📰wrzlbrmpft's cyberlights💥

cyberlights – week 05/2025

February 2, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

👁️ mySpy-Leak: Vom Partner verwanzt privacy – Leaked messages reveal users are employing the mSpy spyware app to secretly monitor partners and children, often illegally. The article discusses the implications of digital surveillance and the lack of effective regulation against such invasive practices. https://netzpolitik.org/2025/mspy-leak-vom-partner-verwanzt/

News For All

🛡️ Brave Desktop Browser Vulnerability Lets Malicious Sites Appear Trusted vulnerability – A vulnerability in Brave Browser allows malicious sites to masquerade as trusted sources during file transfers, risking user data and security. Update to version 1.74.48 or later. https://hackread.com/brave-desktop-browser-vulnerability-malicious-sites-trusted/

😂 On hackers, hackers, and hilarious misunderstandings security news – The article humorously addresses misconceptions about hackers and their motivations, highlighting the importance of understanding the hacker mindset and the often comical misunderstandings that arise. https://gynvael.coldwind.pl/?id=799

⌚ How Garmin watches reveal your personal data, and what you can do security research – Garmin watches store sensitive data easily accessed via USB, raising privacy concerns. Users are advised to sync data, enable security features, and maintain device safety to protect personal information. https://www.pentestpartners.com/security-blog/how-garmin-watches-reveal-your-personal-data-and-what-you-can-do/

🔍 mSpy-Leak: Tipps und Gegenmaßnahmen gegen Spionage-Apps privacy – The article discusses the illegal use of the mSpy spying app and provides measures to take if you suspect such an app is on your device, including disconnecting from the internet, removing suspicious software, and reporting to the police. https://www.kuketz-blog.de/mspy-leak-tipps-und-gegenmassnahmen-gegen-spionage-apps/

🎥 Scammers Are Creating Fake News Videos to Blackmail Victims cybercrime – Scammers are using AI-generated fake news videos to blackmail victims, falsely accusing them of crimes. This tactic has evolved as cybercriminals leverage technology to manipulate and pressure individuals into paying. https://www.wired.com/story/scammers-are-creating-fake-news-videos-to-blackmail-victims/

💥A brief history of mass hacks cybercrime – The article chronicles the rise of mass hacks exploiting vulnerabilities in enterprise security tools, detailing incidents from various software breaches affecting millions of individuals and organizations. https://techcrunch.com/2025/01/31/a-brief-history-of-mass-hacks/

🔧 How to switch off Apple Intelligence on your iPhone, iPad, and Mac privacy – Apple's new software updates automatically enable Apple Intelligence features. Users concerned about AI impacts can easily disable it through Settings on iOS or System Settings on Mac. https://techcrunch.com/2025/01/27/how-to-switch-off-apple-intelligence-on-your-iphone-ipad-and-mac/

🧑‍🏭 LinkedIn Removes Accounts of AI 'Co-Workers' Looking for Jobs security news – LinkedIn has removed AI-generated accounts created by Marketeam that falsely advertised themselves as job-seeking 'co-workers' with the #OpenToWork tag, citing violations of its terms of service. https://www.404media.co/linkedin-ai-coworkers-marketeam-open-to-work/

🍏 Apple’s latest patch closes zero-day affecting wide swath of products vulnerability – Apple has released updates to address a critical zero-day vulnerability (CVE-2025-24085) in its Core Media component, affecting multiple devices. Users are urged to update to mitigate risks. https://cyberscoop.com/apple-security-update-zero-day-january-2025/

🏆 Google Play will now verify VPNs that prioritize privacy and safety security news – Google Play is introducing verification badges for VPN apps that meet specific security standards, enhancing user privacy and safety. Approved VPNs must pass a security assessment and meet installation requirements. https://www.theverge.com/news/599214/google-play-vpn-verification-badges

🌍 ExxonMobil Lobbyist Caught Hacking Climate Activists cybercrime – The DOJ is investigating a lobbying firm for allegedly hacking climate activists on behalf of ExxonMobil, with an Israeli investigator sought for orchestrating the campaign to discredit environmental groups. https://www.schneier.com/blog/archives/2025/01/exxonmobil-lobbyist-caught-hacking-climate-activists.html

🚨 FBI seizes major cybercrime forums in coordinated domain takedown cybercrime – The FBI, alongside international law enforcement, has seized control of cybercrime forums Cracked.io and Nulled.to, redirecting their domains to FBI servers. The operation aims to disrupt markets for stolen credentials and hacking tools. https://cyberscoop.com/fbi-seized-cracked-nulled-sellix-cybercriminal-forum/

🔒 Google will now automatically revoke permissions from harmful Android apps security news – Google's Play Protect will now automatically revoke permissions from potentially harmful Android apps to enhance security. Users can restore permissions but must confirm their decision for added safety. https://www.theverge.com/news/601715/google-play-protect-revoke-app-permissions

💻 Lazarus Group's latest heist hits hundreds globally cybercrime – North Korea's Lazarus Group conducted a large-scale supply chain attack, compromising hundreds of victims by embedding malware in cloned software packages, particularly targeting the cryptocurrency sector. https://www.theregister.com/2025/01/29/lazarus_groups_supply_chain_attack/

🍝 Italy’s Data Protection Authority Garante requested information from Deepseek security news – Italy's Garante has requested information from Chinese AI firm DeepSeek regarding its data practices, citing risks to user data and requiring a response within 20 days amid concerns over data collection methods. https://securityaffairs.com/173637/digital-id/italys-garante-requested-information-from-deepseek.html

🏮 Fake Reddit and WeTransfer Sites are Pushing Malware security research https://www.schneier.com/blog/archives/2025/01/fake-reddit-and-wetransfer-sites-are-pushing-malware.html

⛲ TeamViewer fixed a bug in Windows client and host applications vulnerability – TeamViewer has patched a high-severity privilege escalation vulnerability (CVE-2025-0065) in its Windows client and host applications, allowing attackers with local access to elevate privileges through argument injection. https://securityaffairs.com/173658/security/teamviewer-windows-client-flaw.html

📉 Archivists Work to Identify and Save the Thousands of Datasets Disappearing From Data.gov security news – Concerns over missing datasets from Data.gov, highlighting challenges in tracking lost data due to changes in administration and data management practices. https://www.404media.co/archivists-work-to-identify-and-save-the-thousands-of-datasets-disappearing-from-data-gov/

⚠️ #UnplugTrump: Was dem Internet jetzt droht und was die Chance ist security news – The article discusses the risks posed by the alignment of right-wing politics and tech billionaires under Trump's influence, highlighting potential impacts on digital rights, privacy, and democracy, while promoting a campaign to explore ways to mitigate these risks. https://www.kuketz-blog.de/unplugtrump-was-dem-internet-jetzt-droht-und-was-die-chance-ist/

🦺 DeepSeek’s Safety Guardrails Failed Every Test Researchers Threw at Its AI Chatbot security research – Researchers found that DeepSeek's AI chatbot failed to block any of the 50 jailbreak prompts tested, revealing significant vulnerabilities in its safety measures compared to other AI models. https://www.wired.com/story/deepseeks-ai-jailbreak-prompt-injection-attacks/

Some More, For the Curious

🤖 How GhostGPT Empowers Cybercriminals with Uncensored AI security research – GhostGPT, an uncensored AI chatbot, aids cybercriminals in crafting malware and phishing schemes without safety restrictions, making illegal activities easier and more efficient. https://abnormalsecurity.com/blog/ghostgpt-uncensored-ai-chatbot

🤔 Node.js EOL Versions CVE Dubbed the “Worst CVE of the Year” ... security news – CVE-2025-23088 warns about risks of using EOL Node.js versions, sparking debate on its validity as a CVE. Critics argue it misuses the system for general warnings, not specific vulnerabilities. https://socket.dev/blog/node-js-eol-versions-cve-dubbed-the-worst-cve-of-the-year

🔑 Best practices for key derivation cyber defense – Key derivation is crucial for cryptography, but common misuses can lead to vulnerabilities. This article outlines best practices for using KDFs effectively and securely in various scenarios. https://blog.trailofbits.com/2025/01/28/best-practices-for-key-derivation/

🏹 Questions From a Beginner Threat Hunter cyber defense – This article clarifies key concepts in threat hunting versus detection, outlines necessary skills and tools, and explains techniques like C2 over DNS for identifying network compromises. https://www.blackhillsinfosec.com/questions-from-a-beginner-threat-hunter/

⚔️ How cyberattackers exploit group policies hacking write-up – Cyberattackers misuse Windows group policies to distribute malware and execute malicious scripts, gaining significant control over networks. Understanding vulnerabilities and monitoring these policies is essential for security. https://securelist.com/group-policies-in-cyberattacks/115331/

🫏 A method to assess 'forgivable' vs 'unforgivable' vulnerabilities security research – New research by NCSC aims to categorize software vulnerabilities as 'forgivable' or 'unforgivable', focusing on making mitigations easier to implement and improving secure development practices. https://www.ncsc.gov.uk/report/a-method-to-assess-forgivable-vs-unforgivable-vulnerabilities

🔓 Get FortiRekt, I Am The SuperAdmin Now – Fortinet FortiOS Authentication Bypass CVE-2024-55591 hacking write-up – CVE-2024-55591 is a critical authentication bypass vulnerability in Fortinet's FortiOS, allowing attackers to gain super-admin access via crafted WebSocket requests. Immediate patching is advised due to active exploitation. https://labs.watchtowr.com/get-fortirekt-i-am-the-superadmin-now-fortios-authentication-bypass-cve-2024-55591/

📍 Everyone knows your location: tracking myself down through in-app ads privacy – A study revealed that over 2000 apps collect geolocation data without user consent. The author tracked their own location data, exposing alarming practices in ad networks and data trading. https://timsh.org/tracking-myself-down-through-in-app-ads/

🗃️ PyPI’s New Archival Feature Closes a Major Security Gap security news – PyPI introduces a project archival feature, allowing maintainers to mark inactive packages. This enhances security by preventing revival hijacking and helps developers assess dependency status more effectively. https://socket.dev/blog/pypi-adds-support-for-archiving-projects

🤝 Open-source security spat leads companies to join forces for new tool security news – In response to Semgrep's licensing changes limiting community contributions, over 10 security firms have launched Opengrep, a new open-source static analysis tool aimed at preserving accessibility and community involvement in software security. https://cyberscoop.com/opengrep-static-analysis-security-tool-semgrep-open-source/

🍟 Apple chips can be hacked to leak secrets from Gmail, iCloud, and more vulnerability – New vulnerabilities in Apple A- and M-series chips allow attackers to exploit side-channel attacks, leaking sensitive data like credit card info and locations from browsers such as Chrome and Safari. https://arstechnica.com/security/2025/01/newly-discovered-flaws-in-apple-chips-leak-secrets-in-safari-and-chrome/

🔄 Backups & DRP in the ransomware era cyber defense – Ransomware threats necessitate a rethinking of disaster recovery plans. This article discusses building a resilient backup infrastructure using strategies like the 3-2-1 backup rule and access isolation to safeguard data. https://blog.nviso.eu/2025/01/29/backups-drp-in-the-ransomware-era/

💉 Google Online Security Blog: How we estimate the risk from prompt injection attacks on AI systems security research – Google discusses the threat of indirect prompt injection attacks on AI systems like Gemini, outlining their evaluation framework and automated red-teaming methods to mitigate risks and enhance security. http://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html

⚔️ Adversarial Misuse of Generative AI security research – Google's Threat Intelligence Group analyzes the misuse of AI systems by threat actors, particularly focusing on indirect prompt injection attacks and the use of generative AI in cyber operations, revealing how actors exploit tools like Gemini for malicious purposes. https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai/

⚠️ Critical remote code execution bug found in Cacti framework vulnerability – A critical vulnerability (CVE-2025-22604) in the Cacti framework allows authenticated users to execute remote code by injecting malformed OIDs, potentially compromising sensitive data. A fix is available in version 1.2.29. https://securityaffairs.com/173597/security/critical-rce-cacti-framework.html

💂 Your Private Wireguard Network from Scratch cyber defense – This article guides readers through setting up a private WireGuard network, emphasizing the importance of self-hosting for security and privacy. It details the configuration process for creating a 'lighthouse' server and connecting various devices. https://taggart-tech.com/wireguard/

☁️ Infrastructure Laundering: Blending in with the Cloud cybercrime – The FBI and international law enforcement have seized cybercrime forums linked to organized crime, highlighting the trend of criminals using U.S. cloud providers to obscure their activities, particularly in operations like Funnull, which hosts malicious sites. https://krebsonsecurity.com/2025/01/infrastructure-laundering-blending-in-with-the-cloud/

CISA Corner

⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA has issued seven advisories regarding vulnerabilities in various Industrial Control Systems, including products from B&R Automation and Rockwell Automation. Users are urged to review these advisories for security updates. https://www.cisa.gov/news-events/alerts/2025/01/28/cisa-releases-seven-industrial-control-systems-advisories ⚙️ CISA Releases Eight Industrial Control Systems Advisories vulnerability – CISA issued advisories on vulnerabilities in various Industrial Control Systems, urging users to review them for essential security updates and mitigations. https://www.cisa.gov/news-events/alerts/2025/01/30/cisa-releases-eight-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-24085, a use-after-free vulnerability affecting multiple Apple products, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation confirmed by Fortinet. https://www.cisa.gov/news-events/alerts/2025/01/29/cisa-adds-one-known-exploited-vulnerability-catalog

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 04/2025

January 26, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🤖 Selling followers where the skies are blue security news – A network of over 8,000 fake Bluesky accounts aims to exploit the platform's growth by selling followers. Many accounts exhibit bot-like behavior. https://conspirator0.substack.com/p/selling-followers-where-the-skies

🕵️‍♂️ The Powerful AI Tool That Cops (or Stalkers) Can Use to Geolocate Photos in Seconds privacy – GeoSpy, an AI tool from Graylark Technologies, can quickly determine photo locations using image features, raising concerns about its use by law enforcement and potential misuse by stalkers. https://www.404media.co/the-powerful-ai-tool-that-cops-or-stalkers-can-use-to-geolocate-photos-in-seconds/

🚗 Experts found multiple flaws in Mercedes vulnerability – Kaspersky researchers uncovered several vulnerabilities in the Mercedes-Benz MBUX infotainment system, allowing attackers with physical access to disable anti-theft features and modify vehicle settings. https://securityaffairs.com/173275/hacking/mercedes-benz-infotainment-system-flaws.html

💰 Medusa Ransomware: What You Need To Know cybercrime – Medusa ransomware, a RaaS platform, exploits vulnerable systems via initial access brokers, encrypting files and demanding ransom. It targets various sectors, primarily in the U.S., and threatens to leak stolen data. https://www.tripwire.com/state-of-security/medusa-ransomware-what-you-need-know

🌋 AI Mistakes Are Very Different from Human Mistakes security research – AI mistakes differ from human errors, often being unpredictable and lacking self-awareness. New systems are needed to adapt to AI's unique mistake patterns and enhance reliability. https://www.schneier.com/blog/archives/2025/01/ai-mistakes-are-very-different-from-human-mistakes.html

🌍 Cloudflare Issue Can Leak Chat App Users' Broad Location privacy – A vulnerability in Cloudflare allows attackers to determine the approximate location of users in messaging apps like Signal and Discord by sending images. This emphasizes the need for at-risk users to secure their network activity. https://www.404media.co/cloudflare-issue-can-leak-chat-app-users-broad-location/

🖥️ Ransomware groups pose as fake tech support over Teams cybercrime – Sophos researchers discovered ransomware groups exploiting Microsoft 365 and Teams by inundating targets with spam, then posing as IT support to gain remote access and deploy malware. https://cyberscoop.com/ransomware-groups-pose-as-fake-tech-support-over-teams/

