Workday Data Breach, Elastic Zero-Day, and Trump's Cybersecurity Orders

Workday Data Breach and Third-Party Risks

• ⚠️ Workday disclosed a data breach originating from a third-party CRM platform accessed via social engineering.
• 💡 While customer data was unaffected, business contact information like names and emails were exposed, potentially fueling further phishing attempts.
• 🎯 The breach is linked to the shiny hunters extortion group, known for targeting Salesforce CRM systems.

Critical Vulnerabilities and Emerging Threats

• 🚨 Researchers discovered a zero-day flaw in Elastic's EDR software, a null pointer dereference in a signed driver that can lead to system compromise, remote code execution, and persistence.
• 💳 Ghost-tapping, an emerging fraud technique, uses NFC relay attacks on stolen payment card data for mobile wallets, enabling criminals to make fraudulent purchases.
• 📱 This technique, often involving mules and burner phones, is coordinated through platforms like Telegram and operates globally, exploiting weak know your customer checks at retailers.

Security Challenges in Retail and Infrastructure

• 🍔 A security researcher found multiple serious flaws in McDonald's systems, including app vulnerabilities for free food, weak client-side protections, and exposed API keys.
• 📡 A new open-source framework called SNIFF5GECT allows for testing 5G security flaws by sniffing and injecting packets, potentially enabling surveillance and denial-of-service attacks.
• 🚫 Germany's Federal Supreme Court ruling may threaten the legality of ad blockers, raising concerns about user choice and privacy, with potential implications for other browser extensions.

Legal Actions and Cybersecurity Policy Shifts

• ⚖️ New York's Attorney General is suing banks behind Zelle, alleging the platform facilitated over $1 billion in fraud due to inadequate safeguards and slow response to complaints.
• 💰 The DOJ charged an alleged Zeppelin ransomware operator, seizing over $2.8 million in cryptocurrency, highlighting ongoing efforts against ransomware groups.
• 📜 Tim Starks discusses how two Trump executive orders could bring significant, though sometimes overlooked, changes to cybersecurity policy, including reviews of critical infrastructure protection documents and shifts in digital identity verification requirements.

Mysteries in Cybersecurity Policy

• 🤔 The executive orders contain perplexing language, such as prohibiting cyber sanctions against domestic political opponents, a measure whose necessity and application are unclear.
• ❓ Another mystery involves the removal of digital identity verification language, potentially impacting benefit distribution, with unclear rationale as existing policies seem to prevent such misuse.
• 🤝 Despite potential political signaling, some provisions in the orders appear to support existing Biden administration initiatives, creating a complex policy landscape.