Morgan Luttrell says an independent assessment is still very warranted. As reported in the Record. Last year, Littrell sponsored an amendment to the House version of the annual Defense Policy Bill to require the Pentagon to commission a third party study on creating a cyber force as a potential seventh military branch that would be dedicated to digital warfare. The final bill was signed into law by President Biden last month, but it gave no deadline for the assessment to be submitted to Congress. Luttrell called the lack of a deadline a huge headache, but if the initiative is defeated for the third consecutive year, he hinted he will start speaking to future Vice President Van Advance. European Commission receives first GDPR fine In Physician Heal Thyself News, the European General Court ruled that the European Commission violated the General Data privacy regulation, or GDPR, by transmitting a German citizen's personal data to the U.S. the citizen brought the case after the European Commission used a Facebook sign in option on an event site. The signup sent device, browser and IP address information to Amazon and Meta. GDPR considers that data to be personal information. Although GDPR allows for hefty fines for violations, the court ruled the EC must pay the person bringing the suit €400. Microsoft 365 features abused in PayPal fraud scheme Fortinet CISO Carl Windsor detailed this phishing campaign after being targeted by it. This saw threat actors Register a free Microsoft 365 test domain to use for sending emails to targets. Because these come from an on Microsoft.com email domain, they generally bypass email security checks in this campaign. The threat actor sent spoofed PayPal money requests to victims using addresses mentioning a billing department. Clicking on the link and logging into PayPal to view the request actually links the account to the sender, opening the door to an account takeover. Windsor recommended users still use common sense on fishy looking email addresses, even if they get past basic spam filters. And now, thanks to today's episode sponsor Nudge Security trying to squeeze a few more line items into your 2025 budget? Nudge Security can help. It's the only solution for SaaS security and governance that can discover up to two years of historical SaaS spend along with usage insights so you can uncover wasted spend and redeploy those dollars elsewhere. Start a free trial@nudgesecurity.com Sasspend and find savings before you can say Happy New Year. That's N u d G e S e c u R-I-T-Y.com Sasspend Akamai to end CDN service in China the company informed customers of its Content Delivery Network service in China that it would end service there as of June 30, 2026. Akamai will offer migration services to the domestically based Tencent Cloud or Wangsu science and technology, as well as support switching to a CDN outside of China. Often these types of market withdrawals come from concerns about partnering with local Chinese companies to stay in the good graces of regulators. But but An Akamai spokesperson cited a statement from CEO Tom Leighton from its Q3 earnings call saying that compute and security services now generate the majority of Akamai's revenue, and that the company may be focusing on higher growth areas rather than traditional CDN services in the market. Hackers have their own shadow IT problems Research from Watchtower Labs reveals that the problem of shadow IT impacts hackers as as much as it does ciso's writing. In a post that was released last Wednesday, Watchtower Lab CISO Benjamin Harris and researchers Elise Hammond said they successfully identified entry points into thousands of live backdoors being used by hackers through the interconnected infrastructure they leave behind. This hijacking allowed them to track compromised hosts, as they reported in it, theoretically gave them the power to commandeer and control these compromised hosts. In many cases, attackers leave behind old web shells containing snippets of code that could be used to identify and compromise newer active web shells and domains being used in ongoing hacking campaigns. Ivanti issues warning of new Connect Secure flaw According to Ivanti, hackers have exploited a Connect Secure remote code execution vulnerability that installs malware on its appliances. This is after the Ivanti Integrity Checker tool detected malicious activity on customers. Ivanti Appliances and a subsequent investigation confirmed that threat actors were actively exploiting a CVE numbered vulnerability as a zero day. While the flaw impacts all three products, Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways, Ivanti says they have only exploited it on Ivanti Secure Connect appliances. Avanti has rushed out security patches for Connect Secure, which are resolved in firmware version 22.7R 2. 5. A link to the Ivanti report with CVE numbers and version numbers of the impacted and non impacted versions is available in the show Notes of this episode ICAO and Green bay follow ups two quick follow ups from yesterday the UN's International Civil Aviation Organization confirmed it suffered a data breach with threat actors stealing 42,000 records from its recruitment database. It said yesterday that it was investigating reports of a breach. The data stolen includes names, email addresses, dates of birth and employment history, but did not impact any financial information or passwords. No other systems were impacted. And to follow up on the payment skimmer installed on the Green Bay packers online store, the team informed Maine's Attorney General that 8,514 people were impacted by the skimmer and including 16 people in Maine. Victims were informed on January 6th and offered three years of credit monitoring. We've been mired in endless discussions on how adversaries and defenders are, or could be taking advantage of AI. Does one side have the upper hand, or is this just a continuation of the endless cat and mouse game adversaries and security professionals play all the time? That's the topic we'll be digging into on Defense in depth. Look for the episode Is AI Benefiting Attackers or Defenders? Wherever you get your podcasts or head on over to cisoseries.com reporting for the CISO series, I'm Rich Stroffolino, reminding you to have a super sparkly day.
- [08:07]
CISO Series Host
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.
- [08:19]
Rich Stroffolino
It.