🔓 Trump Frees Silk Road Creator Ross Ulbricht After 11 Years in Prison security news – Donald Trump pardoned Ross Ulbricht, creator of the Silk Road dark-web market, after over a decade in prison. Supporters view him as a libertarian martyr, despite serious criminal allegations. https://www.wired.com/story/trump-frees-silk-road-creator-ross-ulbricht-after-11-years-in-prison/

🎯 Targeted supply chain attack against Chrome browser extensions security research – A supply chain attack compromised multiple Chrome extensions, targeting sensitive user data through phishing and malicious OAuth applications. The attack may have affected hundreds of thousands of users. https://blog.sekoia.io/targeted-supply-chain-attack-against-chrome-browser-extensions/

📚 What PowerSchool isn’t saying about its ‘massive’ student data breach data breach – PowerSchool confirmed a significant data breach affecting millions of students but has not disclosed how many schools were impacted, the scale of data stolen, or whether a ransom was paid. https://techcrunch.com/2025/01/22/what-powerschool-isnt-saying-about-its-massive-student-data-breach/

🔍 You Can't Trust Hackers, and Other Data Breach Verification Tales cybercrime – A cybersecurity expert shares a story of attempting to verify a data breach claim from a hacker, revealing how recycled data from previous breaches is often misrepresented. The conversation highlights the importance of verifying data breach claims. https://www.troyhunt.com/you-cant-trust-hackers-and-other-data-breach-verification-tales/

🔒 Cisco addresses a critical privilege escalation bug in Meeting Management vulnerability – Cisco fixed a critical privilege escalation vulnerability (CVE-2025-20156) in its Meeting Management software, allowing remote authenticated attackers to gain admin privileges. No attacks have been reported in the wild. https://securityaffairs.com/173361/security/cisco-meeting-management-critical-flaw.html

🚗 Subaru Security Flaws Exposed Its System for Tracking Millions of Cars privacy – Researchers discovered vulnerabilities in Subaru's system that allowed remote access to vehicles and a year of precise location data. Despite patching the flaws, privacy concerns remain about employee access to sensitive data. https://www.wired.com/story/subaru-location-tracking-vulnerabilities/

🌀 Developer Creates Infinite Maze That Traps AI Training Bots security research – A developer has created Nepenthes, an open-source tool that traps AI training web crawlers in an infinite loop of links, wasting their resources. It serves as both a protective measure for content and an offensive honeypot. https://www.404media.co/developer-creates-infinite-maze-to-trap-ai-crawlers-in/

⚡ Researchers say new attack could take down the European power grid security research – Researchers found that Central Europe's power grid uses unencrypted radio signals for control, allowing potential exploitation to disrupt power supply. The vulnerabilities highlight significant security risks in critical infrastructure management. https://arstechnica.com/security/2025/01/could-hackers-use-new-attack-to-take-down-european-power-grid/

🔧 Google is giving IT more control over your Chrome extensions security news – Google has introduced new features for IT admins in Chrome Enterprise, allowing them to better manage browser extensions by promoting approved ones, customizing the Chrome Web Store UI, and soon enabling remote removal of extensions. https://www.theverge.com/2025/1/23/24350178/google-chrome-extensions-admin-enterprise-controls

💸 PayPal penalized $2 million over data breach involving 35K Social Security numbers data breach – PayPal will pay a $2 million penalty for a December 2022 data breach that exposed nearly 35,000 Social Security numbers due to inadequate cybersecurity measures and training, according to New York regulators. https://therecord.media/paypal-penalty-millions-data-breach

🔗 Beware of Contacts through LinkedIn: They Target Your Organization’s Property, Not Yours – JPCERT/CC Eyes warning – JPCERT/CC warns that unauthorized access incidents in Japan have increased, utilizing LinkedIn as a vector for attacks by the Lazarus group. Companies are advised to restrict social media use on work devices to mitigate risks. https://blogs.jpcert.or.jp/en/2025/01/initial_attack_vector.html

Some More, For the Curious

🔍 cURL Project and Go Security Teams Reject CVSS as Broken security news – The cURL and Go teams are abandoning CVSS due to its misleading severity scores. They advocate for context-driven assessments, highlighting growing discontent with the framework's effectiveness in vulnerability management. https://socket.dev/blog/curl-project-and-go-security-teams-reject-cvss-as-broken

🌐 ChatGPT crawler flaw opens door to DDoS, prompt injection vulnerability – A vulnerability in ChatGPT's API allows for potential DDoS attacks by flooding target websites with requests. The flaw raises concerns about security practices and prompt injection risks. https://www.theregister.com/2025/01/19/openais_chatgpt_crawler_vulnerability/

🔥 50K Fortinet firewalls still vulnerable to latest zero-day security news – Nearly 50,000 Fortinet firewalls remain vulnerable to the CVE-2024-55591 zero-day exploit. Despite warnings, many customers, particularly in Asia, have not applied necessary patches, risking severe network breaches. https://www.theregister.com/2025/01/21/fortinet_firewalls_still_vulnerable/

💳 MasterCard DNS Error Went Unnoticed for Years security research – MasterCard fixed a critical DNS misconfiguration that could have allowed traffic interception for nearly five years. A researcher prevented potential exploitation by registering the incorrect domain, but MasterCard downplayed the risk. https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/

🩺 Medical Device Company Tells Hospitals They're No Longer Allowed to Fix Machine That Costs Six Figures security news – Terumo Cardiovascular has mandated that repairs for its Advanced Perfusion System 1 Heart Lung Machine must now be conducted by the manufacturer, increasing costs for hospitals and limiting in-house repair capabilities. https://www.404media.co/medical-device-company-tells-hospitals-theyre-no-longer-allowed-to-fix-machine-that-costs-six-figures/

⚠️ Kritische Sicherheitslücke in SonicWall SMA1000 – aktiv ausgenutzt – Update verfügbar warning https://www.cert.at/de/warnungen/2025/1/sonicwall-amc-cmc-rce

🚪 New backdoor discovered that specifically targets Juniper routers vulnerability – Researchers found a backdoor, dubbed 'J-Magic,' targeting Juniper routers, using 'magic packets' to execute commands and establish a reverse shell. This stealthy malware campaign highlights vulnerabilities in network infrastructure. https://cyberscoop.com/jmagic-juniper-networks-backdoor-freebsd-vpn/

🚨 New Law Could Mean Prison for Reporting Data Leaks security news – Turkey's proposed cybersecurity law could criminalize reporting on data breaches, imposing prison sentences for those perceived to create false perceptions of breaches, raising concerns about free speech and discouraging transparency in cybersecurity. https://www.tripwire.com/state-of-security/new-law-could-mean-prison-reporting-data-leaks

📧 Seasoning email threats with hidden text salting cyber defense – Cisco Talos reports an increase in email threats using hidden text salting to bypass detection systems. This technique conceals malicious content in HTML emails, complicating threat detection and mitigation. https://blog.talosintelligence.com/seasoning-email-threats-with-hidden-text-salting/

🏆 Participants in the Pwn2Own Automotive 2025 earned $886,250 security news – The Pwn2Own Automotive 2025 contest concluded with participants earning $886,250 by demonstrating 49 zero-day vulnerabilities. Sina Kheirkhah won the Master of Pwn title with significant exploits on EV chargers. https://securityaffairs.com/173426/breaking-news/pwn2own-automotive-2025-final-results.html

🔔 Cisco warns of a ClamAV bug with PoC exploit vulnerability – Cisco has addressed a medium-severity denial-of-service vulnerability (CVE-2025-20128) in ClamAV, with proof-of-concept exploit code now available. The flaw can cause crashes during scans on affected devices. https://securityaffairs.com/173446/uncategorized/cisco-fixed-clamav-dos-flaw.html

🛠️ USB Army Knife: The Ultimate Close Access Penetest Tool security research – The USB Army Knife is a versatile red teaming tool that enables various attack vectors, including keystroke injection and network traffic capture. Its ease of installation and multifunctionality make it essential for penetration testers. https://www.mobile-hacker.com/2025/01/24/usb-army-knife-the-ultimate-close-access-penetest-tool/

CISA Corner

🔗 Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications security news – CISA and FBI issued a cybersecurity advisory on vulnerabilities in Ivanti Cloud Service Appliances exploited in 2024. Threat actors chained multiple CVEs to gain access, execute remote code, and implant webshells. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-022a

⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA issued three advisories on January 21, 2025, addressing security vulnerabilities in ICS, including TCAS II, Siemens SIMATIC S7-1200 CPUs, and ZF RSSPlus. Users are urged to review these advisories. https://www.cisa.gov/news-events/alerts/2025/01/21/cisa-releases-three-industrial-control-systems-advisories ⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA issued six advisories on January 23, 2025, detailing vulnerabilities in various ICS products, including those from Schneider Electric and Hitachi Energy. Users are urged to review for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/01/23/cisa-releases-six-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2020-11023, a jQuery Cross-Site Scripting vulnerability, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, emphasizing the need for federal agencies to remediate such risks. https://www.cisa.gov/news-events/alerts/2025/01/23/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-23006, a deserialization vulnerability affecting SonicWall SMA1000 Appliances, to its Known Exploited Vulnerabilities Catalog, highlighting significant risks for federal agencies. https://www.cisa.gov/news-events/alerts/2025/01/24/cisa-adds-one-known-exploited-vulnerability-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 03/2025

January 19, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

📞 Rufnummernmissbrauch dank Verordnung drastisch zurückgegangen cybercrime – Österreich verzeichnet einen Rückgang bei missbräuchlicher Verwendung von Telefonnummern, dank einer neuen Anti-Spoofing-Verordnung. Spoofing mit ausländischen Nummern bleibt jedoch ein Problem. https://www.derstandard.at/story/3000000252624/rufnummernmissbrauch-dank-verordnung-drastisch-zurueckgegangen

🚜 FTC, States Sue Deere & Company to Protect Farmers from Unfair Corporate Tactics, High Repair Costs security news – The FTC is suing Deere for unfair practices that inflate repair costs and restrict farmers' ability to fix their own equipment, maintaining a monopoly on repairs. https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-states-sue-deere-company-protect-farmers-unfair-corporate-tactics-high-repair-costs?ref=404media.co

🔑 Passkeys: the promise of a simpler and safer alternative to passwords security news – Passkeys provide a secure, user-friendly alternative to traditional passwords, reducing the risk of cyber attacks through unique verification methods and credential management. https://www.ncsc.gov.uk/blog-post/passkeys-promise-simpler-alternative-passwords

🎓 Cyberattack forces Dutch university to cancel lectures cybercrime – Eindhoven University of Technology canceled lectures due to a cyberattack, shutting down its network for investigation. No data theft confirmed yet, but services reliant on the network are down. https://therecord.media/tu-eindhoven-cyberattack-lectures-canceled

🍱 Inside the Black Box of Predictive Travel Surveillance privacy – Governments and companies are using AI to analyze traveler data for security profiling, raising privacy concerns. Cases like Frank van der Linde highlight risks of inaccurate data and surveillance. https://www.wired.com/story/inside-the-black-box-of-predictive-travel-surveillance/

⛪️ Pastor's “dream” crypto scheme alleged to be a multi-million dollar scam cybercrime – Pastor Francier Obando Pinillo faces 26 fraud charges for allegedly running a $5.9 million cryptocurrency scam, claiming inspiration from a dream while exploiting his church community. https://www.bitdefender.com/en-us/blog/hotforsecurity/pastors-dream-crypto-scheme-alleged-to-be-a-multi-million-dollar-scam

🎮 Hacker Broke into ‘Path of Exile 2’ Admin Account, Hijacked Wave of Characters security news – A hacker accessed an admin account for Path of Exile 2, allowing them to reset passwords and steal rare in-game items from numerous players just before the game's launch. https://www.404media.co/hacker-broke-into-path-of-exile-2-admin-account-hijacked-wave-of-characters-2/

📍 A major data broker hack may have leaked precise location info for millions data breach – Gravy Analytics disclosed a data breach that may have exposed precise location data for millions, including sensitive sites. The FTC had previously targeted the company for location data practices. https://www.theverge.com/2025/1/13/24342694/gravy-analytics-location-data-broker-breach-hack-disclosed

🐂 How Barcelona became an unlikely hub for spyware startups cybercrime – Barcelona has emerged as a hub for spyware startups, attracting firms like Palm Beach Networks. Concerns arise over the potential for surveillance abuses amid a growing cybersecurity ecosystem. https://techcrunch.com/2025/01/13/how-barcelona-became-an-unlikely-hub-for-spyware-startups/

🥇 The First Password on the Internet security news – Peter Kirstein created the first password for Arpanet in 1973, ensuring security for UK users and preventing breaches during his 15-year service. The actual password remains unknown. https://www.schneier.com/blog/archives/2025/01/the-first-password-on-the-internet.html

🪴 The ‘Largest Illicit Online Marketplace’ Ever Is Growing at an Alarming Rate, Report Says cybercrime – Huione Guarantee, an illicit marketplace facilitating $24 billion in transactions, provides services for scammers, including money laundering and fake tools. Its growth poses significant challenges for law enforcement. https://www.wired.com/story/the-largest-illicit-online-marketplace-ever-is-growing-at-an-alarming-rate/

⚠️ Achtung Fake: vailllant.at und vaillantproservice.at cybercrime – Warnings have been issued about fake websites vailllant.at and vaillantproservice.at, which impersonate legitimate services, potentially misleading users and compromising security. https://www.watchlist-internet.at/news/achtung-fake-vailllantat-und-vaillantproserviceat/

🖥️ FBI hacked thousands of computers to make malware uninstall itself cyber defense – The FBI hacked approximately 4,200 US computers to remove PlugX malware, used by Chinese state-sponsored hackers, by accessing its command-and-control server to issue self-delete commands. https://www.theverge.com/2025/1/14/24343495/fbi-computer-hack-uninstall-plugx-malware

🎭 Subtle makeup tweaks can outsmart facial recognition privacy – Researchers at PeopleTec demonstrate that subtle makeup applications can effectively disrupt facial recognition algorithms without drawing attention, offering a new approach to evade surveillance. https://www.theregister.com/2025/01/15/make_up_thwart_facial_recognition/

🔳 Opting Out of Gmail's Gemini AI Summaries Is a Mess. Here's How to Do It, We Think privacy – Google's Gemini AI feature in Gmail offers email summaries but automatically opts users in. Disabling it is complicated, as it requires turning off broader smart features, raising privacy concerns. https://www.404media.co/opting-out-of-gmails-gemini-ai-summaries-is-a-mess-heres-how-to-do-it-we-think/

💰 North Korea stole over $659M in crypto heists during 2024, deployed fake job seekers cybercrime – North Korean hackers, linked to the Lazarus Group, stole over $659 million in cryptocurrency in 2024 and infiltrated blockchain firms using fake job applications, according to a joint statement from the U.S., Japan, and South Korea. https://techcrunch.com/2025/01/14/north-korea-stole-over-659m-in-crypto-heists-during-2024-deploys-fake-job-seekers/

💔 No, Brad Pitt isn't in love with you cybercrime – Anne, a French woman, was scammed out of 830,000 Euros by fraudsters posing as Brad Pitt and his family. The emotional fallout has left her homeless and facing harassment after her story became public. https://www.bitdefender.com/en-us/blog/hotforsecurity/no-brad-pitt-isnt-in-love-with-you

Some More, For the Curious

🤖 An honest mistake – and a cautionary tale security research – Misinterpretation of sandbox results led to false malware accusations against harmless files. Context is crucial; not all suspicious behavior indicates malicious intent. https://www.gdatasoftware.com/blog/2025/01/38129-usb-network-adapter-malware

⚠️ A new campaign is likely targeting a zero-day in Fortinet FortiGate firewalls warning – A campaign targeting a zero-day vulnerability in Fortinet FortiGate firewalls has been observed, allowing attackers to access and modify configurations. Experts advise disabling public management access. https://securityaffairs.com/173050/hacking/attackers-target-zero-day-in-fortinet-fortigate-firewalls.html

🔧 Microsoft: Happy 2025. Here’s 161 Security Updates security news – Microsoft released 161 security updates, including three zero-day vulnerabilities under active attack. This marks the largest Patch Tuesday since 2017, with critical flaws affecting Windows components. https://krebsonsecurity.com/2025/01/microsoft-happy-2025-heres-161-security-updates/

📄 Your Single-Page Applications Are Vulnerable: Here's How to Fix Them cyber defense – Single-page applications (SPAs) are prone to access control vulnerabilities due to client-side rendering. Implementing robust server-side controls and using server-side rendering can mitigate these risks. https://cloud.google.com/blog/topics/threat-intelligence/single-page-applications-vulnerable/

💧 Threat actor leaked config files and VPN passwords for over Fortinet Fortigate devices data breach – The Belsen Group leaked configuration files and VPN passwords for over 15,000 Fortinet FortiGate devices, offering the data for free on a cybercrime forum, raising significant security concerns. https://securityaffairs.com/173111/cyber-crime/fortinet-fortigate-devices-data-leak.html

🦇 CISA director says threat hunters spotted Salt Typhoon on federal networks before telco compromises security news – CISA Director Jen Easterly revealed that threat hunters identified activity from the Chinese hacking group Salt Typhoon on federal networks, aiding faster responses to attacks on U.S. telecommunications. https://cyberscoop.com/salt-typhoon-us-government-jen-easterly-cisa/

🍥 Detecting Teams Chat Phishing Attacks (Black Basta) cyber defense – Black Basta ransomware group uses social engineering via Microsoft Teams, posing as IT support after flooding victims with spam emails. Detection strategies include monitoring email spikes and Teams chat creation. https://blog.nviso.eu/2025/01/16/detecting-teams-chat-phishing-attacks-black-basta/

🚗 A closer look at the Mercedes-Benz infotainment system security security research – Kaspersky's research on the Mercedes-Benz MBUX infotainment system identifies several vulnerabilities, including potential exploits via diagnostic tools and physical access, highlighting the need for improved security measures. https://securelist.com/mercedes-benz-head-unit-security-research/115218/

🎰 One Active Directory Account Can Be Your Best Early Warning cyber defense – The article discusses how a single Active Directory account can be used to detect common adversarial activities through various detection strategies, including monitoring for Kerberoasting and failed login attempts. https://www.blackhillsinfosec.com/one-active-directory-account-can-be-your-best-early-warning/

CISA Corner

📚 CISA Releases Microsoft Expanded Cloud Logs Implementation Playbook security news – CISA has released a playbook to assist organizations in utilizing Microsoft Purview Audit logs for enhanced cybersecurity, detailing log usage, ingestion into SIEM systems, and significant events in M365 services. https://www.cisa.gov/news-events/alerts/2025/01/15/cisa-releases-microsoft-expanded-cloud-logs-implementation-playbook 🛡️ CISA and FBI Release Updated Guidance on Product Security Bad Practices security news – CISA and the FBI updated their guidance on Product Security Bad Practices, enhancing recommendations for software manufacturers, especially those supporting critical infrastructure, to improve security practices. https://www.cisa.gov/news-events/alerts/2025/01/17/cisa-and-fbi-release-updated-guidance-product-security-bad-practices

⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has added CVE-2024-12686 and CVE-2023-48365 to its Known Exploited Vulnerabilities Catalog due to active exploitation, highlighting significant risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/01/13/cisa-adds-two-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Four Known Exploited Vulnerabilities to Catalog warning – CISA has added four vulnerabilities, including those in Fortinet and Microsoft Windows Hyper-V, to its Known Exploited Vulnerabilities Catalog, highlighting significant risks for federal networks. https://www.cisa.gov/news-events/alerts/2025/01/14/cisa-adds-four-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-50603, an OS command injection vulnerability in Aviatrix Controllers, to its Known Exploited Vulnerabilities Catalog, highlighting risks for federal networks. https://www.cisa.gov/news-events/alerts/2025/01/16/cisa-adds-one-known-exploited-vulnerability-catalog

🔒 Fortinet Releases Security Updates for Multiple Products security news – Fortinet has issued security updates to fix vulnerabilities that could allow cybercriminals to gain control of affected systems. Users are urged to apply the updates promptly. https://www.cisa.gov/news-events/alerts/2025/01/14/fortinet-releases-security-updates-multiple-products 🔒 Ivanti Releases Security Updates for Multiple Products security news – Ivanti has issued security updates for several of its products to address vulnerabilities that could be exploited by attackers, urging users to apply the updates promptly. https://www.cisa.gov/news-events/alerts/2025/01/14/ivanti-releases-security-updates-multiple-products 🔒 Adobe Releases Security Updates for Multiple Products security news – Adobe has issued security updates for Photoshop, Animate, and Illustrator for iPad to fix vulnerabilities that could allow attackers to gain control of affected systems. https://www.cisa.gov/news-events/alerts/2025/01/14/adobe-releases-security-updates-multiple-products 🔒 Microsoft Releases January 2025 Security Updates security news – Microsoft has issued security updates for various products to fix vulnerabilities that could allow attackers to gain control of affected systems, urging users to apply the updates promptly. https://www.cisa.gov/news-events/alerts/2025/01/14/microsoft-releases-january-2025-security-updates

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA has published four advisories addressing security vulnerabilities in various Industrial Control Systems, urging users to review them for technical details and mitigations. https://www.cisa.gov/news-events/alerts/2025/01/14/cisa-releases-four-industrial-control-systems-advisories ⚙️ CISA Releases Twelve Industrial Control Systems Advisories vulnerability – CISA published twelve advisories on January 16, 2025, addressing vulnerabilities in various Industrial Control Systems, urging users to review them for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/01/16/cisa-releases-twelve-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 02/2025

January 12, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

🔔 Schwerwiegende Sicherheitslücken in Sonicwall SSL-VPN – aktiv ausgenutzt warning https://www.cert.at/de/warnungen/2025/1/schwewiegende-sicherheitslucken-in-sonicwall-ssl-vpn-aktiv-ausgenutzt

News For All

🕵️‍♂️ Privacy of Photos.app’s Enhanced Visual Search privacy – Apple's Enhanced Visual Search feature, enabled by default, allows photo data to be matched with a global index, raising privacy concerns about data transmission and user consent. https://mjtsai.com/blog/2025/01/01/privacy-of-photos-apps-enhanced-visual-search/

📊 Telegram Hands U.S. Authorities Data on Thousands of Users privacy – Telegram provided U.S. authorities with data on over 2,200 users in 2024, marking a significant increase in data requests after its CEO was arrested. https://www.404media.co/telegram-hands-u-s-authorities-data-on-thousands-of-users/

🧬 Widely used DNA sequencer still doesn’t enforce Secure Boot vulnerability – The Illumina iSeq 100 DNA sequencer lacks Secure Boot enforcement, exposing it to firmware attacks. Researchers warn this vulnerability could be exploited by threat actors in sensitive environments. https://arstechnica.com/security/2025/01/widely-used-dna-sequencer-still-doesnt-enforce-secure-boot/

🪽 UN aviation agency ‘investigating’ security breach after hacker claims theft of personal data data breach – The ICAO is investigating a security breach after a hacker claimed to have stolen 42,000 documents containing personal data, including names and contact details of individuals. https://techcrunch.com/2025/01/07/un-aviation-agency-investigating-security-breach-after-hacker-claims-theft-of-personal-data/

🔒 Android patches several vulnerabilities in first security update of 2025 security news – Android's first security update of 2025 addresses critical RCE vulnerabilities that could allow attackers to execute code without privileges. Users are urged to apply patches to protect their devices. https://cyberscoop.com/android-security-update-january-2025/

🚘The leaked GTA San Andreas source code is apparently fake and contains ransomware, so please don't download it malware – The purported GTA: San Andreas source code leak is fake and harbors ransomware from a new group called Rhysida. https://www.gamesradar.com/games/grand-theft-auto/the-leaked-gta-san-andreas-source-code-is-apparently-fake-and-contains-ransomware-so-please-dont-download-it/

📹 License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data security research – Misconfigured ALPR systems from Motorola are exposing live video feeds and sensitive vehicle data online, raising serious privacy concerns. Over 150 cameras have leaked information due to security flaws. https://www.wired.com/story/license-plate-reader-live-video-data-exposed/

🗣️ Meta replaces fact-checking with community notes post ‘Cultural Tipping Point’ security news – Meta is shifting from its fact-checking program to a community notes system, emphasizing free speech and reducing censorship. This change aims to simplify policies and enhance user involvement in moderation. https://securityaffairs.com/172793/social-networks/meta-replaces-fact-checking.html

🏈 Data of more than 8,500 customers breached on Green Bay Packers shopping website data breach – The Green Bay Packers reported a breach affecting 8,514 customers due to malicious code on their Pro Shop website, compromising payment information. Affected individuals will receive credit monitoring services. https://therecord.media/green-bay-packers-online-store-data-breach

🔍 Here’s how hucksters are manipulating Google to promote shady Chrome extensions cybercrime – Developers are violating Chrome Web Store policies by using keyword stuffing techniques, including hidden translations, to manipulate search results for extensions. This leads to unrelated or potentially harmful extensions appearing in searches. https://arstechnica.com/security/2025/01/googles-chrome-web-store-has-a-serious-spam-problem-promoting-shady-extensions/

📳 Apple says Siri isn’t sending your conversations to advertisers privacy – Apple denies claims that Siri recordings are used for advertising, stating it has never built marketing profiles from Siri data. This follows a settlement over privacy concerns related to Siri interactions. https://www.theverge.com/2025/1/8/24337477/apple-responds-rumors-siri-advertising-privacy-lawsuit

🐻 Space Bears Ransomware: What You Need To Know cybercrime – Space Bears is a new ransomware group known for its corporate-like image and ransom tactics. Operating from Moscow, they steal data, encrypt systems, and demand payment, offering post-transaction guarantees. https://www.tripwire.com/state-of-security/space-bears-ransomware-what-you-need-know

📍 Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location data breach – A hack of Gravy Analytics exposed thousands of apps, including popular ones like Candy Crush and Tinder, used to collect sensitive location data without user knowledge, raising serious privacy concerns. https://www.wired.com/story/gravy-location-data-app-leak-rtb/

📚 PowerSchool data breach leaks info of students and staff at schools across the US data breach – A data breach at PowerSchool has potentially exposed sensitive information of students and staff, including names, addresses, and Social Security numbers. The company has paid a ransom and claims the data is deleted. https://www.theverge.com/2025/1/10/24340556/powerschool-sis-data-breach-leak-student-data-us-canada-schools

💻 Slovakia’s land registry hit by biggest cyberattack in country’s history, minister says security news – Slovakia's land registry suffered its largest cyberattack, disrupting property transactions and essential services. The attack, believed to be ransomware, has paralyzed real estate markets and is linked to rising tensions with Ukraine. https://therecord.media/slovakia-registry-cyberattack-land-agriculture

💸 A novel PayPal phishing campaign hijacks accounts cybercrime – Fortinet warns of a phishing campaign targeting PayPal users by using legitimate links to trick victims into granting unauthorized access, potentially compromising their accounts. https://securityaffairs.com/172935/cyber-crime/paypal-phishing-campaign-hijacks-accounts.html

📦 How Cracks and Installers Bring Malware to Your Device security research – Attackers exploit platforms like YouTube to distribute fake installers, using reputable file hosting services and encryption to evade detection. This malware collects sensitive browser data, highlighting the risks of downloading fraudulent software. https://www.trendmicro.com/en_us/research/25/a/how-cracks-and-installers-bring-malware-to-your-device.html

Some More, For the Curious

🎣 New PhishWP Plugin on Russian Forum Turns Sites into Phishing Pages cybercrime – Cybercriminals have developed PhishWP, a WordPress plugin that creates fake payment pages to steal sensitive data like credit card info. It sends stolen data directly to attackers via Telegram. https://hackread.com/phishwp-plugin-russian-hacker-forum-phishing-sites/

⚠️ MediaTek says ‘Happy New Year’ with critical RCE, other bugs vulnerability – MediaTek disclosed critical vulnerabilities, including a severe RCE bug in 51 chipsets that could be exploited via attacker-controlled base stations. Device manufacturers were notified and patches are expected. https://www.theregister.com/2025/01/06/mediatek_chipset_vulnerabilities/

🏭 Industrial networking manufacturer Moxa reports ‘critical’ router bugs vulnerability – Moxa's cellular and secure routers have critical vulnerabilities allowing privilege escalation and command execution. Users are urged to apply patches or limit network exposure to mitigate risks. https://cyberscoop.com/industrial-networking-manufacturer-moxa-reports-critical-router-bugs/

📡 Three more telcos reportedly join China Salt Typhoon victims security news – Charter, Consolidated, and Windstream are the latest telecom companies confirmed as victims of the Salt Typhoon cyberattack, attributed to Chinese government espionage efforts targeting U.S. networks. https://www.theregister.com/2025/01/06/charter_consolidated_windstream_salt_typhoon/

🔍 CISA says 'no indication' of wider government hack beyond Treasury security news – CISA reports no evidence of other U.S. federal agencies being hacked in the December cyberattack on the Treasury, attributed to Chinese government-backed hackers accessing employee workstations. https://techcrunch.com/2025/01/06/cisa-says-no-indication-of-wider-government-hack-beyond-treasury/

🛡️ US adds Tencent to the list of companies supporting Chinese military security news – The U.S. Department of Defense has listed Tencent among companies supporting the Chinese military, citing concerns over its technologies' dual-use potential. Tencent plans to appeal, claiming the inclusion is an error. https://securityaffairs.com/172765/security/us-adds-tencent-list-of-companies-supporting-chinese-military.html

🦠 Gayfemboy Botnet targets Four-Faith router vulnerability cybercrime – The Gayfemboy botnet, a variant of Mirai, exploits vulnerabilities in Four-Faith routers and other devices to conduct DDoS attacks, with over 15,000 active nodes targeting global entities since late 2024. https://securityaffairs.com/172805/malware/gayfemboy-mirai-botnet-four-faith-flaw.html

🪢 Ukrainian Cyber Alliance destroyed the connectivity of Russian ISP Nodex security news – The Ukrainian Cyber Alliance hacked Russian ISP Nodex, stealing sensitive data and disrupting connectivity. The ISP confirmed the attack and is working to restore its systems. https://securityaffairs.com/172864/hacktivism/ukrainian-cyber-alliance-destroyed-russian-isp-nodex.html

💰 Facebook awards researcher $100,000 for finding bug that granted internal access security news – Ben Sadeghipour discovered a vulnerability in Facebook's ad platform that allowed him to run commands on an internal server. Meta awarded him $100,000 for reporting the issue, which was fixed quickly. https://techcrunch.com/2025/01/09/facebook-awards-researcher-100000-for-finding-bug-that-granted-internal-access/

🖱️ Researchers disclosed details of a now-patched Samsung zero-click flaw vulnerability – Google Project Zero revealed a now-patched zero-click vulnerability (CVE-2024-49415) in Samsung devices that allowed remote code execution via audio messages, affecting Galaxy S23 and S24 models. https://securityaffairs.com/172909/hacking/samsung-zero-click-flaw.html

🔑 How We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud hacking write-up – Researchers cracked a 512-bit DKIM key using a cloud server for under $8, revealing the insecurity of short RSA keys. They tested DKIM signatures, finding some providers accepted the compromised key. https://dmarcchecker.app/articles/crack-512-bit-dkim-rsa-key

🚼 WorstFit: Unveiling Hidden Transformers in Windows ANSI! hacking write-up – Research reveals a novel attack surface in Windows through the Best-Fit character conversion feature, leading to vulnerabilities like Path Traversal and RCE. The study highlights risks associated with encoding mishandling and provides examples of exploitation. https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/

🔍 Using SYN Port Scans with Source IP Spoofing For Offensive Deception cyber defense – This article discusses how attackers use SYN port scanning with spoofed IP addresses as a deceptive tactic to generate alerts, diverting SOC teams' attention from real threats. It highlights the challenges modern IDS face in detecting such evasion techniques. https://tierzerosecurity.co.nz/2025/01/08/syn-spoof-scan.html

CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities, including two from Mitel and one from Oracle, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, highlighting significant security risks. https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Vulnerability to the KEV Catalog warning – CISA has added CVE-2025-0282, a vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities Catalog, urging organizations to implement mitigations and report incidents promptly. https://www.cisa.gov/news-events/alerts/2025/01/08/cisa-adds-one-vulnerability-kev-catalog

⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA issued two advisories on January 7, 2025, highlighting security issues in ABB and Nedap ICS products. Users are urged to review for vulnerabilities and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-releases-two-industrial-control-systems-advisories ⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA has issued four advisories on January 10, 2025, detailing security vulnerabilities in various Industrial Control Systems, urging users to review for technical details and mitigations. https://www.cisa.gov/news-events/alerts/2025/01/10/cisa-releases-four-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 01/2025

January 6, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

📧 Mails zur Rückerstattung von ORF warning – Aktuell erhalten viele Personen Phishing-E-Mails, die fälschlicherweise eine Rückerstattung von ORF-Gebühren in Höhe von 34,40 Euro versprechen, um Kontodaten zu stehlen. https://www.watchlist-internet.at/news/betruegerisches-orf-rueckerstattung-e-mail/

News For All

🧩 Large language models can do jaw-dropping things. But nobody knows exactly why. security research – Researchers explore the unpredictable behaviors of large language models, such as 'grokking' and 'double descent', revealing a lack of understanding behind their impressive capabilities and potential risks. https://www.technologyreview.com/2024/03/04/1089403/large-language-models-amazing-but-nobody-knows-why/

🦠 The Mac Malware of 2024 malware – A detailed overview of new macOS malware in 2024, including various types like info stealers, their infection vectors, persistence mechanisms, and technical insights into their operations. https://objective-see.org/blog/blog_0x7D.html

🚨 Threat actors attempt to exploit a flaw in Four vulnerability – Researchers warn of active exploitation of a high-severity OS command injection vulnerability in Four-Faith routers, allowing remote attackers to execute arbitrary commands using default credentials. https://securityaffairs.com/172450/hacking/four-faith-routers-flaw-exploited.html

🔑 Passkey technology is elegant, but it’s most definitely not usable security security news – Despite their security advantages, passkeys face usability issues due to inconsistent implementations across platforms, confusing workflows, and reliance on passwords, undermining their intended benefits. https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

🔒 AT&T and Verizon say networks are secure after being breached by China-linked Salt Typhoon hackers cybercrime – AT&T and Verizon claim their networks are secure after being targeted by the China-linked Salt Typhoon hackers, stating they have contained the incident with no ongoing threat activity detected. https://techcrunch.com/2024/12/30/verizon-says-it-has-secured-its-network-after-breach-by-china-linked-salt-typhoon-group/

🌐 The Most Dangerous People on the Internet in 2024 cybercrime – In 2024, the internet remains perilous, driven by disruptive figures like Elon Musk, Donald Trump, state-sponsored hackers, and ransomware groups, all contributing to a chaotic online environment. https://www.wired.com/story/the-most-dangerous-people-on-the-internet-in-2024/

🚗 Volkswagen leak exposed location data for 800,000 electric cars data breach – A data leak exposed precise location data for 800,000 Volkswagen electric vehicles, potentially allowing tracking of drivers, along with personal information like emails and phone numbers. https://www.theverge.com/2024/12/30/24332181/volkswagen-data-leak-exposed-location-evs

📰 Telegram blocks Russian state media channels in several EU countries security news – Telegram has blocked access to Russian state media channels in multiple EU countries, citing local law violations, prompting accusations of censorship from Moscow and highlighting ongoing tensions over media control. https://therecord.media/telegram-blocks-russian-state-channels

🔓 AT&T, Verizon, Lumen confirm Salt Typhoon breach data breach – AT&T, Verizon, and Lumen confirmed breaches by the Chinese state-sponsored Salt Typhoon group, which allowed access to geolocation data and potential recording of calls, highlighting significant cybersecurity vulnerabilities. https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/

🍏 Not just one bad apple: FTX's practices were business as usual in crypto security research – The collapse of FTX reveals widespread unethical practices in the crypto industry, including secret acquisitions, unaudited financials, and connections to criminal activity, indicating that FTX's behavior was not an isolated incident. https://www.citationneeded.news/not-just-one-bad-apple/

💳 Gift Card Fraud cybercrime – Organized crime is increasingly using gift card fraud tactics, such as card draining, where criminals tamper with gift cards and return them to stores, enabling them to steal funds loaded by unsuspecting customers. https://www.schneier.com/blog/archives/2024/12/gift-card-fraud.html

🔒 New Year’s cybersecurity resolutions that every startup should keep security news – As 2024 ended with numerous data breaches, startups should adopt cybersecurity resolutions like using password managers, implementing multi-factor authentication, applying software patches, backing up data, being cautious with phone calls, and maintaining transparency about incidents. https://techcrunch.com/2024/12/31/new-year-cybersecurity-resolutions-that-every-startup-should-keep/

🔓 Rhode Island ’s data from health benefits system leaked on the dark web data breach – Rhode Island's health benefits system was hacked, resulting in leaked resident data on the dark web. The state is informing affected individuals and advising them to take protective measures. https://securityaffairs.com/172503/cyber-crime/rhode-island-data-breach.html

🗑️ Hey, Maybe It's Time to Delete Some Old Chat Histories privacy – As old chat histories may expose sensitive information, users are encouraged to declutter their digital footprint by deleting outdated messages and utilizing features like auto-delete to enhance privacy. https://www.wired.com/story/old-chat-history-delete/

💰 Apple to pay $95 million to settle Siri privacy lawsuit privacy – Apple will pay $95 million to settle a class-action lawsuit claiming Siri recorded conversations without consent and shared them with third parties. Affected users may receive up to $20 each. https://therecord.media/apple-to-pay-95-million-siri-lawsuit

🔍 Google Is Allowing Device Fingerprinting privacy – Google's decision to permit device fingerprinting starting in 2025 has been criticized as a significant setback for user privacy. https://www.schneier.com/blog/archives/2025/01/google-is-allowing-device-fingerprinting.html

📞 A US soldier was arrested for leaking presidential call logs security news – US Army soldier Cameron John Wagenius was arrested for allegedly leaking presidential call logs and selling stolen records from AT&T and Verizon under the alias 'Kiberphant0m.' https://securityaffairs.com/172589/cyber-crime/us-soldier-arrested-for-leaking-presidential-call-logs.html

🔒 Time to check if you ran any of these 33 malicious Chrome extensions malware – A recent discovery revealed that 33 malicious Chrome extensions, used by approximately 2.6 million devices, siphoned sensitive data through a double-click attack, prompting users to change passwords and review their security. https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/

🤖 Meta's AI Profiles Are Indistinguishable From Terrible Spam That Took Over Facebook security news – Meta's plan to introduce AI character profiles on Instagram and Facebook has sparked concerns as existing, poorly received AI profiles have led users to fear an influx of spam-like content on the platforms. https://www.404media.co/metas-ai-profiles-are-indistinguishable-from-terrible-spam-that-took-over-facebook/

🔒 Atos mostly denies Space Bears' ransomware claims security news – Atos denied a ransomware breach by Space Bears but acknowledged that third-party infrastructure containing data linked to Atos was compromised. The company emphasized that its own systems were not affected. https://www.theregister.com/2025/01/04/atos_denies_space_bears_ransomware/

🔐 Encryption backdoor debate 'done and dusted' security news – Following the Salt Typhoon hacks, US officials have reversed their stance on encryption, now advocating for end-to-end encryption without backdoors to protect communications from cyber threats. https://www.theregister.com/2025/01/04/encryption_backdoor_debate/

Some More, For the Curious

🔧 Why Configurations Are the Wrong Thing to Get Wrong cyber defense – Misconfigurations remain a leading cause of data breaches, with many organizations neglecting basic security practices. Proper management can significantly reduce vulnerabilities. https://www.tripwire.com/state-of-security/configurations-mega-blog-why-configurations-are-wrong-thing-get-wrong

🤔 10 Non-tech things you wish you had done after being breached security news – Post-breach recovery involves vital non-tech actions like reinforcing NDAs, reviewing third-party relationships, updating employee training, and conducting reputation assessments to strengthen resilience. https://www.pentestpartners.com/security-blog/10-non-tech-things-you-wish-you-had-done-after-being-breached/

🛠️ Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks cyber defense – This article explores alternative frameworks like EPSS and SSVC for vulnerability prioritization, highlighting their strengths and limitations in comparison to CVSS, and emphasizing the need for a tailored approach based on organizational context. https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-into-frameworks-and-tools-part-2-alternative-frameworks/

🔍 Log4j Log4Shell Vulnerability Q&A vulnerability – The article discusses the Log4j Log4Shell vulnerability, its detection, comparison to Shellshock, and solutions for identifying and remediating affected packages using tools like JFrog Xray. https://jfrog.com/blog/a-log4j-log4shell-vulnerability-qa/

🖱️ DoubleClickjacking allows clickjacking on major websites vulnerability – The 'DoubleClickjacking' exploit uses a double-click sequence to bypass clickjacking protections on major websites, potentially leading to account takeovers and unauthorized actions. https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html

💻 Japan's largest mobile carrier says cyberattack disrupted some services security news – NTT Docomo, Japan's largest mobile carrier, reported a DDoS cyberattack that temporarily disrupted services, including its news and video platforms. Most services have been restored, but delays may continue. https://therecord.media/ntt-docomo-japan-mobile-carrier-ddos-incident

📱 stealing malware supports spyware capabilities malware – FireScam malware targets Android devices by masquerading as a fake 'Telegram Premium' app, stealing sensitive information through notification monitoring and exfiltrating data to a Firebase database. https://securityaffairs.com/172656/malware/firescam-android-malware.html

⚠️ Malicious npm packages target Ethereum developers malware – A supply chain attack involving malicious npm packages is targeting Ethereum developers by impersonating Hardhat plugins, aiming to steal private keys and sensitive data from development environments. https://securityaffairs.com/172671/malware/malicious-npm-packages-target-ethereum-developers.html

🧬 Studie: Entwicklungsstand Quantencomputer Version 2.1 security research – This study examines the theoretical and practical developments in quantum computing, particularly in cryptanalysis, providing insights for scientists and actionable information for decision makers. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Quantencomputer/Entwicklungstand_QC_V_2_1.html

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2024-3393, a vulnerability in Palo Alto Networks' PAN-OS, in its Known Exploited Vulnerabilities Catalog, emphasizing the need for federal agencies to remediate it to mitigate risks. https://www.cisa.gov/news-events/alerts/2024/12/30/cisa-adds-one-known-exploited-vulnerability-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 50/2024

December 15, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🛡️ Microsoft Recall screenshots credit cards and Social Security numbers, even with the “sensitive information” filter enabled privacy – Microsoft's Recall feature, designed to capture screenshots, fails to adequately filter sensitive information like credit card numbers and Social Security numbers, raising privacy concerns despite encryption efforts. https://www.tomshardware.com/software/windows/microsoft-recall-screenshots-credit-cards-and-social-security-numbers-even-with-the-sensitive-information-filter-enabled

🏡 OpenWrt supply chain attack scare prompts urgent upgrades vulnerability – OpenWrt users are urged to upgrade their firmware to mitigate a potential supply chain attack involving command injection and weak hash vulnerabilities that could allow attackers to serve malicious images. https://www.theregister.com/2024/12/09/openwrt_firmware_vulnerabilities/

🔒 WhatsApp patches View Once flaw exposing vanishing media security news – WhatsApp has fixed a vulnerability in its View Once feature, which allowed disappearing media to be accessed through web clients and rogue browser extensions, undermining user privacy. https://www.theregister.com/2024/12/10/whatsapp_view_once/

🛡️ EU cybersecurity rules for smart devices enter into force security news – The EU's Cyber Resilience Act has come into effect, imposing security obligations on manufacturers of connected devices, requiring them to provide updates and ensure compliance by December 2027. https://techcrunch.com/2024/12/10/eu-cybersecurity-rules-for-smart-devices-enter-into-force/

💰 3AM Ransomware: What You Need To Know malware – 3AM is a ransomware group that exfiltrates and encrypts data, using Rust for speed. Notably linked to LockBit, it threatens victims with data leaks unless a ransom is paid. https://www.tripwire.com/state-of-security/3am-ransomware-what-you-need-know

🚨 Location Data Firm Offers to Help Cops Track Targets via Doctor Visits privacy – Fog Data Science is proposing to assist police in tracking individuals by using location data linked to their doctors' offices, raising privacy concerns amidst increasing surveillance of healthcare visits. https://www.404media.co/location-data-firm-offers-to-help-cops-track-targets-via-doctor-visits/

💸 French internet operator fined $53 million for unsolicited ads and tracking users without consent privacy – France's CNIL fined Orange S.A. $53 million for sending unsolicited ads and tracking users without consent, violating data protection laws, despite the company claiming the practices were standard. https://therecord.media/french-internet-operator-fined-53-million-unsolicited-ads-tracking

🎄 Network security best practices for the holidays security news – As cyber threats rise during the holidays, ensure your network is secure by updating infrastructure, shutting down non-essential systems, and implementing multi-factor authentication to protect against attacks. https://news.sophos.com/en-us/2024/12/10/network-security-best-practices-for-the-holidays/

🔑 How easily access cards can be cloned and why your PACS might be vulnerable hacking write-up – Access cards can be easily cloned due to vulnerabilities in Physical Access Control Systems (PACS). Proper configuration and secure tokens are essential to protect against cloning threats. https://www.pentestpartners.com/security-blog/how-easily-access-cards-can-be-cloned-and-why-your-pacs-might-be-vulnerable/

👍 Patch Tuesday, December 2024 Edition security news – Microsoft patched at least 70 security vulnerabilities, including a zero-day exploit (CVE-2024-49138) in the Windows CLFS driver that allows attackers to gain system privileges. Users are urged to update systems. https://krebsonsecurity.com/2024/12/patch-tuesday-december-2024-edition/

💵 How Cryptocurrency Turns to Cash in Russian Banks – Krebs on Security cybercrime – Research reveals that a Canadian firm, Cryptomus, acts as a payment processor for Russian cryptocurrency exchanges, enabling cash conversion for cybercrime services and evasion of sanctions against Russia. https://krebsonsecurity.com/2024/12/how-cryptocurrency-turns-to-cash-in-russian-banks/

🚫 Mozilla removing Do Not Track option from Firefox 135 privacy – Mozilla will remove the Do Not Track feature from Firefox 135 due to its ineffectiveness, directing users to utilize the Global Privacy Control instead, which aims to enhance online privacy. https://www.theregister.com/2024/12/12/firefox_do_not_track/

🛑 27 DDoS-For-Hire Services Disrupted In Run-Up To Holiday Season cybercrime – Operation PowerOFF, involving law enforcement from 15 countries, has disrupted 27 DDoS-for-hire services ahead of the holiday season, arresting several individuals and aiming to deter cybercriminal activity. https://www.tripwire.com/state-of-security/27-ddos-hire-services-disrupted-run-holiday-season

🚙 Researchers find security flaws in Skoda cars that may let hackers remotely track them vulnerability – Security researchers identified 12 vulnerabilities in Skoda Superb III's infotainment system that could allow hackers to track vehicles and execute malicious code via Bluetooth without authentication. https://techcrunch.com/2024/12/12/researchers-find-security-flaws-in-skoda-cars-that-may-let-hackers-remotely-track-them/

🔝 The Top Ten List of Why You Got Hacked This Year (2023/2024) security news – An analysis of penetration testing findings reveals the top reasons for security breaches, including lack of firewall restrictions, weak protocols, outdated web applications, social engineering, and poor password policies. https://www.blackhillsinfosec.com/top-ten-list-of-why-you-got-hacked-this-year-2023-2024/

📦 Critical WordPress plugin vulnerability under active exploit threatens thousands vulnerability – A critical vulnerability (CVE-2024-11972) in the Hunk Companion WordPress plugin, affecting over 10,000 sites, is actively exploited for unauthenticated code execution, with only 12% of users having applied the patch. https://arstechnica.com/security/2024/12/thousands-of-sites-remain-unpatched-against-actively-exploited-wordpress-plugin-bug/

🪙 Cleo urges customers to ‘immediately’ apply new patch as researchers discover new malware vulnerability – Cleo has urged users to apply a new patch for a critical vulnerability in its file sharing products, following reports of ongoing exploitation and the discovery of a new malware family, Malichus. https://therecord.media/cleo-urges-customers-to-immediately-patch-systems-after-exploitation

💰 Game-like ‘task scams’ stole more than $220 million in six months cybercrime – The FTC warns about game-like online job scams that have stolen over $220 million in six months, accounting for 40% of scam reports this year. Victims are often tricked into paying scammers under false promises of income. https://www.theverge.com/2024/12/13/24320391/ftc-task-scams-spotlight-warning

🔑 The Simple Math Behind Public Key Cryptography security news – Public key cryptography uses a pair of keys—one public and one private—to secure communications, relying on mathematical trapdoor functions that are easy to compute one way but difficult to reverse, ensuring data security against unauthorized access. https://www.wired.com/story/how-public-key-cryptography-really-works-using-only-simple-math/

Some More, For the Curious

🔒 Mitigating NTLM Relay Attacks by Default cyber defense – Microsoft has enhanced security by enabling Extended Protection for Authentication (EPA) by default in Exchange Server and other services to combat NTLM relay attacks, protecting users' identities. https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/

⚠️ Cleo Harmony, VLTrader, and LexiCom – RCE via Arbitrary File Write (CVE-2024-50623) vulnerability – A zero-day exploit in Cleo's file transfer software allows attackers to execute remote code via arbitrary file write. Patched versions still vulnerable; urgent updates are needed. https://labs.watchtowr.com/cleo-cve-2024-50623/

💻 Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows malware – A new cross-platform malware named Meeten targets crypto users via AI-generated scams, stealing sensitive information from macOS and Windows systems through deceptive downloads. https://www.cadosecurity.com/blog/meeten-malware-threat

🎭 Malicious Maven Package Impersonating 'XZ for Java' Library ... security research – A malicious Maven package impersonating the legitimate XZ for Java library introduces a backdoor for remote command execution, posing significant risks to Java applications and supply chains. https://socket.dev/blog/malicious-maven-package-impersonating-xz-for-java-library

🚨 Stark gestiegenes Aufkommen an Microsoft Remote Desktop Protokoll (RDP) Scanning warning – A significant surge in Microsoft Remote Desktop Protocol (RDP) scanning has been observed, particularly targeting port 1098. It's advised to restrict RDP access to enhance security. https://www.cert.at/de/aktuelles/2024/12/stark-gestiegenes-aufkommen-an-microsoft-remote-desktop-protokoll-rdp-scanning

💥 AMD’s trusted execution environment blown wide open by new BadRAM attack vulnerability – Researchers revealed the BadRAM attack, which exploits vulnerabilities in AMD's Secure Encrypted Virtualization, allowing physical access to bypass protections and compromise sensitive data in virtual machines. https://arstechnica.com/information-technology/2024/12/new-badram-attack-neuters-security-assurances-in-amd-epyc-processors/

🔧 Ivanti fixed a maximum severity vulnerability in its CSA solution vulnerability – Ivanti addressed a critical authentication bypass vulnerability (CVE-2024-11639) in its Cloud Services Appliance, allowing remote attackers to gain administrative access. Additional SQL injection vulnerabilities were also fixed in version 5.0.3. https://securityaffairs.com/171850/breaking-news/ivanti-maximum-severity-flaw-csa-solution.html

📊 Latest round of MITRE ATT&CK evaluations put cybersecurity products through rigors of ransomware security news – MITRE's latest ATT&CK evaluations assessed 19 vendors against ransomware tactics, revealing disparities in detection rates and false positives. The inclusion of macOS threats highlighted evolving security challenges. https://cyberscoop.com/mitre-attack-evaluations-ransomware-macos/

👁️ Researchers uncover Chinese spyware used to target Android devices security research – Researchers at Lookout revealed EagleMsgSpy, a Chinese spyware tool used by law enforcement to collect extensive data from Android devices, including messages and location information, potentially posing risks to travelers. https://techcrunch.com/2024/12/11/researchers-uncover-chinese-spyware-used-to-target-android-devices/

🤞 The evolution and abuse of proxy networks cybercrime – Proxy networks have evolved from privacy tools like VPNs and TOR to being exploited by cybercriminals and state-sponsored actors for malicious activities, including DDoS attacks and espionage, posing challenges for defenders. https://blog.talosintelligence.com/the-evolution-and-abuse-of-proxy-networks/

🔍 Zero Day Initiative — SolarWinds Access Rights Manager: One Vulnerability to LPE Them All vulnerability – Research revealed multiple vulnerabilities in SolarWinds Access Rights Manager, including pre-auth arbitrary file deletion that could allow attackers to escalate privileges remotely on Windows machines, particularly if using a Domain Admin account. https://www.thezdi.com/blog/2024/12/11/solarwinds-access-rights-manager-one-vulnerability-to-lpe-them-all

🔒 Google says its breakthrough quantum chip can’t break modern cryptography security news – Google's Willow quantum chip, while powerful, is not capable of breaking modern cryptography. Experts estimate it will take millions of qubits and at least a decade to potentially crack RSA encryption. https://www.theverge.com/2024/12/12/24319879/google-willow-cant-break-rsa-cryptography

📊 Common Vulnerability Scoring System (CVSS) security news – The Common Vulnerability Scoring System (CVSS) is a standardized framework used to assess the severity of software vulnerabilities, providing a numerical score to help organizations prioritize their responses. https://vulncheck.com/blog/common-vulnerability-scoring-system

⛓️‍💥 Ultralytics Supply-Chain Attack security research – A supply-chain attack on the Ultralytics AI library led to a malicious version being published on PyPI, which downloaded a coinminer. Experts recommend improving security configurations for package publishers. https://www.schneier.com/blog/archives/2024/12/ultralytics-supply-chain-attack.html

🔍 XRefer: The Gemini-Assisted Binary Navigator security research – Mandiant introduces XRefer, a tool designed to assist malware analysts by providing cluster-based navigation and context-aware views for understanding complex binaries, enhancing efficiency in reverse engineering. https://cloud.google.com/blog/topics/threat-intelligence/xrefer-gemini-assisted-binary-navigator/

⛳ German agency BSI sinkholed a botnet of 30,000 devices infected with BadBox malware – BSI has disrupted a botnet of 30,000 infected devices running BadBox malware, blocking communication and preventing further exploitation. Outdated Android versions are at risk. https://securityaffairs.com/171968/malware/bsi-sinkholed-badbox-botnet.html

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-49138, a heap-based buffer overflow vulnerability in Microsoft Windows CLFS Driver, to its Known Exploited Vulnerabilities Catalog due to active exploitation risks. https://www.cisa.gov/news-events/alerts/2024/12/10/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-50623, an unrestricted file upload vulnerability affecting Cleo products, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, highlighting significant risks for federal agencies. https://www.cisa.gov/news-events/alerts/2024/12/13/cisa-adds-one-known-exploited-vulnerability-catalog

🔒 Microsoft Releases December 2024 Security Updates security news – Microsoft has issued security updates for various products to fix vulnerabilities that could allow cyber attackers to take control of affected systems. Users are urged to apply the updates promptly. https://www.cisa.gov/news-events/alerts/2024/12/10/microsoft-releases-december-2024-security-updates 🔒 Ivanti Releases Security Updates for Multiple Products security news – Ivanti has issued security updates for several products, including Ivanti Cloud Service Application and Ivanti Connect Secure, urging users to review advisories and apply necessary updates. https://www.cisa.gov/news-events/alerts/2024/12/10/ivanti-releases-security-updates-multiple-products 🔒 Adobe Releases Security Updates for Multiple Products security news – Adobe has issued security updates for several products, including Acrobat and Illustrator, to fix vulnerabilities that could allow cyber attackers to take control of affected systems. https://www.cisa.gov/news-events/alerts/2024/12/10/adobe-releases-security-updates-multiple-products 🔒 Apple Releases Security Updates for Multiple Products security news – Apple has issued security updates for various products to fix vulnerabilities that could allow cyber attackers to take control of affected systems. Users are urged to review advisories and apply updates promptly. https://www.cisa.gov/news-events/alerts/2024/12/12/apple-releases-security-updates-multiple-products

⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA has issued seven advisories on ICS vulnerabilities, including products from MOBATIME, Schneider Electric, National Instruments, and Rockwell Automation, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2024/12/10/cisa-releases-seven-industrial-control-systems-advisories ⚙️ CISA Releases Ten Industrial Control Systems Advisories vulnerability – CISA has published ten advisories addressing vulnerabilities in various Siemens Industrial Control Systems, urging users to review the advisories for technical details and necessary mitigations. https://www.cisa.gov/news-events/alerts/2024/12/12/cisa-releases-ten-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 49/2024

December 8, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🤖 How threat actors can use generative artificial intelligence? cybercrime – Generative AI is increasingly exploited by cybercriminals for phishing, deepfakes, and disinformation campaigns, posing significant risks in cybersecurity. https://securityaffairs.com/171582/uncategorized/how-threat-actors-can-use-generative-artificial-intelligence.html

🔍 Are You Being Tracked by an AirTag? Here’s How to Check privacy – To check for unwanted AirTag tracking, iPhone users should enable notifications and scan for unknown devices, while Android users can use the Tracker Detect app. If found, remove the battery and contact authorities if necessary. https://www.wired.com/story/how-to-find-airtags/

🪧 Indian online ID verification firm Signzy confirms security incident data breach – Signzy, a major online ID verification provider, confirmed a cyberattack impacting its services for financial institutions. Although some client data was briefly visible online, many customers report no data compromise. https://techcrunch.com/2024/12/02/indian-online-id-verification-firm-signzy-confirms-security-incident/

📳 Small number of vulnerabilities patched in last Android security update of 2024 security news – Google's December 2024 Android Security Bulletin addresses several vulnerabilities, including a high-severity flaw (CVE-2024-43767) allowing remote code execution. Patches are provided to partners for various Android components. https://cyberscoop.com/android-security-update-december-2024/

🚫 Certain names make ChatGPT grind to a halt, and we know why security research – ChatGPT encounters issues when certain names are mentioned due to hard-coded filters, likely stemming from past defamation lawsuits. This can hinder user experience and raise concerns about adversarial attacks. https://arstechnica.com/information-technology/2024/12/certain-names-make-chatgpt-grind-to-a-halt-and-we-know-why/

👯 Apple patents system for identifying people when facial scans aren’t enough privacy – Apple's newly approved patent describes a system that enhances facial recognition with body characteristics like gait and clothing to identify individuals even in unclear video feeds. https://therecord.media/apple-patent-body-recognition-biometrics

💼 Xerox, Nokia, BofA, Morgan Stanley's employees data dumped data breach – A massive data breach linked to the MOVEit vulnerability has exposed personal data of hundreds of thousands of employees from companies like Xerox, Nokia, Bank of America, and Morgan Stanley, posing risks for social engineering attacks. https://www.theregister.com/2024/12/03/760k_xerox_nokia_bofa_morgan/

🛑 Data brokers may be banned from selling your social security number privacy – The CFPB proposes a rule to limit data brokers from selling sensitive personal information, including Social Security numbers, requiring compliance with the Fair Credit Reporting Act and explicit consumer consent for data sharing. https://www.theverge.com/2024/12/3/24311498/cfpb-rule-data-brokers-social-security-number-fico-score

⬆️ North Korean hackers masquerade as remote IT workers and venture capitalists to steal crypto and secrets cybercrime – North Korean hackers are using false identities to pose as remote IT workers and venture capitalists to steal cryptocurrency and sensitive information, employing sophisticated tactics to infiltrate unsuspecting companies. https://www.bitdefender.com/en-us/blog/hotforsecurity/north-korean-hackers-masquerade-as-remote-it-workers-and-venture-capitalists-to-steal-crypto-and-secrets

🔗 Why Phishers Love New TLDs Like .shop, .top and .xyz cybercrime – Phishing attacks surged nearly 40% due to new generic top-level domains (gTLDs) like .shop and .xyz, which offer cheap registration and minimal verification, making them attractive to scammers. New research highlights the need for stricter regulations. https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-shop-top-and-xyz/

📊 Your Bluesky Posts Are Probably In A Bunch of Datasets Now privacy – Bluesky posts are being scraped into large datasets for machine learning, sparking controversy over consent and privacy. Multiple datasets, including one with 298 million posts, have emerged, raising ethical and legal concerns. https://www.404media.co/bluesky-posts-machine-learning-ai-datasets-hugging-face/

🚗 ‘A Total Meltdown’: Black Friday Zipcar Outage Strands Customers in Random Places security news – A Zipcar outage on Black Friday stranded customers nationwide, locking them out of rented cars and leading to surprise charges. The company attributed the issue to increased site traffic and SMS service problems. https://www.404media.co/a-total-meltdown-black-friday-zipcar-outage-strands-customers-in-random-places/

🌐 Finland says latest fiber-optic cable break was an accident, not sabotage security news – Finland's police confirmed that the recent damage to two fiber-optic cables was accidental, caused by excavation work, not sabotage. The incident led to a major internet outage affecting 6,000 customers and 100 businesses. https://therecord.media/finland-sweden-cable-accident-not-malicious

🚫 Two data brokers banned from selling ‘sensitive’ location data by the FTC privacy – The FTC has banned Gravy Analytics and Mobilewalla from selling sensitive location data, citing violations that put millions of Americans at risk by enabling tracking to sensitive sites. The companies must comply with strict data handling regulations. https://www.theverge.com/2024/12/3/24312313/ftc-bans-sensitive-location-data-brokers-gravy-analytics-venntel-mobilewalla

💬 Eurocops red pill the Matrix 'secure' criminal chat systems cybercrime – French and Dutch police have dismantled the Matrix chat app, a secure messaging tool for criminals, after infiltrating its servers. The operation yielded 2.3 million messages related to criminal activities and resulted in multiple arrests. https://www.theregister.com/2024/12/04/eurocop_crack_matrix/

💻 Tech Support Scams Exploit Google Ads to Target Users cybercrime – Cybercriminals are using Google Ads for tech support scams, manipulating search results to display malicious ads impersonating legitimate companies like PayPal and Netflix. https://www.tripwire.com/state-of-security/tech-support-scams-exploit-google-ads-target-users

🗳️ AI and the 2024 Elections security news – In the unprecedented 2024 elections, AI played a significant role, with both beneficial and harmful applications observed. While AI-assisted campaigns helped connect with voters, misinformation and deepfakes raised concerns about electoral integrity. https://www.schneier.com/blog/archives/2024/12/ai-and-the-2024-elections.html

🔒 U.S. Offered $10M for Hacker Just Arrested by Russia cybercrime – Mikhail Matveev, known as 'Wazawaka,' was arrested by Russian authorities after being indicted by the U.S. for ransomware activities. The arrest raises questions about motivations behind the move, with experts suggesting it could be linked to local corruption and financial pressures. https://krebsonsecurity.com/2024/12/u-s-offered-10m-for-hacker-just-arrested-by-russia/

🎭 Deepfake YouTube Ads of Celebrities Promise to Get You ‘Rock Hard’ security news – YouTube ran ads featuring deepfaked celebrities like Schwarzenegger and Stallone promoting erectile dysfunction supplements. These misleading ads, using AI-generated voices, have been removed after being flagged for false endorsements. https://www.404media.co/deepfake-youtube-ads-of-celebrities-promise-to-get-you-rock-hard/

🚔 Authorities shut down Crimenetwork, the Germany's largest crime marketplace cybercrime – German authorities have dismantled Crimenetwork, the largest German-speaking underground marketplace for illegal goods, arresting an administrator and seizing €1 million in assets. The platform facilitated extensive criminal activities since 2012. https://securityaffairs.com/171658/cyber-crime/german-authorities-shut-down-crimenetwork.html

🫥 US officials recommend encrypted messaging to evade hackers in telecom networks security news – FBI and CISA officials advise Americans to use encrypted messaging apps to protect communications from hackers linked to the Chinese group Salt Typhoon, who may still access U.S. telecom networks. https://www.theverge.com/2024/12/4/24313187/encrypted-apps-salt-typhoon-hack-telecom-fbi-cisa

🔍 $1 phone scanner finds seven Pegasus spyware infections privacy – iVerify's $1 diagnostic tool detected seven instances of Pegasus spyware among 2,500 scans, indicating a broader scope of spyware use beyond just targeting activists. The findings challenge the narrative that commercial spyware is only used against a select few. https://arstechnica.com/security/2024/12/1-phone-scanner-finds-seven-pegasus-spyware-infections/

🔑 Your AI clone could target your family, but there’s a simple defense security news – The FBI advises families to establish a secret word or phrase to verify identity and protect against AI voice-cloning scams, as criminals increasingly use AI to impersonate loved ones for fraud. https://arstechnica.com/ai/2024/12/your-ai-clone-could-target-your-family-but-theres-a-simple-defense/

Some More, For the Curious

🤦‍♂️ New era of slop security reports for open source security news – An increase in low-quality security reports from AI tools burdens open source maintainers, leading to burnout and confusion. Better reporting practices are needed to protect valuable contributors. https://sethmlarson.dev/slop-security-reports

💰 Supply Chain Attack Detected in Solana's web3.js Library security research – Versions 1.95.6 and 1.95.7 of the @solana/web3.js library were compromised to steal private keys, risking users' cryptocurrency wallets. Developers are urged to audit and secure their projects immediately. https://socket.dev/blog/supply-chain-attack-solana-web3-js-library

🥚 The Curious Case of an Egg-Cellent Resume security research – A campaign by TA4557/FIN6 exploited resumes to install malware and access servers. The attack involved multiple tactics, including credential theft and lateral movement, using various malicious tools. https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/

🥴 Exploit Intelligence this is part of a post series. take a look at the others! 😉 cyber defense – The article discusses the significance of exploit intelligence in cybersecurity, highlighting the need for organizations to stay informed about vulnerabilities and emerging threats to enhance their defense strategies. https://vulncheck.com/blog/exploit-intelligence

🃏 ICS Hard Knocks: Mitigations to Scenarios Found in ICS/OT Backdoors & Breaches cyber defense – This article outlines essential strategies for securing Industrial Control Systems against cyber threats found in their card game, emphasizing isolation and comprehensive security practices to mitigate risks. https://www.blackhillsinfosec.com/mitigations-to-scenarios-found-in-ics-ot-backdoors-and-breaches/

🌉 Tor Project needs 200 WebTunnel bridges more to bypass Russia' censorship privacy – The Tor Project aims to deploy 200 new WebTunnel bridges by year-end to combat increasing censorship in Russia, where government actions have made existing bridges less accessible. https://securityaffairs.com/171601/digital-id/tor-project-needs-200-webtunnel-bridges.html

🛡️ Building Cyber Resilience Against Ransomware Attacks cyber defense – Ransomware attacks are on the rise, costing organizations an average of $5.24 million. This article outlines a framework for building resilience against ransomware, emphasizing the need for effective response, sustainability, and recovery strategies. https://blog.nviso.eu/2024/12/03/building-cyber-resilience-against-ransomware-attacks/

🔌 Zero Day Initiative — Detailing the Attack Surfaces of the WolfBox E40 EV Charger hacking write-up – The WolfBox E40 EV charger has been analyzed for potential vulnerabilities, revealing attack surfaces via its mobile app and hardware components. The firmware extraction process highlights risks associated with its communications module and embedded OS. https://www.thezdi.com/blog/2024/12/2/detailing-the-attack-surfaces-of-the-wolfbox-e40-ev-charger

📊 Linux Foundation report highlights the true state of open source libraries in production apps security news – The Linux Foundation's Census III report reveals insights on open source libraries in production, emphasizing the rise of Rust for memory safety and ongoing reliance on Python 2, which raises security risks. https://techcrunch.com/2024/12/04/linux-foundation-report-highlights-the-true-state-of-open-source-libraries-in-production-apps/

🔧 Veeam addressed critical Service Provider Console (VSPC) bug vulnerability – Veeam fixed a critical vulnerability (CVE-2024-42448) in its Service Provider Console that could allow remote code execution. Organizations are urged to upgrade to version 8.1.0.21999 to mitigate this and another related vulnerability. https://securityaffairs.com/171651/security/veeam-addressed-critical-service-provider-console-vspc-flaw.html

🏝️ (QR) Coding My Way Out of Here: C2 in Browser Isolation Environments cyber defense – Mandiant reveals a technique to bypass browser isolation using QR codes for command-and-control (C2) communication, highlighting vulnerabilities in browser isolation technologies while recommending continued use as a defense measure against web threats. https://cloud.google.com/blog/topics/threat-intelligence/c2-browser-isolation-environments/

🌶️ White House: Chinese telecom hacks have been in motion for years security news – A White House official revealed that the Salt Typhoon hack, linked to Chinese state-sponsored actors, has impacted eight U.S. telecom companies and has been ongoing for two years, posing risks to communications and requiring urgent cybersecurity measures. https://cyberscoop.com/salt-typhoon-national-security-council-chinese-spying/

🏁 RACE Conditions in Modern Web Applications security research – RACE conditions, where simultaneous processes lead to unpredictable outcomes, remain a security concern in web applications. Recent research highlights new methods to exploit these vulnerabilities, emphasizing the need for proactive mitigation strategies in application development. https://www.guidepointsecurity.com/blog/race-conditions-in-modern-web-applications/

🧫 Analyzing the vulnerability landscape in Q3 2024 security news – Q3 2024 saw an increase in vulnerabilities in Windows and Linux, with notable exploits affecting systems like WinRAR and Microsoft Office. Experts emphasize the importance of timely patching and monitoring to mitigate risks. https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/

CISA Corner

🔒 CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers security news – CISA, alongside the NSA, FBI, and international partners, issued guidance to enhance security following a cyber espionage campaign by a PRC-affiliated threat actor targeting global telecommunications networks. https://www.cisa.gov/news-events/alerts/2024/12/03/cisa-and-partners-release-joint-guidance-prc-affiliated-threat-actor-compromising-networks-global

🔒 Cisco Releases Security Updates for NX-OS Software vulnerability – Cisco has issued security updates for NX-OS software to fix a vulnerability that could allow cybercriminals to gain control of affected systems. Users are advised to review the advisory and apply updates promptly. https://www.cisa.gov/news-events/alerts/2024/12/05/cisco-releases-security-updates-nx-os-software

⚙️ CISA Releases Eight Industrial Control Systems Advisories vulnerability – On December 3, 2024, CISA issued eight advisories addressing vulnerabilities in various Industrial Control Systems, urging users and administrators to review the advisories for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2024/12/03/cisa-releases-eight-industrial-control-systems-advisories ⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – On December 5, 2024, CISA issued two advisories addressing security vulnerabilities in Industrial Control Systems: AutomationDirect C-More EA9 Programming Software and Planet Technology Planet WGS-804HPT, urging users to review them for mitigation strategies. https://www.cisa.gov/news-events/alerts/2024/12/05/cisa-releases-two-industrial-control-systems-advisories

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, urging users to address these risks to federal networks. The vulnerabilities include CVE-2023-45727, CVE-2024-11680, and CVE-2024-11667. https://www.cisa.gov/news-events/alerts/2024/12/03/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2024-51378, a vulnerability in CyberPanel related to incorrect default permissions, to its Known Exploited Vulnerabilities Catalog, highlighting the need for Federal agencies to remediate this risk promptly. https://www.cisa.gov/news-events/alerts/2024/12/04/cisa-adds-one-known-exploited-vulnerability-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 48/2024

December 1, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

📦 Vorsicht vor gefälschten Paketbenachrichtigungen warning – Kriminelle nutzen die Black Friday Zeit, um gefälschte Paketbenachrichtigungen zu versenden, die Nutzer zur Zahlung von angeblichen Versandkosten verleiten und sie in Abofallen locken. https://www.watchlist-internet.at/news/falsche-paketbenachrichtigungen/

🧱 Google blocked 1000 pro China websites from services security news – Google has blocked over 1,000 sites linked to a network promoting pro-China narratives, exposing coordinated disinformation tactics that blur the lines between authentic and fake news. https://www.theregister.com/2024/11/25/google_beijing_propaganda/

📦 Supply chain vendor Blue Yonder succumbs to ransomware cybercrime – Blue Yonder has suffered a ransomware attack, disrupting services and affecting customers like Starbucks and UK retailers, who are struggling to maintain supply chain operations. https://www.theregister.com/2024/11/26/blue_yonder_ransomware/

📞 Malware linked to Salt Typhoon used to hack telcos around the world security news – Salt Typhoon, a sophisticated Chinese APT group, has exploited various vulnerabilities to infiltrate telecom companies globally, using advanced malware and tactics for cyber-espionage. https://cyberscoop.com/salt-typhoon-us-telecom-hack-earth-estries-trend-micro-report/

🔧 Weekend QNAP, Veritas bugs hit patch pipelines vulnerability – QNAP patched 24 vulnerabilities in its products, including critical flaws in Notes Station 3, while Veritas faces delays in addressing seven critical vulnerabilities in its Enterprise Vault software. https://www.theregister.com/2024/11/26/qnap_veritas_vulnerabilities/

🚔 Emergency Vehicle Lights Can Screw Up a Car’s Automated Driving System security research – Research reveals that emergency vehicle lights can disrupt camera-based automated driving systems, causing them to misidentify objects and potentially leading to accidents, highlighting vulnerabilities in AI driving tech. https://www.wired.com/story/emergency-vehicle-lights-can-screw-up-a-cars-automated-driving-system/

🚫 Steam Removes Oct 7 Game at Request of UK Counter-Terrorism Unit security news – Valve removed the game 'Fursan al-Aqsa' from Steam in the UK at the request of the Counter-Terrorism Internet Referral Unit, citing concerns over its portrayal of violence related to the Israel-Palestine conflict. https://www.404media.co/steam-removes-oct-7-game-at-request-of-uk-counter-terrorism-unit/

🔓 Canadian privacy regulators publish details of medical testing company’s data breach data breach – A court ruling has allowed the public release of a report detailing a 2019 data breach at LifeLabs, exposing millions of Canadians' health data and revealing inadequate security measures. https://therecord.media/canadian-privacy-regulators-publish-life-labs-investigation

🦠 Russia-linked hackers exploited Firefox and Windows bugs in 'widespread' hacking campaign security research – RomCom, a Russian-linked hacking group, exploited zero-day vulnerabilities in Firefox and Windows to deploy malware via a 'zero-click' exploit, targeting users in Europe and North America. https://techcrunch.com/2024/11/26/russia-linked-hackers-exploited-firefox-and-windows-zero-day-bugs-in-widespread-hacking-campaign/

🤫 US alleges man is cybercrook with distaste for opsec cybercrime – Nicholas Kloster, 31, is accused of a cybercrime spree in Missouri, including unauthorized access and damage to computers, showing a blatant disregard for operational security. https://www.theregister.com/2024/11/26/kansas_city_cybercrime_charges/

📊 Someone Made a Dataset of One Million Bluesky Posts for 'Machine Learning Research' privacy – A dataset of one million public Bluesky posts was released for machine learning research but was later removed by its creator, citing violations of transparency and consent principles. https://www.404media.co/someone-made-a-dataset-of-one-million-bluesky-posts-for-machine-learning-research/

👔 NSO Group Spies on People on Behalf of Governments privacy – NSO Group, known for selling Pegasus spyware, reportedly operates the spyware on behalf of governments, revealing that they install and extract data from targeted devices themselves. https://www.schneier.com/blog/archives/2024/11/nso-group-spies-on-people-on-behalf-of-governments.html

⚖️ Judge rejects data brokers’ bid to throw out case brought by law enforcement officers privacy – A federal judge denied data brokers' motion to dismiss a lawsuit by New Jersey law enforcement officers under Daniel's Law, which protects their personal information from being disclosed online. https://therecord.media/judge-rejects-bid-to-throw-out-data-broker-police-privacy-case

🎮 Russian Disinformation Campaign Spreads Lies About Ukraine's ‘Stalker 2’ security news- A Russian disinformation campaign falsely claims that the Ukrainian game Stalker 2 is used for military enlistment and data collection, aiming to undermine the game's significance amidst the ongoing conflict. https://www.404media.co/stalker2-disinformation/

📳 T-Mobile says telco hackers had 'no access' to customer call and text message logs data breach – T-Mobile stated that hackers did not access customer calls, texts, or voicemails during a cyberattack linked to the China-backed group Salt Typhoon, while emphasizing their robust cybersecurity measures. https://techcrunch.com/2024/11/27/t-mobile-says-telco-hackers-had-no-access-to-customer-call-and-text-message-logs/

🚢 Investigators think a Chinese ship purposefully cut critical data cables security news – European investigators allege a Chinese ship intentionally dragged its anchor to sever two critical data cables, potentially linked to Russian intelligence, while the Kremlin denies involvement. https://techcrunch.com/2024/11/27/investigators-think-a-chinese-ship-purposefully-cut-critical-data-cables/

💻 Mimic Ransomware: What You Need To Know malware – Mimic ransomware, first identified in 2022, encrypts files and may exfiltrate data, leveraging the legitimate 'Everything' tool for quick file access. Infected files have a '.QUIETPLACE' extension, and a new variant called Elpaco has emerged, targeting systems via RDP. https://www.tripwire.com/state-of-security/mimic-ransomware-what-you-need-know

⚽ Italian football club Bologna FC says company data stolen during ransomware attack data breach – Bologna FC confirmed a ransomware attack by RansomHub, resulting in the theft of 200GB of sensitive data, including financial documents and player medical records, which may be leaked online. https://therecord.media/italian-football-club-blogna-fc-ransomware

📱 15 SpyLoan Android apps found on Google play had over 8 million installs malware – McAfee identified 15 SpyLoan apps on Google Play with over 8 million installs, exploiting users through deceptive tactics to collect sensitive data and leading to extortion and harassment. https://securityaffairs.com/171553/cyber-crime/15-spyloan-android-apps-on-google-play.html

Some More, For the Curious

🤦‍♂️ Malicious NPM Package Exploits React Native Documentation Example security research – A malicious npm package mimicked official React Native documentation, tricking developers and highlighting vulnerabilities in supply chain security. Vigilance is essential to prevent such attacks. https://checkmarx.com/blog/malicious-npm-package-exploits-react-native-documentation-example/

🗳️ Security Analysis of the MERGE Voting Protocol security research – The MERGE voting protocol, intended for internet voting, is criticized for its fundamental flaws and the impracticality of ensuring trustworthy elections without significant legal and administrative reforms. https://www.schneier.com/blog/archives/2024/11/security-analysis-of-the-merge-voting-protocol.html

🎮 The Exploitation of Gaming Engines: A New Dimension in Cybercrime cybercrime – Cybercriminals exploit Godot Engine to distribute malware undetected, infecting over 17,000 machines. This new trend poses significant risks to developers and gamers alike. https://blog.checkpoint.com/research/the-exploitation-of-gaming-engines-a-new-dimension-in-cybercrime/

🚨 Malware campaign abused flawed Avast Anti security research – Threat actors exploited a vulnerable Avast Anti-Rootkit driver to gain kernel-level access, disable security tools, and compromise systems, highlighting the risks of flawed drivers in malware campaigns. https://securityaffairs.com/171340/hacking/avast-anti-rootkit-driver-abused-malware-campaign.html

🛡️ Zyxel firewalls targeted in recent ransomware attacks vulnerability – Zyxel warns that a ransomware group is exploiting a patched command injection vulnerability in its firewalls, allowing attackers to execute OS commands if certain conditions are met. https://securityaffairs.com/171382/cyber-crime/zyxel-firewall-ransomware-attacks.html

🔑 BitLocker Security: Are Your Keys Truly Safe? hacking write-up – BitLocker's security relies on the TPM, but its default configuration may expose vulnerabilities. Without additional authentication, attackers can sniff the TPM bus and access encryption keys, compromising data. https://blog.nviso.eu/2024/11/26/wake-up-and-smell-the-bitlocker-keys/

🧑‍💻 The source code of Banshee Stealer leaked online malware – Banshee Stealer, a macOS malware for stealing sensitive data, has had its source code leaked on GitHub, leading to the shutdown of its operations by the developers. https://securityaffairs.com/171423/malware/the-source-code-of-banshee-stealer-leaked-online.html

📄 The Four Question Framework for Threat Modeling security research – Shostack + Associates has released a free whitepaper on the Four Question Framework for Threat Modeling, emphasizing the importance of consistent phrasing to maintain nuance and intent in security discussions. https://shostack.org/blog/four-question-frame/

⚠️ ProjectSend critical flaw actively exploited in the wild, experts warn vulnerability – A critical vulnerability in ProjectSend (CVE-2024-11680) is being actively exploited, allowing unauthorized access and webshell uploads. Many instances remain unpatched, raising significant security concerns. https://securityaffairs.com/171494/hacking/projectsend-critical-flaw-actively-exploited.html

🏇 Race Condition Attacks against LLMs security research – New attacks against LLMs include 'Flowbreaking,' which disrupts guardrails, and 'Second Thoughts,' where LLMs retract sensitive content if a user interrupts the response. These exploit vulnerabilities in the surrounding application architecture. https://www.schneier.com/blog/archives/2024/11/race-condition-attacks-against-llms.html

🔒 Zabbix urges upgrades after SQL injection bug disclosure vulnerability – Zabbix warns of a critical SQL injection vulnerability (CVE-2024-42327) affecting multiple product versions, potentially allowing full system compromise. Users are urged to upgrade to the latest versions for protection. https://www.theregister.com/2024/11/29/zabbix_urges_upgrades_after_critical/

🐱 Code found online exploits LogoFAIL to install Bootkitty Linux backdoor malware – Malicious code exploiting the LogoFAIL vulnerability can hijack the boot process of certain Linux devices from manufacturers like Acer and HP, allowing installation of the Bootkitty backdoor without user interaction. https://arstechnica.com/security/2024/11/code-found-online-exploits-logofail-to-install-bootkitty-linux-backdoor/

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2023-28461, a vulnerability in Array Networks, to its catalog due to active exploitation, underscoring the need for federal agencies to address known vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2024/11/25/cisa-adds-one-known-exploited-vulnerability-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 47/2024

November 24, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

⚠️ PSA: You shouldn't upload your medical images to AI chatbots privacy – Users are cautioned against uploading private medical images to AI chatbots like Grok, as it risks exposing sensitive data, which may be used to train models and shared without clear protections. https://techcrunch.com/2024/11/19/psa-you-shouldnt-upload-your-medical-images-to-ai-chatbots/

News For All

🌟 These alternatives to popular apps can help reclaim your online life from billionaires and surveillance privacy – Explore privacy-focused alternatives to popular apps that empower you to control your data, avoiding surveillance and monetization by big tech companies. https://techcrunch.com/2024/11/24/these-alternatives-to-popular-apps-can-help-reclaim-your-online-life-from-billionaires-and-surveillance/

🕵️‍♀️ Women In Russian-Speaking Cybercrime: Mythical Creatures or Significant Members of Underground? cybercrime – This article explores the underrepresented roles of women in Russian-speaking cybercrime, revealing their contributions, challenges, and evolving dynamics amid geopolitical tensions, highlighting both historical and contemporary insights. https://www.sans.org/blog/women-in-russian-speaking-cybercrime-mythical-creatures-or-significant-members-of-underground

🎶 Spotify abused to promote pirated software and game cheats cybercrime – Threat actors are exploiting Spotify playlists and podcasts to promote pirated software and game cheats, leveraging Spotify's SEO benefits to drive traffic to malicious sites. https://www.bleepingcomputer.com/news/security/spotify-abused-to-promote-pirated-software-and-game-cheats/

🦠 Facebook Malvertising Campaign Spreads Malware via Fake Bitwarden malware – A malvertising campaign on Facebook disguised as Bitwarden updates spreads malware through fake ads, tricking users into installing malicious Chrome extensions that exploit business accounts. https://hackread.com/facebook-malvertising-malware-via-fake-bitwarden/

⚠️ Really Simple Security plugin flaw impacts 4M+ WordPress sites vulnerability – A critical vulnerability (CVE-2024-10924) in the Really Simple Security plugin affects over 4 million WordPress sites, allowing attackers to bypass authentication and gain full admin access. A fix has been released. https://securityaffairs.com/171100/hacking/really-simple-security-plugin-flaw-affects-4m-sites.html

💻 Ransomware gang Akira leaks unprecedented number of victims’ data in one day cybercrime – The Akira ransomware gang leaked a record 35 victims' data in one day, showcasing their aggressive tactics. This marks a significant surge in their operations since emerging in 2023. https://therecord.media/akira-ransomware-group-publishes-unprecedented-leak-data

🚨 Alleged Russian Phobos ransomware administrator extradited to U.S., in custody cybercrime – Evgenii Ptitsyn, a Russian alleged Phobos ransomware administrator, has been extradited to the U.S. after extorting over $16 million from more than 1,000 victims worldwide, facing multiple charges. https://cyberscoop.com/alleged-russian-phobos-ransomware-administrator-extradited-to-u-s-in-custody/

🛒 Scammer Black Friday offers: Online shopping threats and dark web sales security news – Kaspersky's report highlights the surge in online shopping-related cyber threats, including phishing attacks, fake mobile apps, and banking trojans, emphasizing the risks during Black Friday and the role of the dark web in selling stolen data. https://securelist.com/black-friday-report-2024/114589/

🔒 Microsoft beefs up Windows security with new recovery and patching features security news – In response to the CrowdStrike outage, Microsoft announced enhancements to Windows security, including Quick Machine Recovery, kernel mode changes for antivirus, and Administrator Protection for user permissions, aimed at improving system resilience and recovery. https://techcrunch.com/2024/11/19/microsoft-beefs-up-windows-security/

⚖️ German court says victims of massive Facebook data breach can be compensated data breach – A German court ruled that victims of the 2021 Facebook data breach can claim €100 ($105) in compensation, acknowledging non-material damage due to loss of control over personal data, despite no financial loss evidence. https://therecord.media/german-court-says-victims-facebook-breach-compensation

🌍 Niantic uses Pokémon Go player data to build AI navigation system security news – Niantic is developing a 'Large Geospatial Model' for AI navigation, using visual scans from Pokémon Go and Scaniverse players, leveraging over 10 million scanned locations worldwide to enhance augmented reality applications. https://arstechnica.com/ai/2024/11/niantic-uses-pokemon-go-player-data-to-build-ai-navigation-system/

📍 Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany security news – A report reveals that a data broker is selling detailed location data of US military and intelligence personnel in Germany, raising national security concerns as this information can be exploited for espionage and other malicious activities. https://www.wired.com/story/phone-data-us-soldiers-spies-nuclear-germany/

📺 Unsecured JupyterLab and Jupyter Notebooks servers abused for illegal streaming of Sports events security research – Threat actors exploit misconfigured JupyterLab and Jupyter Notebook servers to hijack environments for illegal sports streaming, using tools like ffmpeg to capture and redistribute broadcasts, posing significant risks to organizations. https://securityaffairs.com/171193/cyber-crime/misconfigured-jupyterlab-and-jupyter-notebooks-illegal-live-sports-streaming.html

📱 Malicious QR Codes: How big of a problem is it, really? security news – Malicious QR codes exploit weaknesses in anti-spam filters, with around 60% of emails containing QR codes being spam. Security experts recommend caution when scanning QR codes, as they can lead to phishing or malware sites. https://blog.talosintelligence.com/malicious_qr_codes/

🚸 UK says a new law banning social media for under-16s is 'on the table' security news – The UK government is considering a ban on social media for under-16s to protect children's wellbeing, with a new study announced to assess social media's impact. The proposal aligns with the upcoming Online Safety Act aimed at enhancing online safety for children. https://therecord.media/britain-social-media-ban-children-proposal

🏥 750,000 Patients' Medical Records Exposed After Data Breach at French data breach – A cyber attack on a French hospital exposed the medical records of over 750,000 patients, with the hacker claiming access to data from multiple healthcare facilities. The breach was linked to stolen login credentials for the Mediboard system. https://www.tripwire.com/state-of-security/750000-patients-medical-records-exposed-after-data-breach-french-hospital

💰 DeliveryHero subsidiary fined \$5.2 million for tracking drivers’ geolocation privacy – Italy's data privacy regulator fined Foodinho S.r.l. €5 million ($5.2 million) for illegally tracking drivers' geolocation, including outside working hours, and sharing data with third parties without consent. The company is also prohibited from using biometric data for identity verification. https://therecord.media/deliveryhero-subsidiary-fined-5-million-geolocation-data

🐖 Meta cracks down on millions of accounts it tied to pig-butchering scams security news – Meta has removed millions of accounts linked to pig-butchering scams, a fraudulent scheme costing victims billions. The crackdown aims to protect users from organized crime. https://cyberscoop.com/meta-cracks-down-on-millions-of-accounts-it-tied-to-pig-butchering-scams/

🎉 Hackers break into Andrew Tate’s online ‘university,’ steal user data and flood chats with emojis data breach – Hackers accessed data of nearly 800,000 users from Andrew Tate's online course, leaking emails and private chats while disrupting chats. https://techcrunch.com/2024/11/21/hackers-break-into-andrew-tates-online-university-steal-user-data-and-flood-chats-with-emojis/

Some More, For the Curious

🔓 BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA security research – BrazenBamboo exploits a zero-day vulnerability in FortiClient to extract user VPN credentials using their DEEPDATA malware, highlighting the ongoing threat of credential theft. https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/

🔒 What To Use Instead of PGP security research – The article argues against using PGP for secure communications, recommending better alternatives like Sigstore, SSH signatures, Magic Wormhole, and Signal for various use cases, emphasizing modern tools over outdated methods. https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

🛡️ Inside the Threat: A Behind-the-Scenes Look at Stopping an Active Intrusion cyber defense – This article details a proactive investigation into an active intrusion, showcasing how early detection, vigilant employees, and layered security measures thwarted a potentially devastating ransomware attack. https://sec-consult.com/blog/detail/inside-the-threat-a-behind-the-scenes-look-at-stopping-an-active-intrusion/

📝 Azure Detection Engineering: Log idiosyncrasies you should know about cyber defense – This article discusses various inconsistencies and intricacies in Azure logs, including schema, IP addresses, user-agent fields, and UUID formatting, offering insights for better monitoring and detection in Azure environments. https://tracebit.com/blog/azure-detection-engineering-log-idiosyncrasies-you-should-know-about

🔍 CVE-2024-10524 Wget Zero Day Vulnerability vulnerability – A zero-day vulnerability (CVE-2024-10524) in Wget allows attackers to exploit shorthand HTTP URLs, potentially leading to phishing, SSRF, and MiTM attacks. A patch has been released in version 1.25.0. https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/

⚠️ Critical 9.8-rated VMware vCenter RCE bug under exploit security news – Two VMware vCenter vulnerabilities, CVE-2024-38812 and CVE-2024-38813, have been confirmed exploited in the wild, including a critical RCE flaw rated 9.8. Urgent fixes are required. https://www.theregister.com/2024/11/18/vmware_vcenter_rce_exploited/

🎈 Microsoft announces its own Black Hat-like hacking event with big rewards for AI security security news – Microsoft is launching Zero Day Quest, a major hacking event aimed at discovering cloud and AI security flaws, offering $4 million in rewards. The event emphasizes collaboration with security researchers and aims to enhance industry-wide security practices. https://www.theverge.com/2024/11/19/24299999/microsoft-zero-day-quest-hacking-event-ai-cloud-security

🩶 Leaked Documents Show What Phones Secretive Tech ‘Graykey’ Can Unlock privacy – Leaked documents reveal that Graykey, a law enforcement tool for unlocking phones, can only access partial data from modern iPhones running iOS 18 and iOS 18.0.1, highlighting the ongoing battle between forensics tools and phone security. https://www.404media.co/leaked-documents-show-what-phones-secretive-tech-graykey-can-unlock-2/

🛠️ Botnet serving as ‘backbone’ of malicious proxy network taken offline security research – The ngioweb botnet, a key player in malicious proxy services, has been dismantled by security experts. This botnet, primarily composed of compromised IoT devices and routers, facilitated various cybercrimes, including DDoS attacks and credential stuffing. https://cyberscoop.com/proxy-services-cybercrime-ngioweb-botnet-nsocks/

🔒 Fintech giant Finastra confirms it's investigating a data breach data breach – Finastra is investigating a data breach involving its internal Secure File Transfer Platform after a hacker claimed to sell 400GB of stolen data from the company’s banking clients. Initial evidence suggests compromised credentials. https://techcrunch.com/2024/11/20/fintech-giant-finastra-confirms-its-investigating-a-data-breach/

🖇️ D-Link says replace vulnerable routers or risk pwnage vulnerability – D-Link has advised users of older VPN router models to replace them due to a serious unauthenticated remote code execution vulnerability. The company will not issue patches for affected devices, which have reached end of life, and is offering a discount on a new model. https://www.theregister.com/2024/11/20/dlink_rip_replace_router/

🔒 A new ‘ultra-secure’ phone carrier says it can make you harder to track security news – Cape, a new privacy-focused phone carrier, aims to protect users' data by minimizing personal information collection and offering a pre-configured Android phone with enhanced security features, targeting high-risk individuals. https://www.theverge.com/2024/11/21/24302416/cape-ultra-secure-phone-data-collection-tracking

🎛️ Finding Access Control Vulnerabilities with Autorize cyber defense – This article discusses how to identify access control vulnerabilities using Autorize, focusing on vertical and horizontal access control issues in web applications, and highlights the importance of proper session management and user permissions. https://www.blackhillsinfosec.com/finding-access-control-vulnerabilities-with-autorize/

🏘️ Spies hack Wi-Fi networks in far-off land to launch attack on target next door security research – Russian hackers linked to Fancy Bear executed a 'Nearest Neighbor Attack' by compromising a nearby Wi-Fi-enabled device to access a high-value target's network, exploiting credential weaknesses without needing physical proximity. https://arstechnica.com/security/2024/11/spies-hack-wi-fi-networks-in-far-off-land-to-launch-attack-on-target-next-door/

😱 'Alarming' security bugs lay low in Linux's needrestart utility for 10 years vulnerability – Five critical vulnerabilities in the needrestart utility allow local attackers to gain root access, posing severe risks to system security. Immediate updates are urged. https://www.theregister.com/2024/11/21/qualys_needrestart_linux_vulnerabilities/

CISA Corner

🔍 Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a US Critical Infrastructure Sector Organization security research – CISA conducted a red team assessment revealing critical vulnerabilities in a US critical infrastructure organization, highlighting issues with insufficient technical controls, lack of staff training, and ineffective monitoring that allowed attackers to exploit systems. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-326a

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog, including command injection and authentication bypass flaws in Kemp LoadMaster and Palo Alto Networks PAN-OS, urging users to review related security bulletins. https://www.cisa.gov/news-events/alerts/2024/11/18/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has added two vulnerabilities, CVE-2024-38812 and CVE-2024-38813, related to VMware vCenter Server, to its Known Exploited Vulnerabilities Catalog, highlighting significant risks for federal agencies and the need for prompt remediation. https://www.cisa.gov/news-events/alerts/2024/11/20/cisa-adds-two-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog, including code execution and XSS vulnerabilities in Apple products and an incorrect authorization flaw in Oracle PLM, highlighting significant risks for federal agencies. https://www.cisa.gov/news-events/alerts/2024/11/21/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases One Industrial Control Systems Advisory vulnerability – CISA issued an advisory (ICSA-24-324-01) on November 19, 2024, regarding vulnerabilities in Mitsubishi Electric's MELSEC iQ-F Series. Users are urged to review the advisory for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2024/11/19/cisa-releases-one-industrial-control-systems-advisory ⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA has released seven advisories on November 21, 2024, addressing security issues and vulnerabilities in various Industrial Control Systems, including products from Automated Logic and Schneider Electric. https://www.cisa.gov/news-events/alerts/2024/11/21/cisa-releases-seven-industrial-control-systems-advisories

🔒 Apple Releases Security Updates for Multiple Products security news – Apple has released security updates to fix vulnerabilities in various products, warning that cyber threat actors could exploit these flaws to gain control of affected systems. Users are urged to apply the updates. https://www.cisa.gov/news-events/alerts/2024/11/20/apple-releases-security-updates-multiple-products

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 46/2024

November 18, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

🐦 Einladung ins Fediverse: Mastodon als Alternative zu X, Instagram und Co. privacy – The article invites readers to consider Mastodon as a privacy-friendly alternative to popular social media platforms like X and Instagram, encouraging sharing and engagement through various channels. https://www.kuketz-blog.de/einladung-ins-fediverse-mastodon-als-alternative-zu-x-instagram-und-co/

🛡️ Kritische Sicherheitslücke in Laravel Framework – Updates verfügbar warning – The article about a critical vulnerability in Laravel is provided by CERT.at, Austria's Computer Emergency Response Team. https://www.cert.at/de/warnungen/2024/11/kritische-sicherheitslucke-in-laravel-framework-updates-verfugbar

News For All

❓ Brauchst du wirklich ein VPN? privacy – The article explores whether a VPN is necessary for online privacy and security, highlighting both its benefits and limitations in protecting personal data. https://www.kuketz-blog.de/brauchst-du-wirklich-ein-vpn/

💼 Hacker erbeuten Firmendaten des Statistischen Bundesamtes data breach – A hacker group has stolen and is selling sensitive data from Germany's Federal Statistical Office, including contact details and access credentials, raising significant privacy concerns. https://www.golem.de/news/cyberangriff-auf-destatis-hacker-erbeuten-firmendaten-des-statistischen-bundesamtes-2411-190805.html

💳 200,000 SelectBlinds customers have their cards skimmed in malware attack data breach – SelectBlinds revealed a breach affecting over 206,000 customers due to malware on its checkout page, compromising sensitive information, including credit card details. Users are advised to reset passwords and monitor statements. https://www.bitdefender.com/en-us/blog/hotforsecurity/200-000-selectblinds-customers-card-details-skimmed-malware-attack/

🔑 These are the passwords you definitely shouldn’t be using security news – NordPass released its annual list of the most common passwords, revealing a lack of creativity with '123456' topping the chart. Users are urged to create more secure passwords or consider using passkeys. https://www.theverge.com/2024/11/13/24295543/most-common-passwords-list-2024

🕵️‍♀️ The WIRED Guide to Protecting Yourself From Government Surveillance privacy – With the potential expansion of government surveillance under a new administration, experts recommend various privacy protections, including encrypted communications, device encryption, and careful management of location and financial data. https://www.wired.com/story/the-wired-guide-to-protecting-yourself-from-government-surveillance/

🚨 Criminals Exploiting FBI Emergency Data Requests cybercrime – Cybercriminals have exploited compromised police accounts to impersonate law enforcement and request user data, resulting in unauthorized access to sensitive information from companies. This highlights vulnerabilities in lawful-access mechanisms. https://www.schneier.com/blog/archives/2024/11/criminals-exploiting-fbi-emergency-data-requests.html

📃 'FYI. A Warrant Isn’t Needed': Secret Service Says You Agreed To Be Tracked With Location Data privacy – Internal emails reveal the Secret Service's debate on needing warrants for location data from apps, claiming users consented through terms of service, despite concerns over illegal usage of the data. https://www.404media.co/fyi-a-warrant-isnt-needed-secret-service-says-you-agreed-to-be-tracked-with-location-data/

🔓 Delta, Amazon confirm vendor breach as dark web posts revive MOVEit leak concerns data breach – Delta and Amazon confirmed that employee data was stolen from a vendor via a MOVEit vulnerability. The leaked data, including contact information, has reignited concerns about previous breaches tied to the Clop ransomware gang. https://therecord.media/delta-amazon-vendor-breach-confirmed

👁️ ICE Started Ramping Up Its Surveillance Arsenal Immediately After Donald Trump Won privacy – Immediately following Trump's election, ICE sought contracts to enhance surveillance technologies for monitoring non-citizens awaiting deportation, anticipating a dramatic increase in those under surveillance from 200,000 to over 5 million. https://www.wired.com/story/ice-surveillance-contracts-isap/

📱 Safer with Google: New intelligent, real-time protections on Android to keep you safe security news – The article discusses Google's latest advancements in online security features aimed at enhancing user safety through intelligent systems and real-time protection mechanisms. https://security.googleblog.com/2024/11/new-real-time-protections-on-Android.html

🎧 These Guys Hacked AirPods to Give Their Grandmas Hearing Aids hacking write-up – Three technologists in India hacked AirPods Pro 2 to enable hearing aid features by creating a Faraday cage to bypass Apple's location restrictions, allowing their grandmothers to use the technology. https://www.wired.com/story/apple-airpods-hearing-aid-hack/

👶 Pregnancy Tracking App ‘What to Expect’ Refuses to Fix Issue that Allows Full Account Takeover privacy – The 'What to Expect' pregnancy tracking app is neglecting serious vulnerabilities, including one enabling full account takeover, which risks exposing users' sensitive reproductive health information amid rising concerns for privacy and safety. https://www.404media.co/pregnancy-tracking-app-what-to-expect-refuses-to-fix-issue-that-allows-full-account-takeover-2/

💬 An Interview With the Target & Home Depot Hacker – Krebs on Security cybercrime – Mikhail Shefel, the identity behind the Rescator alias, discusses his role in the Target and Home Depot breaches, his connections to other hackers, and his current financial struggles following legal issues and arrests. https://krebsonsecurity.com/2024/11/an-interview-with-the-target-home-depot-hacker/

🤏 ShrinkLocker Ransomware: What You Need To Know malware – ShrinkLocker is a new ransomware that uses VBScript and BitLocker to encrypt victims' files, locking them out without providing a password. It changes drive names to an attacker's contact, but Bitdefender offers a free decryption tool. https://www.tripwire.com/state-of-security/shrinklocker-ransomware-what-you-need-know

📬 Scammers resort to physical Swiss post to spread malware cybercrime – Switzerland's NCSC warns of a new scam where malware is spread through fake letters mimicking official weather alerts. Recipients are tricked into downloading a malicious app containing the Coper trojan, targeting banking information. https://www.theregister.com/2024/11/16/swiss_malware_qr/

Some More, For the Curious

🤔 Newag admits: Dragon Sector hackers did not modify software in Impuls trains I missed this one a few weeks earlier. security news – Newag's lawsuit against hackers reveals that while they claim no software modifications were made, they still face questions about intentional software locks in their trains. The truth remains elusive. https://rys.io/en/175.html

🦠 A new fileless variant of Remcos RAT observed in the wild malware – Fortinet has identified a phishing campaign distributing a new variant of Remcos RAT, using an Excel document to exploit vulnerabilities and stealthily execute malware, granting attackers remote access. https://securityaffairs.com/170791/security/a-new-fileless-variant-of-remcos-rat-phishing.html

💻 North Korean-linked hackers were caught experimenting with new macOS malware malware – Researchers found North Korean hackers embedding malware in macOS applications using an open-source SDK, capable of bypassing Apple's security. The malware shows ties to cryptocurrency intrusions but its use remains uncertain. https://cyberscoop.com/north-korea-macos-malware-flutter-jamf/

⚙️ Exploit code released for RCE attack on Citrix VDI solution vulnerability – Researchers released a PoC exploit for a vulnerability in Citrix's Virtual Apps and Desktops, allowing remote code execution via HTTP requests. Citrix disputes the claim of unauthenticated access, urging users to apply hotfixes. https://www.theregister.com/2024/11/12/http_citrix_vuln/

🔧 Zero Day Initiative — The November 2024 Security Update Review security news – Adobe and Microsoft released significant patches in November, addressing numerous vulnerabilities across various products. Key issues include critical RCE flaws in Windows and multiple critical updates from Adobe. https://www.thezdi.com/blog/2024/11/12/the-november-2024-security-update-review

🥼 Inside the DemandScience by Pure Incubation Data Breach data breach – The article discusses the DemandScience data breach, revealing how personal data was aggregated and sold. It highlights public concerns about data privacy, expectations of notification, and the implications of data misuse. https://www.troyhunt.com/inside-the-demandscience-by-pure-incubation-data-breach/

🌐 A three beats waltz: The ecosystem behind Chinese state-sponsored cyber threats security research – The article analyzes the complex ecosystem of Chinese state-sponsored cyber operations, highlighting the roles of the PLA, MSS, and MPS, along with the involvement of private companies and patriotic hackers in cyber offensives. https://blog.sekoia.io/a-three-beats-waltz-the-ecosystem-behind-chinese-state-sponsored-cyber-threats/

🔗 China's Volt Typhoon botnet has re security research – The Volt Typhoon botnet has resurfaced, using the same infrastructure and techniques to target critical infrastructure in the U.S. and Guam. Despite previous disruptions, it remains a significant threat, exploiting outdated devices. https://securityaffairs.com/170872/apt/volt-typhoon-botnet-has-re-emerged.html

📉 NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikely security news – NIST announced it has cleared a backlog of unanalyzed exploited vulnerabilities with support from CISA and the private sector. However, it will not meet its goal of clearing all vulnerabilities by year-end due to data processing challenges. https://therecord.media/nist-vulnerability-backlog-cleared-cisa

💰 Crimeware and financial predictions for 2025 security news – Kaspersky's report predicts an increase in AI-powered cyberattacks, supply chain attacks, and financial threats targeting central banks and smartphones in 2025, highlighting evolving tactics in the crimeware landscape. https://securelist.com/ksb-financial-and-crimeware-predictions-2025/114565/

🔑 Good Essay on the History of Bad Password Policies security research – Stuart Schechter discusses the history of ineffective password policies, highlighting mistakes made by Morris and Thompson in assuming that their interventions would lead to strong passwords without adequate testing or metrics. https://www.schneier.com/blog/archives/2024/11/good-essay-on-the-history-of-bad-password-policies.html

🔍 NSO Group admits cutting off 10 customers because they abused its Pegasus spyware, say unsealed court documents security news – Court documents reveal NSO Group cut off 10 customers for abusing its Pegasus spyware, which exploited WhatsApp vulnerabilities. The revelations raise concerns about NSO's operations and the use of its tools against individuals, including high-profile targets. https://techcrunch.com/2024/11/15/nso-group-admits-cutting-off-10-customers-because-they-abused-its-pegasus-spyware-say-unsealed-court-documents/

🪪 Defending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitation cyber defense – Misconfigurations in Active Directory Certificate Services can lead to serious vulnerabilities, enabling attackers to gain unauthorized access and escalate privileges within a domain. https://www.nccgroup.com/us/research-blog/defending-your-directory-an-expert-guide-to-fortifying-active-directory-certificate-services-adcs-against-exploitation/

CISA Corner

🔒 2023 Top Routinely Exploited Vulnerabilities security news – A joint advisory from cybersecurity agencies highlights an increase in zero-day vulnerabilities exploited in 2023, urging software developers and end-users to implement secure practices and timely patching to mitigate risks. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a

⚠️ CISA Adds Five Known Exploited Vulnerabilities to Catalog warning – CISA has included five new vulnerabilities in Atlassian Jira, Cisco ASA, Metabase GeoJSON and Microsoft Windows to its Known Exploited Vulnerabilities Catalog, emphasizing their active exploitation risks. https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has included two new vulnerabilities in its Known Exploited Vulnerabilities Catalog: CVE-2024-9463 and CVE-2024-9465, both related to Palo Alto Networks Expedition, highlighting significant risks to federal networks. https://www.cisa.gov/news-events/alerts/2024/11/14/cisa-adds-two-known-exploited-vulnerabilities-catalog

🏭 CISA Releases Nineteen Industrial Control Systems Advisories vulnerability – CISA has published nineteen advisories addressing security vulnerabilities in Industrial Control Systems. Siemens, Rockwell, Hitachi, 2N, Elvaco, Baxter https://www.cisa.gov/news-events/alerts/2024/11/14/cisa-releases-nineteen-industrial-control-systems-advisories 🏭 CISA Releases Five Industrial Control Systems Advisories vulnerability – CISA has published five advisories detailing security vulnerabilities and exploits related to various Industrial Control Systems. Subnet, Hitachi, Rockwell, Mitsubishi, Snap One https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-releases-five-industrial-control-systems-advisories

🔒 Fortinet Releases Security Updates for Multiple Products https://www.cisa.gov/news-events/alerts/2024/11/12/fortinet-releases-security-updates-multiple-products 🛡️ Adobe Releases Security Updates for Multiple Products https://www.cisa.gov/news-events/alerts/2024/11/12/adobe-releases-security-updates-multiple-products 🔐 Microsoft Releases November 2024 Security Updates https://www.cisa.gov/news-events/alerts/2024/11/12/microsoft-releases-november-2024-security-updates 🔧 Ivanti Releases Security Updates for Multiple Products https://www.cisa.gov/news-events/alerts/2024/11/12/ivanti-releases-security-updates-multiple-products 🔒 Citrix Releases Security Updates for NetScaler and Citrix Session Recording https://www.cisa.gov/news-events/alerts/2024/11/12/citrix-releases-security-updates-netscaler-and-citrix-session-recording

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub