📰wrzlbrmpft's cyberlights💥

cyberlights – week 36/2024

September 8, 2024

Back after vacation – My weekly shortlist of cyber security highlights. (maybe I'll even redo the skipped weeks 😏) The short summaries are AI generated! If something is wrong, please let me know.

News For All

🕵️‍♂️ Ausweiskopie und persönliche Daten an Kriminelle weitergegeben? Das können Sie tun security news – Criminals exploit job offers and ads to steal personal data and ID copies, leading to identity theft, fraudulent accounts, and potential legal consequences for victims. https://www.watchlist-internet.at/news/umgang-mit-datendiebstahl/

✈️ SQL Injection Attack on Airport Security vulnerability – A serious SQL injection vulnerability allows unauthorized users to bypass airport security checks, risking safety by granting access to restricted areas like cockpits. https://www.schneier.com/blog/archives/2024/09/sql-injection-attack-on-airport-security.html

🛫 German air traffic control agency confirms cyberattack, says operations unaffected security news – Germany's air traffic control agency confirmed a cyberattack affecting administrative systems but assured that flight safety remains intact and operations were not disrupted. https://therecord.media/german-air-traffic-control-company-deutsche-flugsicherung-cyberattack

🚍 Transport for London (TfL) is dealing with an ongoing cyberattack security news – TfL is investigating a cyberattack affecting internal systems but reports no evidence of customer data compromise, assuring that services remain unaffected. https://securityaffairs.com/167946/hacking/transport-for-london-tfl-ongoing-cyberattack.html

🔑 Owners of 1-Time Passcode Theft Service Plead Guilty cybercrime – Three men pleaded guilty for operating OTP Agency, a service that intercepted one-time passcodes for account takeovers, affecting over 12,500 victims before its shutdown. https://krebsonsecurity.com/2024/09/owners-of-1-time-passcode-theft-service-plead-guilty/

🦠 Disinfo group Spamouflage more aggressively targeting U.S. elections, candidates cybercrime – The disinformation group Spamouflage has intensified efforts to impersonate U.S. voters, undermining political candidates and institutions, though its impact on engagement remains limited. https://cyberscoop.com/spamouflage-targeting-us-election-candidates/

📸 Sextortion Scams Now Include Photos of Your Home – Krebs on Security cybercrime – Sextortion scams are evolving, now featuring personalized threats with photos of victims' homes, increasing fear and urgency to pay ransoms, often near $2,000 in Bitcoin. https://krebsonsecurity.com/2024/09/sextortion-scams-now-include-photos-of-your-home/

💰 Data watchdog fines Clearview AI $33M privacy – The Dutch Data Protection Authority fined Clearview AI €30.5 million for illegally collecting images without consent, stating the company's practices violate GDPR and threaten individual privacy. https://www.theregister.com/2024/09/03/clearview_ai_dutch_fine/

🔒 Google releases Pixel update to get rid of surveillance vulnerability vulnerability – Google's latest Pixel update removes the insecure Showcase.apk, originally intended for Verizon demos, which posed risks of man-in-the-middle attacks and spyware, ensuring enhanced device security. https://www.theverge.com/2024/9/3/24235127/google-pixel-showcase-vulnerability-patch

🔑 YubiKeys have an unfixable security flaw — but it’s difficult to exploit vulnerability – A vulnerability in older YubiKey devices allows cloning but is hard to exploit, requiring physical access and additional knowledge. Devices prior to firmware version 5.7 remain permanently affected. https://www.theverge.com/2024/9/4/24235635/yubikey-unfixable-security-vulnerability-side-channel-explot

🚨 846 routers are affected by code execution flaws. Replace them! vulnerability – D-Link's discontinued DIR-846 routers are vulnerable to multiple critical remote code execution flaws (CVSS scores up to 9.8). Users are advised to replace these devices as they are no longer supported. https://securityaffairs.com/168041/security/d-link-dir-846-routers-code-execution-flaws.html

☢️ Zyxel warns of vulnerabilities in a wide range of its products vulnerability – Zyxel has disclosed nearly a dozen vulnerabilities across its products, with the most critical (CVE-2024-7261) allowing unauthenticated OS command execution, rated 9.8. Users are urged to patch immediately. https://arstechnica.com/?p=2047312

🗳️ Biden cracks down on Putin's election meddling cybercrime – The Biden administration seized 32 websites linked to Russian propaganda efforts and charged two RT employees in a $10 million scheme to influence the upcoming U.S. presidential election. https://www.theregister.com/2024/09/05/biden_cracks_down_on_putins/

🎣 Warning Against Phishing Emails Impersonating Netflix warning – AhnLab warns of phishing emails posing as Netflix, claiming payment failures and urging users to update payment methods via malicious links. Users are advised to verify URLs before clicking. https://asec.ahnlab.com/en/82969/

⚡ Quishing, an insidious threat to electric car owners security news – Quishing is a phishing attack using counterfeit QR codes at electric car charging stations to steal sensitive information. Users are urged to use recharge cards and verify URLs to protect against scams. https://securityaffairs.com/168059/hacking/quishing-electric-car-owners.html

♀️ New report shows ongoing gender pay gap in cybersecurity security news – The ISC2 Cybersecurity Workforce Study reveals a persistent gender pay gap in cybersecurity, with men earning more than women, and highlights the underrepresentation of women in the field, emphasizing the need for targeted DEI hiring initiatives. https://securityintelligence.com/articles/new-report-shows-gender-pay-gap-in-cybersecurity/

🦠 Predator spyware resurfaces with signs of activity, Recorded Future says security news – Recorded Future reports renewed activity from Predator spyware, linked to Intellexa, with new infrastructure identified and potential customers in Angola, Saudi Arabia, and the Democratic Republic of the Congo. https://cyberscoop.com/predator-spyware-resurfaces-with-signs-of-activity-recorded-future-says/

🔎 Colombian president suggests prior administration illegally sent $11 million in cash to Israel for spyware security news – Colombian President Gustavo Petro announced an investigation into $11 million allegedly used by the previous administration to purchase Pegasus spyware, questioning the legality of the transactions. https://therecord.media/colombian-president-pegasus-spyware-israel-missing-money

📎 Telegram changes its tone on moderating private chats after CEO’s arrest security news – Following CEO Pavel Durov's arrest, Telegram revised its FAQ to allow reporting of illegal content in private chats, shifting from a previous stance of non-cooperation with moderation requests. https://www.theverge.com/2024/9/5/24237254/telegram-pavel-durov-arrest-private-chats-moderation-policy-change

🛋️ Therapy Sessions Exposed by Mental Health Care Firm’s Unsecured Database data breach – Confidant Health inadvertently exposed sensitive patient data, including therapy session recordings, due to an unsecured database. The incident highlights the urgent need for improved data security in healthcare organizations. https://www.wired.com/story/confidant-health-therapy-records-database-exposure/

🔓 Hackers Threaten to Leak Planned Parenthood Data cybercrime – RansomHub ransomware group claims to have hacked Planned Parenthood's Montana branch, threatening to leak 93 GB of sensitive data after a cybersecurity incident was reported on August 28. https://www.wired.com/story/hackers-threaten-to-leak-planned-parenthood-data/

Some More, For the Curious

🔍 Most interesting IR cases in 2023: insider threats and more security research – Kaspersky's Global Emergency Response Team highlights 2023's notable incident response cases, including insider fraud and advanced persistent threats, emphasizing the need for enhanced monitoring and threat intelligence. https://securelist.com/incident-response-interesting-cases-2023/113611/

🔒 Vulnerabilities in Microsoft apps for macOS allow stealing permissions vulnerability – Eight vulnerabilities in Microsoft apps for macOS could enable attackers to steal permissions, allowing unauthorized access to sensitive resources like cameras and microphones without user knowledge. https://securityaffairs.com/167973/hacking/microsoft-apps-for-macos-flaws.html

🛑 VMWare releases Fusion vulnerability with 8.8 rating vulnerability – A critical vulnerability in VMWare Fusion (CVE-2024-38811) allows code execution with standard user privileges, rated 8.8 on the CVSS scale, prompting a software patch. https://cyberscoop.com/vmware-vulnerability-fushion-cve-2024-38811/

💻 Rust in Linux lead retires rather than deal with more “nontechnical nonsense” security news – Wedson Almeida Filho, leader of the Rust for Linux project, retires citing frustration with nontechnical disputes, expressing concern that the Linux kernel must embrace memory-safe languages like Rust to remain relevant. https://arstechnica.com/?p=2046763

🧬 Evolution of Mallox: from private ransomware to RaaS security research – Mallox ransomware has evolved from targeted attacks to a Ransomware-as-a-Service model, with over 700 samples identified. Its affiliate program seeks experienced partners for cybercrime, indicating a shift in operational strategy. https://securelist.com/mallox-ransomware/113529/

🐍 Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk security research – The 'Revival Hijack' technique allows attackers to reclaim deleted PyPI packages, risking 22,000 packages and potentially leading to malicious downloads. JFrog has taken action to protect the community. https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/

📃 Validate your Windows Audit Policy Configuration with KQL cyber defense – Ensuring proper configuration of Windows audit policies is essential for security. This article discusses using Kusto Query Language (KQL) to validate and troubleshoot audit policy application across environments. https://blog.nviso.eu/2024/09/05/validate-your-windows-audit-policy-configuration-with-kql/

🦗 Cicada Ransomware – What You Need To Know security news – Cicada ransomware, discovered in June 2024, has targeted over 20 organizations primarily in North America and the UK. Written in Rust, it threatens to publish stolen data unless a ransom is paid. https://www.tripwire.com/state-of-security/cicada-ransomware-what-you-need-know

🪅 Veeam fixed a critical flaw in Veeam Backup & Replication software vulnerability – Veeam patched 18 high and critical vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVE-2024-40711) with a CVSS score of 9.8, requiring immediate attention. https://securityaffairs.com/168088/security/veeam-backup-replication-cve-2024-40711.html

🧱 SonicWall warns that SonicOS bug exploited in attacks vulnerability – SonicWall alerts users of a critical access control vulnerability (CVE-2024-40766) in SonicOS that may be actively exploited, urging immediate patching to prevent unauthorized access and potential firewall crashes. https://securityaffairs.com/168112/hacking/sonicwall-sonicos-bug-exploited.html

🔧 Building a Hardware Hacking Arsenal: The Right Bits for Every Byte security research – This article outlines essential tools for hardware hacking, emphasizing cost-effective options that support learning and experimentation in security assessments. Safety and accessibility are also highlighted. https://www.guidepointsecurity.com/blog/building-a-hardware-hacking-arsenal-the-right-bits-for-every-byte/

CISA Corner

⚠️ LOYTEC Electronics LINX Series vulnerability – Multiple vulnerabilities in LOYTEC's LINX series devices could allow attackers to exploit sensitive information and gain unauthorized access, with high CVSS scores indicating significant risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog vulnerability – CISA has added three vulnerabilities, including two in Draytek VigorConnect and one in Kingsoft WPS Office, to its catalog due to active exploitation risks for federal networks. https://www.cisa.gov/news-events/alerts/2024/09/03/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – On September 5, 2024, CISA released four advisories addressing security vulnerabilities in various Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2024/09/05/cisa-releases-four-industrial-control-systems-advisories

⚔️ Russian Military Cyber Actors Target US and Global Critical Infrastructure security news – The FBI, CISA, and NSA report that Russian GRU Unit 29155 is behind ongoing cyber operations targeting critical infrastructure, utilizing tools like WhisperGate malware and exploiting various vulnerabilities since at least 2020. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 32/2024

August 11, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🚫 Videos: Van der Bellen & Assinger werben nicht für Investmentplattformen security news – The article discusses that videos featuring Van der Bellen and Assinger do not promote investment platforms, clarifying any misconceptions surrounding their appearances. https://www.watchlist-internet.at/news/fake-videos-van-der-bellen-assinger-werben-nicht-fuer-investmentplattformen/

💸 Should Organizations Pay Ransom Demands? cybercrime – Organizations are urged to avoid paying ransomware demands as it funds cybercriminals and doesn't guarantee data recovery. Proactive cybersecurity measures are emphasized as a better defense. https://securityaffairs.com/166650/uncategorized/ransomware-organizations-should-avoid-paying-ransoms.html

📧 Users: Microsoft must update Outlook's friendly name feature security news – Users are urging Microsoft to change how Outlook displays sender names to combat phishing, as friendly names can mislead users into clicking malicious links. Calls for disabling aliases have grown. https://www.theregister.com/2024/08/06/users_call_for_microsoft_to/

🛑 Consumer Reports study finds data removal services are often ineffective privacy – A Consumer Reports study found that data removal services are largely ineffective, with only 35% of personal data removed from people-search sites within four months, raising concerns about their reliability. https://therecord.media/data-removal-services-mostly-worthless-study

💻 Report: Myths about tech still plaguing the IT world security news – A Kaspersky survey reveals widespread misconceptions about digital security among tech-savvy Brits, including beliefs about webcam safety, incognito mode, and the effectiveness of encryption, highlighting a need for better cybersecurity education. https://www.theregister.com/2024/08/08/report_tech_misconceptions_plague_the/

🪖 Russia's Kursk region suffers 'massive' DDoS attack amid Ukraine offensive cyber defense – Kursk, Russia, experienced a significant DDoS attack targeting government and business websites, coinciding with Ukraine's military advances, though critical infrastructure remained protected from damage. https://therecord.media/kursk-military-offensive-ddos-russia-ukraine

🐄 Crooks took control of a cow milking robot causing the death of a cow cybercrime – Cybercriminals hacked a farmer's milking robot, demanding a $10,000 ransom. The farmer refused to pay, leading to the death of a cow due to lost data on insemination dates. https://securityaffairs.com/166839/cyber-crime/cow-milking-robot-hacked.html

🔊 Sonos smart speakers flaw allowed to eavesdrop on users vulnerability – NCC Group discovered vulnerabilities in Sonos smart speakers, including CVE-2023-50809, allowing remote code execution and potential eavesdropping. Sonos released a patch to address the issues. https://securityaffairs.com/166823/hacking/sonos-smart-speakers-flaw.html

🔑 How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards security research – Researchers reveal a method to extract HID encoder keys, allowing easy cloning of keycards. https://www.wired.com/story/hid-keycard-authentication-key-vulnerability/

🛡️ Security Tips for Modern Web Administrators security news – Website security is vital for user trust. Employ multi-layered defenses, keep software updated, and follow best practices to safeguard against attacks and protect sensitive data. https://blog.sucuri.net/2024/08/security-tips-for-modern-web-administrators.html

🆙 Mac and Windows users infected by software updates delivered over hacked ISP malware – Hackers compromised an ISP to deliver malware to users via tampered software updates. This attack exploited unencrypted connections, enabling malicious file downloads for Windows and macOS users. https://arstechnica.com/security/2024/08/hacked-isp-infects-users-receiving-unsecure-software-updates/

👁️ Illinois relaxes biometric privacy law, reduces penalties privacy – Illinois has amended its Biometric Information Privacy Act, reducing penalties for breaches by counting multiple data distributions as one violation, which critics say lowers potential damages. https://www.theregister.com/2024/08/06/illinois_bipa_amendment_reduces_penalties/

🔒 Google says Android zero-day was exploited in the wild vulnerability – Google has patched a high-severity Android vulnerability (CVE-2024-36971) allowing remote code execution, amid reports of targeted exploitation. This reflects a rising trend in zero-day attacks. https://therecord.media/android-zero-day-google-fix-august-patch

💻 Students scramble after security breach wipes 13,000 devices data breach – A security breach at Mobile Guardian led to the remote wiping of data from 13,000 school-issued devices in Singapore, prompting the Ministry of Education to halt its services and remove the app. https://arstechnica.com/security/2024/08/students-scramble-after-security-breach-wipes-13000-devices/

🐍 SharpRhino malware targets IT admins, Hunters Intl suspected malware – The SharpRhino malware, disguised as Angry IP Scanner, targets network admins and is linked to the Hunters International gang, known for ransomware-as-a-service tactics and double extortion. https://www.theregister.com/2024/08/07/sharprhino_malware_admins/

❎ Problems with Georgia’s Voter Registration Portal security news – Georgia's voter registration portal has security flaws allowing unauthorized cancellation of registrations and exposing sensitive voter data, highlighting challenges in balancing usability and security. https://www.schneier.com/blog/archives/2024/08/problems-with-georgias-voter-registration-portal.html

💰 US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks cybercrime – The U.S. State Department has offered a $10 million reward for information on six Iranian hackers linked to cyberattacks on U.S. water utilities, attributed to the CyberAv3ngers group. https://therecord.media/us-offers-reward-for-info-on-iranian-hackers-water-utilities

🧓 Researchers find decades-old vulnerability in major web browsers vulnerability – A zero-day vulnerability discovered by Oligo Security affects major browsers, allowing attackers to exploit network requests to 0.0.0.0, potentially breaching local networks and accessing private data. https://cyberscoop.com/browser-zero-day-oligo-security-0-0-0-0-day/

🧑‍🌾 Nashville man arrested for running “laptop farm” to get jobs for North Koreans cybercrime – Matthew Isaac Knoot was arrested for hosting laptops to deceive US companies into hiring North Korean nationals, funneling their earnings to fund North Korea’s weapons program. https://arstechnica.com/security/2024/08/nashville-man-arrested-for-running-laptop-farm-to-get-jobs-for-north-koreans/

Some More, For the Curious

⚡ Hacking a Virtual Power Plant hacking write-up – A security researcher exploited a vulnerability in a virtual power plant's API using weak 512-bit RSA keys, revealing how easily sensitive data could be accessed. https://rya.nc/vpp-hack.html

📊 State of Exploitation – A Peek into 1H-2024 Vulnerability Exploitation security research – In the first half of 2024, 390 new vulnerabilities were added to the Known Exploited Vulnerabilities Catalog, highlighting ongoing threats and trends in exploitation and weaponization. https://vulncheck.com/blog/state-of-exploitation-1h-2024

💼 Florida firm sued over theft of 2.9B personal records data breach – A lawsuit claims Jerico Pictures negligently failed to secure 2.9 billion records, leading to a data breach where personal information was sold on the dark web, risking identity theft. https://www.theregister.com/2024/08/05/national_public_data_lawsuit/

💰 Drama ‘Dark Angels’ Reap Record Ransoms cybercrime – The Dark Angels ransomware group made headlines after receiving a record $75 million ransom from a Fortune 50 company, focusing on massive data theft while avoiding disruption and publicity. https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/

🗽 Intelligence bill would elevate ransomware to a terrorist threat security news – A Senate proposal aims to treat ransomware attacks as terrorism, enhancing legal authority to combat cybercriminals and sanction states harboring them, despite concerns over effectiveness. https://cyberscoop.com/ransomware-terrorism-ndaa-2025/

🌮 Turning the screws: The pressure tactics of ransomware gangs cybercrime – Ransomware gangs are escalating pressure tactics, using media, legislation, and personal threats to coerce victims into paying ransoms, including targeting secondary victims for leverage. https://news.sophos.com/en-us/2024/08/06/turning-the-screws-the-pressure-tactics-of-ransomware-gangs/

➖ Best security practices for ESXi environments cyber defense – Organizations using VMware ESXi should implement ten security practices to mitigate risks, as native EDR is unavailable, including ensuring patching, enforcing strong passwords, and enabling lockdown modes. https://news.sophos.com/en-us/2024/08/07/best-security-practices-for-esxi-environments/

🧠 Mental Health – An Infosec Challenge security news – Cybersecurity professionals face unique mental health challenges like burnout and anxiety due to constant stress. The article offers tips for prevention, emphasizing self-care, communication, and community support. https://www.blackhillsinfosec.com/mental-health-an-infosec-challenge/

🤑 Hackers return $12 million taken during Ronin network breach cybercrime – Hackers returned $12 million stolen from the Ronin gaming blockchain, claiming to act as white-hats after exploiting a vulnerability. The company plans to enhance security and awarded the hackers a $500,000 bounty. https://therecord.media/hackers-return-12-million-taken-from-ronin-network

🎩 The top stories coming out of the Black Hat cybersecurity conference security news – At the Black Hat conference, AI's role in cybersecurity takes center stage, alongside vulnerabilities in car infotainment systems and the impact of upcoming elections on cybersecurity policy. https://blog.talosintelligence.com/threat-source-newsletter-aug-8-2024/

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog vulnerability – CISA has included CVE-2018-0824, a Microsoft vulnerability, in its catalog due to active exploitation, emphasizing the need for federal agencies to address such risks promptly. https://www.cisa.gov/news-events/alerts/2024/08/05/cisa-adds-one-known-exploited-vulnerability-catalog 🚨 CISA Adds Two Known Exploited Vulnerabilities to Catalog vulnerability – CISA has included CVE-2024-36971 and CVE-2024-32113 in its catalog due to active exploitation, highlighting risks to federal networks and the need for timely remediation. https://www.cisa.gov/news-events/alerts/2024/08/07/cisa-adds-two-known-exploited-vulnerabilities-catalog

🛠️ Delta Electronics DIAScreen vulnerability – A stack-based buffer overflow vulnerability in Delta Electronics DIAScreen could allow arbitrary code execution. Users are urged to update to version 1.4.2 to mitigate risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-219-01 🔍 Dorsett Controls InfoScan vulnerability – Dorsett Controls InfoScan has vulnerabilities allowing unauthorized access to sensitive information and path traversal. Users should update to version 1.38 or later to mitigate risks. https://www.cisa.gov/news-events/ics-advisories/icsa-24-221-01

🛒 Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem cyber defense – This guide empowers software customers to demand security in product design, offering questions to assess manufacturers' cybersecurity practices and ensuring resilience against cyber threats. https://www.cisa.gov/resources-tools/resources/secure-demand-guide

🔐 Best Practices for Cisco Device Configuration security news – CISA advises disabling the Cisco Smart Install feature and using type 8 password protection to secure configurations, reducing the risk of password cracking and unauthorized access. https://www.cisa.gov/news-events/alerts/2024/08/08/best-practices-cisco-device-configuration

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 31/2024

August 4, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

❌ Here’s How To Stop X From Using Your Data To Train Its AI privacy – X.ai, affiliated with Elon Musk's X network, utilizes Twitter data for AI training; users can opt out in settings. https://www.forbes.com/sites/johnkoetsier/2024/07/26/x-just-gave-itself-permission-to-use-all-your-data-to-train-grok/

®️ Massenüberwachung als Dienstleistung: Der Handel mit Standortdaten privacy – Data brokers sell billions of location data, threatening privacy and national security, leading to concerns about espionage. Commercial surveillance infrastructure poses systemic problems. https://www.kuketz-blog.de/massenueberwachung-als-dienstleistung-der-handel-mit-standortdaten/

🫥 New Mandrake Android spyware version discovered on Google Play malware – Mandrake spyware resurfaces on Google Play with new evasion techniques, targeting users globally. Sophisticated malware embedded in file sharing app, using complex infection chain and anti-analysis methods. https://securelist.com/mandrake-apps-return-to-google-play/113147/

🖖 IBM, Nike, Disney, others caught in Proofpoint phish palaver security news – Phishing campaign exploited Proofpoint security gap, sending 3 million daily spoofed emails; blamed on insecure Proofpoint Microsoft 365 integration. https://www.theregister.com/2024/07/30/scammers_spoofed_emails/

🎣 A crafty phishing campaign targets Microsoft OneDrive users security news – A phishing campaign targets Microsoft OneDrive users with a PowerShell script through a deceptive email instructing users to fix a fake “Error 0x8004de86.” The attack tricks victims into running malicious commands for system compromise. https://securityaffairs.com/166312/hacking/microsoft-onedrive-phishing.html

🦈 'LockBit of phishing' EvilProxy used in 1M+ attacks monthly security news – EvilProxy, a phishing-as-a-service kit, leverages Cloudflare services to disguise traffic in phishing attacks targeting C-Suite executives. Attacks use redirection through legitimate sites, culminating in phishing Microsoft login pages. https://www.theregister.com/2024/07/30/evilproxy_phishing_kit_analysis/

🤑 Meta to pay Texas $1.4 billion to settle lawsuit alleging it illegally captured users’ faces privacy – Meta agrees to pay Texas $1.4 billion to settle a lawsuit over unauthorized use of facial recognition software on users, violating Texas law and consumer protection regulations. https://therecord.media/meta-texas-facial-recognition-settlement

🦆 Don’t Let Your Domain Name Become a “Sitting Duck” security news – Over a million vulnerable domains are at risk of takeover due to authentication weaknesses at hosting providers and registrars, allowing possible cybercriminal exploitation. https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-become-a-sitting-duck/

💸 Scammer Allegedly Makes $600,000 a Month Holding Instagram Accounts Hostage cybercrime – Idriss Qibaa, aka 'Dani' and 'Unlocked,' allegedly extorted victims through locking their Instagram accounts, threatening them, demanding money to regain access, and using personal information for extortion. https://www.404media.co/unlocked4life-instagram-scam-no-jumper/

🧑‍💼 Germany summons Chinese ambassador over cyberattack on cartography agency security news – German authorities link a Beijing-backed threat actor to a 2021 cyberattack on the Federal Agency for Cartography and Geodesy, summoning the Chinese ambassador. https://therecord.media/germany-summons-chinese-ambassador-over-hack

🌐 Nearly 7% of Internet Traffic Is Malicious security news – Cloudflare reports 6.8% of Internet traffic is malicious, with CVEs exploited as quickly as 22 minutes after proof-of-concepts are published. https://www.schneier.com/blog/archives/2024/07/nearly-7-of-internet-traffic-is-malicious.html

🪝 Microsoft seizes domain used by Vietnamese group to sell fake accounts, services cybercrime – Microsoft seizes domain used by Vietnamese group selling fake accounts and services after previous seizures for creating fraudulent Microsoft accounts and CAPTCHA bypass services. https://cyberscoop.com/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services/

💐 Begging for Bounties and More Info Stealer Logs cybercrime – Fraudsters try to extort bug bounties using stolen credentials from info stealer logs, which originated from victims' malware-infected devices, creating a malicious chain propagated on platforms like Telegram. https://www.troyhunt.com/begging-for-bounties-and-more-info-stealer-logs/ Personal comment: HIBP added a lot of new breaches this week – go check your accounts at https://haveibeenpwned.com/

💸 $75 Million Record-Breaking Ransom Paid To Cybercriminals, Say Researchers cybercrime – A record-breaking $75 million ransom was paid to Dark Angels ransomware group by an undisclosed Fortune 50 company. https://www.tripwire.com/state-of-security/75-million-record-breaking-ransom-paid-cybercriminals-say-researchers

💊 Pharma Giant Cencora confirmed the theft of personal and health information data breach – Pharmaceutical giant Cencora confirms theft of personal and health information in a data breach, affecting individuals' data, including personally identifiable information and protected health information. https://securityaffairs.com/166422/data-breach/cencora-confirmed-theft-pii-heath-data.html

📱 Keeping your Android device safe from text message fraud privacy – SMS Blaster fraud, threats from SMS phishing via cell-site simulators, and Android security features against fraud. https://security.googleblog.com/2024/08/keeping-your-android-device-safe-from.html

🚗 Ford wants patent for tech allowing cars to surveil and report speeding drivers privacy – Ford seeks patent for cars to surveil speeding drivers, sparking privacy concerns from advocates and experts. https://therecord.media/ford-seeks-patent-cars-surveil-speeders-report-to-police

🏈 NFL to roll out facial authentication software league-wide privacy – The NFL will implement facial authentication software at all 32 stadiums this season to enhance event security. The technology aims to streamline authentication processes for media, officials, and staff. Privacy concerns, noting potential inaccuracies and discriminatory impacts of facial recognition technology. https://therecord.media/nfl-to-roll-out-facial-authentication-league-wide

📇 Hackers attempt to sell the personal data of 3 billion people resulting from an April data breach data breach – National Public Data, reportedly exposed the personal data of close to 3 billion people, disclosed by a threat actor named USDoD, who tried to sell the database for $3.5 million on the dark web. https://securityaffairs.com/166539/data-breach/personal-data-3-billion-people-data-breach.html

Some More, For the Curious

🌀 StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms security research – StormBamboo leverages ISP compromise to manipulate DNS updates, installing malware through insecure software updates on macOS and Windows. https://www.volexity.com/blog/2024/08/02/stormbamboo-compromises-isp-to-abuse-insecure-software-update-mechanisms/

🚀🖨️ Reverse engineering the 59-pound printer onboard the Space Shuttle geeky news – The Space Shuttle's Interim Teleprinter, a stop-gap measure, remained in use for over 50 flights, printing thousands of lines; cost $1.5 million per flight. https://www.righto.com/2024/08/space-shuttle-interim-teleprinter.html

😞 Too big to care? – Our disappointment with Cloudflare’s anti-abuse posture cyber defense – Spamhaus criticizes Cloudflare for facilitating cybercriminal activity by providing services to abusive actors, despite having tools to prevent abuse. Calls for Cloudflare to suspend services to abusers. https://www.spamhaus.org/resource-hub/service-providers/too-big-to-care-our-disappointment-with-cloudflares-anti-abuse-posture/

🤖 Websites are Blocking the Wrong AI Scrapers (Because AI Companies Keep Making New Ones) security news – Website owners struggling to block AI scrapers due to constantly changing crawler names and outdated robots.txt files. https://www.404media.co/websites-are-blocking-the-wrong-ai-scrapers-because-ai-companies-keep-making-new-ones/

⚙️ Zero Day Initiative — Breaking Barriers and Assumptions: Techniques for Privilege Escalation on Windows: Part 1 security research – “Link following” vulnerabilities on Windows involve applications improperly resolving filenames, allowing malicious users to redirect to unintended resources. Techniques to exploit these vulnerabilities using file operations are discussed with defensive strategies from developers. https://www.thezdi.com/blog/2024/7/29/breaking-barriers-and-assumptions-techniques-for-privilege-escalation-on-windows-part-1

✈️ Delta Air Lines may sue CrowdStrike, Microsoft over outage security news – Delta Air Lines considers legal action against CrowdStrike and Microsoft following operational losses of up to $500 million due to a recent outage that led millions of Windows machines offline. https://www.theregister.com/2024/07/30/crowdstrike_delta_microsoft_lawsuit/

🌋 'Error' in Microsoft's DDoS defenses amplified Azure outage security news – Microsoft's DDoS defenses amplified an Azure outage caused by a DDoS attack, triggering global service disruptions, despite the company's unique defense and threat intelligence capabilities. https://www.theregister.com/2024/07/31/microsoft_ddos_azure/

🌽 Driving lessons: The kernel drivers in Sophos Intercept X Advanced security research – Sophos Intercept X Advanced uses five kernel drivers for cybersecurity, explaining their functionality, security measures, customer options, gradual rollouts for software updates, and vulnerabilities working in kernel-space. https://news.sophos.com/en-us/2024/08/01/driving-lessons-the-kernel-drivers-in-sophos-intercept-x-advanced/

💵 Leaked ransomware variants give rise to new cybercrime groups cybercrime – Cybercriminals exploit leaked ransomware variants, forming groups utilizing multiple ransomware families for attacks and demanding bug bounties, leading to a rise in cybercrime and affiliate programs. https://securelist.com/sexi-key-group-mallox-ransomware/113183/

🛋️ Education in Secure Software Development security news – Survey by Linux Foundation and OpenSSF shows developers lack essential secure software development skills, raising concerns about software security. https://www.schneier.com/blog/archives/2024/08/education-in-secure-software-development.html

👿 Millions of Websites Susceptible to XSS Attack via OAuth Implementation Flaw vulnerability – Millions of websites vulnerable to XSS attack via OAuth due to flawed implementation, potentially leading to full account takeovers. https://www.securityweek.com/millions-of-websites-susceptible-xss-attack-via-oauth-implementation-flaw/

🛜 WifiForge – WiFi Exploitation for the Classroom hacking write-up – WifiForge, a program allowing safe WiFi hacking lessons through an interactive virtual network platform called Mininet-Wifi. WifiForge facilitates teaching various exploits with pre-built labs, such as WEP key-cracking, eliminating the need for physical network gear. https://www.blackhillsinfosec.com/wififorge/

🧐 One Does Not Simply … Get a Cybersecurity Job security news – Getting a cybersecurity job requires upskilling, certifications, networking, staying informed on trends, and focusing on job opportunities from within your network. https://www.guidepointsecurity.com/blog/one-does-not-simply-get-a-cybersecurity-job/

CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog vulnerability – CISA adds three actively exploited vulnerabilities to catalog: ServiceNow input validation issues and Acronis default password flaw. https://www.cisa.gov/news-events/alerts/2024/07/29/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog vulnerability – CVE-2024-37085 VMware ESXi Authentication Bypass. https://www.cisa.gov/news-events/alerts/2024/07/30/cisa-adds-one-known-exploited-vulnerability-catalog

🍏 Apple Releases Security Updates for Multiple Products vulnerability – Apple issued security updates for Safari, iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. https://www.cisa.gov/news-events/alerts/2024/07/30/apple-releases-security-updates-multiple-products

⏰ DigiCert Certificate Revocations security news – DigiCert is revoking TLS certificates due to a domain control verification issue, potentially causing temporary disruptions, with updated information available on their status page. https://www.cisa.gov/news-events/alerts/2024/07/30/digicert-certificate-revocations

🧑‍🏭 CISA Releases Nine Industrial Control Systems Advisories vulnerability – vulnerabilities in various systems like Johnson Controls, AVTECH IP Camera, Vonets WiFi Bridges, and Rockwell Automation Logix Controllers. https://www.cisa.gov/news-events/alerts/2024/08/01/cisa-releases-nine-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 30/2024

July 28, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🧑‍💻 Double Dipping Cheat Developer Gets Caught Red-Handed security research – EvolvedAim cheat developer includes information stealer, targeting Escape From Tarkov players, double-dipping into profits, and causing significant damage. https://www.cyberark.com/resources/threat-research-blog/double-dipping-cheat-developer-gets-caught-red-handed

🔂 Anyone can Access Deleted and Private Repository Data on GitHub security research – GitHub exposes deleted and private repository data, posing security risks through Cross Fork Object Reference (CFOR) vulnerability. https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

👻 A Hacker ‘Ghost’ Network Is Quietly Spreading Malware on GitHub security research – A network of 3,000 'ghost' accounts on GitHub spreading ransomware and info stealers using fake likes and shares. https://www.wired.com/story/github-malware-spreading-network-stargazer-goblin/

🗳️ Understanding the Election Cybersecurity Landscape cyber defense – Complex election cybersecurity landscape includes diverse targets, tactics, and actors; understanding essential for safeguarding democracy. https://www.greynoise.io/blog/understanding-the-election-cybersecurity-landscape

💰 Oracle coughs up $115M to make privacy case go away privacy – Oracle settles $115 million class action lawsuit over alleged misuse of user data, promising privacy improvements. https://www.theregister.com/2024/07/22/oracle_settles_privacy_case/

📲 Telegram 0-day allowed sending malicious APKs disguised as videos security news – ESET discovers Telegram Android zero-day exploit EvilVideo, allowing attackers to send malicious APKs disguised as videos. https://securityaffairs.com/166042/hacking/evilvideo-telegram-android-zero-day.html

🎲 Chinese ‘cybercrime syndicate’ behind gambling sites advertised at European sporting events cybercrime – Infoblox uncovers Chinese cybercrime syndicate Vigorish Viper behind illegal global gambling network connected to human trafficking and cyber fraud. https://therecord.media/chinese-cybercrime-syndicate-gambling-football-europe

🍪 Google abandons plan to drop third-party cookies in Chrome privacy – Google opting for user choice between Privacy Sandbox and cookies amidst concerns of competitive distortion. https://www.theregister.com/2024/07/23/google_cookies_third_party_continue/

📲 iOS 17: Von einem iPhone kontaktierte Domains privacy https://www.kuketz-blog.de/ios-17-von-einem-iphone-kontaktierte-domains/

🥶 Simple ‘FrostyGoop’ malware responsible for turning off Ukrainians’ heat in January attack security research – Simple but impactful FrostyGoop malware uses Modbus protocol to disrupt heating in Ukrainian apartment buildings, showcasing attackers' focus on critical infrastructure. https://cyberscoop.com/frostygoop-ics-malware-dragos-ukraine/

💥 Inside the 78 minutes that took down millions of Windows machines security news – A faulty update by cybersecurity company CrowdStrike caused global Windows crashes, affecting millions of machines due to a driver flaw. Prospects to avoid such tech disasters involve enabling intelligent boot logic and limiting third-party kernel access. https://www.theverge.com/2024/7/23/24204196/crowdstrike-windows-bsod-faulty-update-microsoft-responses

🪼 AI-Powered Voice Spoofing for Next-Gen Vishing Attacks security research – AI-powered voice cloning advancements enable more realistic vishing attacks, posing significant security risks. Mandiant Red Team incorporated AI voice spoofing in testing, showcasing attackers' potential to exploit this technique for initial access, lateral movement, and privilege escalation. Security defenses must adapt through identifying inconsistencies, source verification, and implementing audio protection measures. https://cloud.google.com/blog/topics/threat-intelligence/ai-powered-voice-spoofing-vishing-attacks/

🤑 TracFone to pay $16 million to settle FCC cyber and privacy investigation security news – TracFone Wireless, owned by Verizon, will pay a $16 million fine to settle an FCC investigation into data breaches caused by API vulnerabilities. The breaches exposed customer data, leading to privacy compromises, necessitating improved API security measures and overall information security protocols. https://therecord.media/tracfone-16-million-to-settle-fcc-investigation

🗺️ Friendly Domain Registry “.top” Put on Notice security news – ICANN has issued a warning to the .top domain registry, expressing concerns over its failure to address phishing reports and suspend abusive domains, with reports showing .top domains were popular choices for phishing websites. https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/

🎰 Philippines to end online casinos, maybe scams too cybercrime – The Philippines aims to shut down online gambling providers embroiled in crimes like tax evasion and human trafficking. Despite economic benefits, the industry faces international pressure due to illicit activities such as scams and exploitation. https://www.theregister.com/2024/07/24/phillipines_bans_online_gambling_operators/

🦸 Google's reCAPTCHA v2 just labor exploitation, boffins say security research – Researchers criticize Google's reCAPTCHA v2, suggesting it exploits human labor without providing significant security benefits, raising concerns about information harvesting and user experience. https://www.theregister.com/2024/07/24/googles_recaptchav2_labor/

🚸 School in hot water over facial recognition in canteen privacy – ICO reprimands a UK school for introducing facial recognition for canteen payments without proper assessments, consent, or consultation, highlighting the importance of data protection in new technologies at educational institutions. https://www.theregister.com/2024/07/24/essex_school_facial_recognition/

🧪 CrowdStrike blames test software for taking down 8.5 million Windows machines security news – CrowdStrike attributes the issue that caused 8.5 million Windows machines to crash to a bug in their test software that failed to properly validate a content update, leading to detailed post-incident corrective measures for improved testing and deployment processes. https://www.theverge.com/2024/7/24/24205020/crowdstrike-test-software-bug-windows-bsod-issue

🍆 SEXi / APT Inc Ransomware – What You Need To Know cybercrime – The SEXi ransomware group targets VMware ESXi servers, encrypting virtual machine-related files and demanding high ransoms. Victims' files are appended with '.SEXi' and a ransom note named SEXi.txt is left. No known weaknesses exist for data recovery. Protection includes updating systems, disabling default accounts, and using strong, unique passwords. https://www.tripwire.com/state-of-security/sexi-apt-inc-ransomware-what-you-need-know

🎮 LummaC2 Malware Abusing the Game Platform 'Steam' security research – LummaC2 malware disguised as illegal programs uses SEO poisoning and abuse of Steam to acquire C2 domains, targeting wallets, browsers, extensions, and more. https://asec.ahnlab.com/en/68309/

Some More, For the Curious

🔭 Astronomers discover technique to spot AI fakes using galaxy-measurement tools security research – University of Hull researchers use astronomy tools to detect AI-generated deepfake images by analyzing eye reflections for inconsistencies. https://arstechnica.com/information-technology/2024/07/astronomers-discover-technique-to-spot-ai-fakes-using-galaxy-measurement-tools/

🙋‍♂️ Ransomware takedowns leave crims scrambling for stability security news – Europol reports ransomware landscape fragmentation post RaaS disruptions, with criminals adapting by working independently or developing own payloads. https://www.theregister.com/2024/07/22/europol_says_ransomware_takedowns_make/

⛔ DDoS-for-hire site DigitalStress taken down by police, suspected owner arrested cybercrime – DDoS-for-hire site DigitalStress taken down by police, data collected from users, suspected owner arrested in Northern Ireland. https://www.bitdefender.com/blog/hotforsecurity/ddos-for-hire-site-digitalstress-taken-down-by-police-suspected-owner-arrested/

💼 Cyber firm KnowBe4 hired a fake IT worker from North Korea security news – KnowBe4 discovered a North Korean threat actor posing as a remote IT worker through an elaborate deception involving stolen identities and AI-augmented imagery, prompting an investigation and alerting authorities as part of the response. https://cyberscoop.com/cyber-firm-knowbe4-hired-a-fake-it-worker-from-north-korea/

🏝️ Unfashionably secure: why we use isolated VMs cyber defense – Canary's security architecture relies on isolated VMs for complete customer data separation, safeguarding against unauthorized access and ensuring individual tenant privacy, despite operational drawbacks. https://blog.thinkst.com/2024/07/unfashionably-secure-why-we-use-isolated-vms.html

🥼 Build a Home Lab: Equipment, Tools, and Tips cyber defense – Building a home lab with virtual machines allows for experimentation and learning in a safe environment, emphasizing the importance of commitment over expensive equipment. Fundamental components include network setup, virtual machines, and physical hardware, and key considerations include VM options, equipment needs, and backup strategies. https://www.blackhillsinfosec.com/build-a-home-lab-equipment-tools-and-tips/

🪖 North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs cybercrime – North Korea's Andariel cyber group targets aerospace, nuclear, and defense industries for espionage, using ransomware to fund operations. Known for sophisticated reconnaissance, custom and commodity malware, system manipulation, credential theft, lateral movement, and data exfiltration. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

🌊 Zero Day Initiative — Multiple Vulnerabilities in the Deep Sea Electronics DSE855 security research – ZDI reported multiple vulnerabilities in Deep Sea Electronics DSE855, prompting no response from the vendor and leading to zero-day disclosure in June. Lack of authentication in configuration backup allowed unauthorized access. https://www.thezdi.com/blog/2024/7/25/multiple-vulnerabilities-in-the-deep-sea-electronics-dse855

🔐 Secure Boot is completely broken on 200+ models from 5 big device makers vulnerability – Cryptographic key underpinning Secure Boot compromised in 2022, allowing an unlimited bypass on over 200 device models from major manufacturers. Serious doubts raised about the integrity of Secure Boot. https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromised-on-200-models-from-5-big-device-makers/

🗣️ Microsoft calls for Windows changes and resilience after CrowdStrike outage security news – Microsoft calls for Windows changes for resilience after CrowdStrike outage, considering restricting kernel access for security vendors. https://www.theverge.com/2024/7/26/24206719/microsoft-windows-changes-crowdstrike-kernel-driver

💉 French authorities launch disinfection operation to eradicate PlugX malware from infected hostss security news – French authorities and Europol conduct a 'disinfection operation' against PlugX malware, addressing espionage activities with insights from cybersecurity firm. https://securityaffairs.com/166213/cyber-crime/plugx-malware-disinfection-operation.html

CISA Corner

🧑‍🏭 CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA issues advisories on current ICS security issues for National Instruments and Hitachi products https://www.cisa.gov/news-events/alerts/2024/07/23/cisa-releases-four-industrial-control-systems-advisories vulnerability – CISA issued advisories for Siemens SICAM and Positron Broadcast Signal Processor. https://www.cisa.gov/news-events/alerts/2024/07/25/cisa-releases-two-industrial-control-systems-advisories

⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog vulnerability – CISA adds two known exploited vulnerabilities to its catalog: CVE-2012-4792 affecting Microsoft Internet Explorer and CVE-2024-39891 affecting Twilio Authy. https://www.cisa.gov/news-events/alerts/2024/07/23/cisa-adds-two-known-exploited-vulnerabilities-catalog

🔒 ISC Releases Security Advisories for BIND 9 security news – ISC released BIND 9 security advisories addressing vulnerabilities that can lead to denial-of-service attacks. https://www.cisa.gov/news-events/alerts/2024/07/24/isc-releases-security-advisories-bind-9

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 29/2024

July 21, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🌍 Data Broker Files: How data brokers sell our location data and jeopardise national security privacy – Data brokers sell German location data, jeopardizing privacy and national security, leading to calls for regulation and concerns about data misuse. https://netzpolitik.org/2024/data-broker-files-how-data-brokers-sell-our-location-data-and-jeopardise-national-security/#netzpolitik-pw

🪪 It's best to just assume you’ve been involved in a data breach somehow privacy – Multiple data breaches in 2024, including AT&T and Snowflake, imply personal data compromise. Recommendations include strong passwords, multi-factor authentication, fraud alerts. https://blog.talosintelligence.com/threat-source-newsletter-july-18-2024/

🔍 Data breach exposes millions of mSpy spyware customers data breach – Data breach at mSpy exposes millions of customers who purchased phone spyware apps over a decade, revealing emails, personal documents, and requests for surveillance without consent by various individuals including U.S. officials. https://techcrunch.com/2024/07/11/mspy-spyware-millions-customers-data-breach/

📱 The FBI says it has ‘gained access’ to the Trump rally shooter’s phone security news – The FBI has accessed the phone of the suspect who shot at a Trump rally without disclosing how, continuing analysis of electronic devices and urging the public for tips. https://www.theverge.com/2024/7/15/24199239/fbi-encryption-phone-trump-shooter-pennsylvania-gained-access

🧔‍♂️ Kaspersky leaves U.S. market following the ban on the sale of its software in the country security news – Kaspersky exits the U.S. market after a ban on its software due to national security risks posed by Russia. The company denies links to the Russian government and will shut down its U.S. operations by September. https://securityaffairs.com/165799/breaking-news/kaspersky-is-leaving-the-u-s-market.html

💰 AT&T ransom laundered through mixers, gambling services cybercrime – AT&T's $370,000 ransom is being laundered through cryptocurrency mixing platforms and gambling services, identified by TRM Labs. Money laundering tactics include using swap services and privacy coins, often employed by cybercriminals to hide the funds' origins. https://therecord.media/att-ransom-laundered-mixers-research

⛑️ Rite Aid says 'limited' cyber incident affected data of 2.2 million people data breach – Rite Aid reports a 'limited' cyber incident after a hacker impersonated an employee accessing purchase-related data. Law enforcement contacted, victims offered identity protection services. https://therecord.media/rite-aid-data-breach-2-million-people

🦠 Private HTS Program Continuously Used in Attacks malware – A threat actor has been distributing malware through the private home trading system (HTS) program named HPlus, replacing the NSIS installer with an MSI format installer and supporting remote assistance with AnyDesk. The malware includes Quasar RAT aimed at stealing personal data. https://asec.ahnlab.com/en/67969/

🪓 HardBit Ransomware – What You Need to Know malware – HardBit ransomware, a ransomware-as-a-service (RaaS), resurfaces with a new version, HardBit 4.0, focused on thwarting security researchers with passphrase protection and improved customization that caters to different criminal operator technical levels. https://www.tripwire.com/state-of-security/hardbit-ransomware-what-you-need-know

💦 Leaked Docs Show What Phones Cellebrite Can (and Can’t) Unlock security news – Cellebrite struggled to unlock a significant portion of modern iPhones as of April 2024, per leaked documents. https://www.404media.co/leaked-docs-show-what-phones-cellebrite-can-and-cant-unlock/

🏳️‍🌈 LGBTQ+ people in Middle East and North Africa subject to intense digital oppression, research finds privacy – LGBTQ+ individuals face intense digital oppression, with police using dating and social media apps for persecution. Research reveals high levels of violence, forced device searches, and abuse. https://therecord.media/lgbtq-mena-region-digital-harassment

🛜 Mobile internet and social media disrupted in Bangladesh amid student protests security news – Bangladesh orders a nationwide mobile internet shutdown amid violent student protests against a government job quota system. The disruption is linked to social media usage by protesters. https://therecord.media/bangladesh-mobile-internet-social-media-outages-student-protests

🏠 How a little-known tool is sweeping the real estate industry by giving instant access to vast amounts of homebuyer data security news – Forewarn app offers real estate professionals instant access to detailed data about prospective clients for a low fee. Although primarily marketed as a safety tool, it also provides financial and criminal records instantly. However, privacy concerns and potential for misusing the data exist despite its explosive adoption in the real estate industry. https://therecord.media/forewarn-app-real-estate-homebuyer-data

🏥 MediSecure data breach impacted 12.9 million individuals data breach – Australian digital prescription provider MediSecure suffered a ransomware attack exposing personal and health information of 12.9 million individuals. The breach resulted in the theft of 6.5TB of data impacting users between March 2019 and November 2023. https://securityaffairs.com/165932/uncategorized/medisecure-databreach-12-9m-individuals.html

Crowdstrike Corner 🚨 Global Microsoft Meltdown Tied to Bad Crowdstrike Update security news – Crowdstrike update causes global Windows system crashes; airports, hospitals, and businesses affected. Recovery may take time, requiring manual fix per machine. https://krebsonsecurity.com/2024/07/global-microsoft-meltdown-tied-to-bad-crowstrike-update/

🐦‍⬛ What is CrowdStrike, and what happened? security news – CrowdStrike caused a global outage after a faulty update to Windows machines, affecting essential services. The issue came from an update that caused Windows systems to crash. Recovery may take days to weeks. https://www.theverge.com/2024/7/19/24201864/crowdstrike-outage-explained-microsoft-windows-bsod

🛹 Threat actors attempted to capitalize CrowdStrike incident security news – Threat actors exploit CrowdStrike IT outage to distribute Remcos RAT malware in a Latin America-targeted campaign under the disguise of an emergency fix via a ZIP file named 'crowdstrike-hotfix.zip.' CrowdStrike provides IOCs for the malicious campaign. https://securityaffairs.com/165953/uncategorized/threat-actors-capitalize-crowdstrike-incident.html

Some More, For the Curious

➿ CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks security research – CVE-2024-38112 used by Void Banshee to exploit IE vulnerability, leading to Atlantida stealer deployment against Windows users. https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html

🖼️ Fake AWS Packages Ship Command and Control Malware In JPEG Files security research – Fake AWS npm packages hide command and control malware in JPEG images, jeopardizing package installations and highlighting the need for increased vigilance in open source ecosystems. https://blog.phylum.io/fake-aws-packages-ship-command-and-control-malware-in-jpeg-files/

0️⃣ Zero Day Initiative – Uncoordinated Vulnerability Disclosure: The Continuing Issues with CVD security news – Gap in coordinated vulnerability disclosure leads to lack of vendor transparency, disputes on severity ratings, and challenges in bug reporting, highlighting the importance of improved communication and accountability within the cybersecurity industry. https://www.thezdi.com/blog/2024/7/15/uncoordinated-vulnerability-disclosure-the-continuing-issues-with-cvd

🥴 Weak Security Defaults Enabled Squarespace Domains Hijacks – Krebs on Security security news – Weak security defaults at Squarespace allowed domain hijacking incidents targeting cryptocurrency businesses, with vulnerabilities arising from the migration process from Google Domains, lack of email verification for new accounts, and limited control over account access and activity. https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/

🃏 Punch Card Hacking – Exploring a Mainframe Attack Vector security research – Article explores using punch card concepts in mainframe hacking for penetration testing, detailing JCL basics, FTP job submission, debugging with spool files, and potential privilege escalation. https://blog.nviso.eu/2024/07/16/punch-card-hacking-exploring-a-mainframe-attack-vector/

👻 ‘GhostEmperor’ returns: Mysterious Chinese hacking group spotted for first time in two years cybercrime – After a two-year hiatus, the sophisticated Chinese hacking group GhostEmperor, known for supply-chain attacks in Southeast Asia, has reappeared, deploying a rootkit to evade detection and carrying out attacks on business partners as seen in a recent incident investigated by cybersecurity company Sygnia. https://therecord.media/ghostemperor-spotted-first-time-in-two-years

🧑‍💼 Vulnerability in Cisco Smart Software Manager lets attackers change any user password vulnerability – Cisco Smart Software Manager On-Prem vulnerability (CVE-2024-20419) allows unauthorized users to change any user's password, posing a severe security risk with a maximum CVSS score of 10. https://arstechnica.com/security/2024/07/vulnerability-in-cisco-smart-software-manager-lets-attackers-change-any-user-password/

⚖️ Judge dismisses much of SEC suit against SolarWinds over cybersecurity disclosures security news – U.S. Judge dismissed most SEC claims against SolarWinds related to cybersecurity disclosures regarding the Sunburst attack. The ruling is seen as a victory for industry officials and a setback for SEC in holding executives accountable. https://cyberscoop.com/judge-dismisses-much-of-sec-suit-against-solarwinds-over-cybersecurity-disclosures/

🤒 APT41 Has Arisen From the DUST security research – APT41, in collaboration with Google's TAG, launched a campaign targeting various sectors across multiple countries, using techniques like web shells, backdoors, SQL export, and OneDrive exfiltration. https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust/

🧑‍🏭 CISA publishes resilience-planning playbook for critical infrastructure cyber defense – CISA releases playbook for infrastructure resilience planning, aiming to enhance security and minimize impact of cyberattacks on critical infrastructure. https://statescoop.com/cisa-cybersecurity-resilience-planning-playbook-critical-infrastructure/

🔒 Cisco fixed a critical flaw in Security Email Gateway that could allow attackers to add root users vulnerability – Cisco fixed a critical vulnerability in Secure Email Gateway allowing attackers to add root users and crash SEG appliances. https://securityaffairs.com/165905/uncategorized/cisco-fixed-a-critical-flaw-in-security-email-gateway-that-could-allow-attackers-to-add-root-users.html

🖲️ Attacking Connection Tracking Frameworks as used by Virtual Private Networks security research – Study demonstrates successful attacks on VPN connection tracking frameworks, highlighting vulnerabilities and proposing mitigations for enhanced security and privacy. https://petsymposium.org/popets/2024/popets-2024-0070.pdf

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 28/2024

July 14, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🍪 Linksys-Router senden wohl WLAN-Passwörter an US-Server security research – zwei getestete Routermodelle übermitteln wohl sensible Daten an einen Server in den USA. https://www.golem.de/news/im-klartext-linksys-router-senden-wohl-wlan-passwoerter-an-us-server-2407-186894.html

🍏 Apple warns iPhone users in 98 countries of spyware attacks warning – Apple warns iPhone users globally about targeted mercenary spyware attacks, emphasizing privacy and ongoing threat notifications. https://techcrunch.com/2024/07/10/apple-alerts-iphone-users-in-98-countries-to-mercenary-spyware-attacks/

🎓 ‘Serious hacker attack’ forces Frankfurt university to shut down IT systems cyberattack – Frankfurt University of Applied Sciences faces a hacker attack, leading to a total IT system shutdown, impacting services and communication. https://therecord.media/serious-hacker-attack-shutdown-frankfurt

‼️ Scammers double-dip by offering help to recover from scams warning – Scammers target victims of previous scams with fake offers to recover lost money, posing as trusted entities and requesting upfront fees or sensitive information, with the most vulnerable being victims over 65 years old. https://www.theregister.com/2024/07/09/australia_rescam_warning/

🏃‍♂️ Gadgetbridge: Smartwatches/Fitness-Tracker datenschutzfreundlich nutzen – Teil 1 privacy – Gadgetbridge ist eine datenschutzfreundliche Open-Source-App für Android, die es ermöglicht, Smartwatches und Fitness-Tracker unabhängig von den herstellereigenen Apps zu verwenden, um die volle Kontrolle über persönliche Daten zu behalten und lokale Speicherung zu gewährleisten. https://www.kuketz-blog.de/gadgetbridge-smartwatches-fitness-tracker-datenschutzfreundlich-nutzen-teil-1/

🔮 Avast released a decryptor for DoNex Ransomware and its predecessors security news – Avast developed a decryptor for the DoNex ransomware family due to a cryptographic flaw, allowing victims to recover files for free since March 2024. https://securityaffairs.com/165469/malware/donex-ransomware-decryptor.html

🐻 Apple removed 25 VPN apps from the App Store in Russia privacy – Apple removed 25 VPN apps from the Russian App Store due to government requests, part of Russia's control over internet access, leading to bypass difficulty for users. https://securityaffairs.com/165437/hacking/apple-removed-vpn-apps-from-app-store-in-russia.html

🎫 The Ticketmaster Hack Is Becoming a Logistical Nightmare for Fans and Brokers data breach – A hacking group released data allowing the creation of over 38,000 concert tickets, posing a potential logistical nightmare for Ticketmaster, venues, fans, brokers, and resale platforms. The hack can lead to issues such as duplicated tickets for sold seats and legitimate buyers being denied entry. https://www.404media.co/the-ticketmaster-hack-is-becoming-a-logistical-nightmare-for-fans-and-brokers/

🥓 More than 31M email addresses exposed following Neiman Marcus data breach data breach – Neiman Marcus data breach exposed over 31 million customer email addresses, affecting 64,472 individuals with leaked names, addresses, and more sold by threat actors. https://securityaffairs.com/165492/data-breach/neiman-marcus-data-breach-2.html

🤖 US, international authorities seize Russian AI bot farm cybercrime – U.S. authorities seized Russian AI bot farm domains linked to RT, accusing operatives of using Meliorator software to create social media personas and spread disinformation primarily aimed at U.S. politics. https://cyberscoop.com/us-international-authorities-seize-russian-ai-bot-farm/

🪛 Google’s dark web monitoring service will soon be free for all users security news – Google's dark web monitoring service, previously exclusive to Google One subscribers, will be free for all Google account holders starting soon, providing a combined solution to protect online presence. https://www.theverge.com/2024/7/9/24194970/google-one-free-dark-web-monitoring

🕵️ Hacktivists release two gigabytes of Heritage Foundation data data breach – The hacktivist group SiegedSec released two gigabytes of data from the Heritage Foundation in response to their Project 2025 initiative, claiming they wanted to expose supporters of the conservative think tank; however, Heritage denies being hacked, stating the data was from a publicly accessible archive. https://cyberscoop.com/hackvists-release-two-gigabytes-of-heritage-foundation-data/

📰 How disinformation from a Russian AI spam farm ended up on top of Google search results security research – A piece of Russian disinformation about Ukrainian president's wife buying a luxury car spread rapidly online, originating from a fake French website and promoted by pro-Kremlin accounts. https://arstechnica.com/ai/2024/07/how-disinformation-from-a-russian-ai-spam-farm-ended-up-on-top-of-google-search-results/

🦍 Scammers harness AI and deepfakes to sell bogus ‘miracle cures’ on Meta platforms security news – Artificial intelligence and deepfake videos fuel health-related scam campaigns on Meta platforms, promoting fake 'miracle cures' endorsed by celebrities and bogus medical experts, targeting millions of users worldwide, based on research by Bitdefender Labs. https://therecord.media/scammers-harness-ai-deepfakes-medical-bogus

🙊 Spear phishing techniques in mass phishing: a new trend security news – An increasing trend shows elements of spear phishing being incorporated into regular mass phishing campaigns, with sophisticated email design, personalized details, and imitation of HR notifications, showcasing a shift in attackers' techniques and an escalation in decentralized attacks. https://securelist.com/spear-phishing-meets-mass/113125/

🦹 RansomHub Ransomware – What You Need To Know cybercrime – RansomHub, a Ransomware-as-a-Service group, exploits a vulnerability in the email servers and has quickly risen as a significant threat. https://www.tripwire.com/state-of-security/ransomhub-ransomware-what-you-need-know

📱 You can now protect your high-risk Google account with just your phone privacy – Google's Advanced Protection Program now allows high-risk users to enroll using a single phone-based passkey. https://www.theverge.com/2024/7/10/24195306/google-accounts-advanced-protection-passkey-enrollment-support-security-key

📞 AT&T breach leaked call and text records from ‘nearly all’ wireless customers data breach – accessed through a third-party cloud platform. https://www.theverge.com/2024/7/12/24197052/att-data-breach-call-text-records-hack

Some More, For the Curious

🔦 Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough hacking writeup – Shelltorch exposes critical vulnerabilities in PyTorch TorchServe, allowing remote code execution and unauthorized server access. https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server

⚠️ CVE-2024-4577 Exploits in the Wild One Day After Disclosure security research – Exploitation of PHP vulnerability CVE-2024-4577 for remote code execution with malicious PHP code, emphasizing swift patching and monitoring. https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure

🧑‍🦯 CISA broke into a US federal agency, and no one noticed for a full 5 months security news – CISA red team exercise uncovers security flaws at US federal agency, lasting undetected for five months. https://www.theregister.com/2024/07/12/cisa_broke_into_fed_agency/

🌐 Emboldened and Evolving: A Snapshot of Cyber Threats Facing NATO security news – NATO faces cyber threats from state-sponsored actors, hacktivists, and cybercriminals, impacting espionage, disruptive attacks, and disinformation campaigns targeting critical infrastructure and political entities. https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-facing-nato/

🦷 Developing and prioritizing a detection engineering backlog based on MITRE ATT&CK security research – Exploring the prioritization of MITRE ATT&CK techniques for detection in Security Operation Centers, Threat Intelligence, and Incident Response. Emphasizing source evaluation, technique relevance, and optimizing detection logic development. https://securelist.com/detection-engineering-backlog-prioritization/113099/

☢️ New Blast-RADIUS attack breaks 30-year-old protocol used in networks everywhere security news – A new attack named Blast RADIUS exploits the 30-year-old RADIUS protocol due to its continued use of MD5, despite known vulnerabilities, allowing adversaries to gain admin access to various networks; the attack has led to a coordinated response from vendors. https://arstechnica.com/security/2024/07/new-blast-radius-attack-breaks-30-year-old-protocol-used-in-networks-everywhere/

🗞️ Chinese cyber agency accused of 'false and baseless' claims about US interfering in Volt Typhoon research security news – China's cybersecurity agency inaccurately claimed a U.S. threat intelligence company succumbed to U.S. influence, mischaracterizing the company's report on Dark Power ransomware, leading to pushback and accusations of false representation and manipulation from Western organizations. https://therecord.media/china-cyber-agency-claims-us-interference-volt-typhoon-research

📧 Exim vulnerability affecting 1.5M servers lets attackers attach malicious files vulnerability – 1.5 million servers with Exim mail agent are vulnerable to delivering malicious executable attachments due to a critical CVE-2024-39929, prompting urgent updates to address the security issue. https://arstechnica.com/security/2024/07/more-than-1-5-million-email-servers-running-exim-vulnerable-to-critical-attacks/

🪰 Palo Alto Networks fixed a critical bug in the Expedition tool vulnerability – Palo Alto Networks fixed an admin account takeover bug in its Expedition tool and addressed multiple other vulnerabilities impacting its products. https://securityaffairs.com/165641/security/palo-alto-networks-critical-bug-expedition.html

🔍 The president ordered a board to probe a massive Russian cyberattack. It never did. security news – Despite a directive to investigate the SolarWinds attack, the Cyber Safety Review Board did not conduct the investigation, raising concerns about government accountability and cybersecurity oversight. https://arstechnica.com/security/2024/07/the-president-ordered-a-board-to-probe-a-massive-russian-cyberattack-it-never-did/

💰 Wallets tied to CDK ransom group received $25 million two days after attack cybercrime – CDK Global paid over $25 million in ransom following a ransomware attack, with most of the funds going through a complex money laundering process involving multiple exchanges. https://cyberscoop.com/cdk-ransom-blacksuit-25-million/

📅 DDoSecrets Mirrors Wikileaks Data After Assange Plea Deal security news – DDoSecrets mirrored Wikileaks data to preserve transparency and ensure data availability, following Julian Assange's plea deal. https://www.404media.co/ddosecrets-mirrors-wikileaks-data-after-assange-plea-deal/

🏭 Critical infrastructure organizations want CISA to dial back cyber reporting security news – Critical infrastructure organizations request scaled-back cyber reporting to CISA, expressing concerns over definitions, reporting entities resource burden. https://cyberscoop.com/cisa-cyber-reporting-circia-2024/

🏁 Binary secret scanning helped us prevent (what might have been) the worst supply chain attack you can imagine security research – JFrog Security Research prevented a potential severe supply chain attack by detecting and reporting a leaked access token compromising Python infrastructure. https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/

7️⃣ The Stark Truth Behind the Resurgence of Russia’s Fin7 cybercrime – The notorious Fin7 cybercrime group reemerges, setting up thousands of malicious sites targeting various brands for phishing attacks. https://krebsonsecurity.com/2024/07/the-stark-truth-behind-the-resurgence-of-russias-fin7/

CISA Corner

🦿 People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action security research – APT40 compromises organization networks via multiple access vectors with enumeration, web shells, and exfiltration of sensitive data, leading to targeted threat actor investigation. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a

🛡️ CISA Adds Three Known Exploited Vulnerabilities to Catalog vulnerability – CISA lists three actively exploited vulnerabilities: Rejetto HTTP File Server flaw, Windows Hyper-V privilege escalation issue, and Windows MSHTML platform spoofing flaw. https://www.cisa.gov/news-events/alerts/2024/07/09/cisa-adds-three-known-exploited-vulnerabilities-catalog

CISA Releases Seven Industrial Control Systems Advisories https://www.cisa.gov/news-events/alerts/2024/07/09/cisa-releases-seven-industrial-control-systems-advisories CISA Releases Twenty-one Industrial Control Systems Advisories https://www.cisa.gov/news-events/alerts/2024/07/11/cisa-releases-twenty-one-industrial-control-systems-advisories Adobe Releases Security Updates for Multiple Products https://www.cisa.gov/news-events/alerts/2024/07/09/adobe-releases-security-updates-multiple-products Microsoft Releases July 2024 Security Updates https://www.cisa.gov/news-events/alerts/2024/07/09/microsoft-releases-july-2024-security-updates Citrix Releases Security Updates for Multiple Products https://www.cisa.gov/news-events/alerts/2024/07/09/citrix-releases-security-updates-multiple-products

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 27/2024

July 7, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🚨 Hijacked: How hacked YouTube channels spread scams and malware cybercrime – Cybercriminals hijack YouTube channels to spread scams and malware, targeting viewers and content creators. https://www.welivesecurity.com/en/scams/hijacked-hacked-youtube-channels-scams-malware/

🚓 Police allege 'evil twin' in-flight Wi-Fi used to steal info cybercrime – Australian man charged for creating fake in-flight Wi-Fi network to steal credentials; AFP warns against using public Wi-Fi without precautions. https://www.theregister.com/2024/07/01/australia_evil_twin_wifi_airline_attack/

📹 San Francisco app livestreams local bars to draw more patrons privacy – 2Night app allows livestreaming of SF bars, raising privacy concerns and backlash from patrons and venue owners. https://sfstandard.com/2024/06/29/2night-live-stream-bars-privacy-concerns/

🏥 LockBit claims cyberattack on Croatia’s largest hospital security news – LockBit ransomware gang targets Croatia's largest hospital; patient data compromised, impacting emergency services and hospital operations. https://therecord.media/lockbit-claims-cyberattack-croatia-hospital

⚠️ 3 million iOS and macOS apps were exposed to potent supply-chain attacks vulnerability – Vulnerabilities in CocoaPods server exposed 3 million iOS and macOS apps to code injection attacks for a decade. https://arstechnica.com/?p=2034866

🔑 The End of Passwords? Embrace the Future with Passkeys. security news – Passkeys offer enhanced security and privacy, along with convenience, as a passwordless authentication solution. https://blog.nviso.eu/2024/07/02/the-end-of-passwords-embrace-the-future-with-passkeys/

🕵️ Fiverr Freelancers Offer to Dox Anyone With Powerful U.S. Data Tool security news – Fiverr freelancers offer doxing services with access to data tool TLOxp https://www.404media.co/fiverr-freelancers-offer-to-dox-anyone-with-powerful-u-s-data-tool-tloxp/

📡 UN urges Russia to ‘immediately’ cease interference in European satellites security news – UN condemns Russian satellite interference, calls for immediate cessation of harmful actions affecting European countries' GPS signals and TV programs. https://therecord.media/un-russia-satellite-interference-europe

🪼 Polish government investigates Russia-linked cyberattack on state news agency security news – Suspicion of Russian involvement in cyberattack on Polish state news agency; aimed at spreading disinformation before European Parliament election. https://securityaffairs.com/165139/intelligence/polish-government-investigating-russia-attack.html

🎒 Alabama Department of Education stops ransomware attack but confirms data stolen data breach – Alabama Department of Education halts ransomware attack but confirms data breach, potential exposure of student and employee information. https://therecord.media/alabama-education-department-data-breach

🔍 Google: AI Potentially Breaking Reality Is a Feature Not a Bug security research – Google researchers co-author a paper detailing real harm caused by generative AI misuse, which can distort reality by producing deceptive content without violating terms of service. It highlights the need for collaboration to address this issue. https://www.404media.co/google-ai-potentially-breaking-reality-is-a-feature-not-a-bug/

⛓️ New ransomware group uses phone calls to pressure victims, researchers say cybercrime – New ransomware group Volcano Demon uses phone calls to intimidate victims, threatens to expose data if ransom is not paid. The group employs a double extortion technique and remains a challenge to track. https://therecord.media/ransomware-group-volcano-demon-lukalocker

🔥 Traeger smokes security bugs threatening grillers' hard work vulnerability – Traeger grills vulnerable to high-severity flaw allowing remote attackers to control temperature or shutdown grill; exploitation could ruin cooking. https://www.theregister.com/2024/07/03/traeger_security_bugs/

☘️ OpenAI’s ChatGPT Mac app was storing conversations in plain text security news – OpenAI's ChatGPT Mac app stored conversations in plain text; fixed after demonstration, highlighting a potential privacy concern. https://www.theverge.com/2024/7/3/24191636/openai-chatgpt-mac-app-conversations-plain-text

☎️ Twilio alerts Authy two-factor app users that ‘threat actors’ have their phone numbers security news – Twilio alerts Authy users of phone number leak, warns of phishing attacks. Previous breach affects 163 Twilio and 93 Authy accounts, leading to the unauthorized registration of additional devices. https://www.theverge.com/2024/7/3/24191791/twilio-authy-2fa-app-phone-numbers-hack-data-breach

🛣️ Europol says mobile roaming tech is hampering crimefighters security news – Europol is concerned about SMS home routing that hampers criminal investigations due to privacy-enhancing technologies, specifically service-level encryption, enabling suspects to maintain communication privacy within their home network while roaming. https://www.theregister.com/2024/07/05/europol_home_routing_complaint/

🥷 Hackers stole OpenAI secrets in a 2023 security breach security news – OpenAI faced a security breach in 2023, compromising internal discussions but not source code or customer data. Concerns about AI security and possible cyber espionage linked to nation-state actors raised. https://securityaffairs.com/165349/data-breach/openai-2023-security-breach.html

Some More, For the Curious

⛔ Qualys Security Blog security news – Qualys blog faced unauthorized spam content, investigated, no impact on customer data, production environment, or data exfiltration. https://blog.qualys.com/qualys-insights/2024/07/03/qualys-blog

🌠 Like Shooting Phish in a Barrel security research – Article explores techniques to bypass email link crawlers used by security gateways, including parsers, CAPTCHAs, redirects, browser fingerprinting, and ASN blocking. https://posts.specterops.io/like-shooting-phish-in-a-barrel-926c1905bb4b

🤕 Threat actors actively exploit D-Link DIR-859 router flaw CVE-2024-0769 warning – Threat actors exploit CVE-2024-0769 in D-Link DIR-859 routers for information disclosure. GreyNoise observes attackers collecting account details. https://securityaffairs.com/165045/hacking/d-link-dir-859-actively-exploited.html

⚔️ Sanctioned and exposed, Predator spyware maker group has gone awfully quiet security news – The Predator spyware group, Intellexa, shows decreased activity post sanctions. Observers suggest impact on operations, but caution about potential retooling. https://cyberscoop.com/sanctioned-and-exposed-predator-spyware-maker-group-has-gone-awfully-quiet/

🔒 Emergency patches now available for Juniper Networks routers vulnerability – Emergency patches released for Juniper Networks routers to fix critical authentication bypass vulnerability (CVE-2024-2973). Users urged to apply patches promptly. https://www.theregister.com/2024/07/01/emergency_patches_available_for_juniper/

😓 TeamViewer: Hackers copied employee directory data and encrypted passwords data breach – TeamViewer breach linked to Russian government-backed APT29; employee directory data and encrypted passwords stolen. https://therecord.media/teamviewer-cyberattack-employee-directory-encrypted-passwords

🦇 Exposing FakeBat loader: distribution methods and adversary infrastructure security research – Sekoia presents FakeBat loader distribution using malvertising, software impersonation, fake browser updates, and social engineering schemes. https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/

🍳 Vulnerabilities in PanelView Plus devices could lead to remote code execution vulnerability – Microsoft discovered and disclosed RCE and DoS vulnerabilities in Rockwell Automation PanelView Plus devices. https://www.microsoft.com/en-us/security/blog/2024/07/02/vulnerabilities-in-panelview-plus-devices-could-lead-to-remote-code-execution/

🥅 Caught in the Net: Using Infostealer Logs to Unmask CSAM Consumers security research – Recorded Future used infostealer logs to detect consumers of child sexual abuse material on the dark web, aiding law enforcement. https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers

🫅 “RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux vulnerability – Critical OpenSSH vulnerability CVE-2024-6387 allows remote code execution with root system rights on Linux based on glibc systems, leading to full system compromise. https://arstechnica.com/?p=2035011

🩹 Splunk fixed tens of flaws in Splunk Enterprise and Cloud Platform vulnerability – Splunk fixes 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including high-severity flaws like Remote Code Execution. https://securityaffairs.com/165204/security/splunk-enterprise-and-cloud-platform-flaws.html

💔 Secret Network Access Broker x999xx – Krebs on Security cybercrime – Russian hacker x999xx, a known access broker, trades network access, databases, and stolen data; identified. Acknowledges identity when reached by email and denies interest in harming healthcare institutions. Operates freely in Russia. https://krebsonsecurity.com/2024/07/the-not-so-secret-network-access-broker-x999xx/

🗃️ Attack Cases Against HTTP File Server (HFS) (CVE-2024-23692) security research – A remote execution vulnerability in HTTP File Server (HFS) was used to exploit user systems, install malware, and establish malicious backdoors. https://asec.ahnlab.com/en/67650/

🌍 Europol and pals band together in Cobalt Strike disruption security news – Europol conducted a week-long operation named Operation Morpheus, disrupting nearly 600 IP addresses linked to illegal copies of Cobalt Strike. https://www.theregister.com/2024/07/04/europol_cobalt_strike_crackdown/

😸 Kimsuky Group’s New Backdoor Appears (HappyDoor) security research https://asec.ahnlab.com/en/67660/

🤖 New Golang Zergeca Botnet appeared in the threat landscape malware – New Golang-based Zergeca Botnet emerges, capable of DDoS attacks and additional functionalities like scanning and reverse shell. https://securityaffairs.com/165288/cyber-crime/golang-based-zergeca-botnet.html

🥧 Polyfill.io Supply Chain Attack: Censys detected 384,773 hosts still embedding a polyfill JS script linking to the malicious domain security research – Censys identifies hosts still linking to the malicious polyfill.io domain, affecting major platforms and websites. https://securityaffairs.com/165302/hacking/polyfill-io-supply-chain-attack.html

🪶 Apache fixed a source code disclosure flaw in Apache HTTP Server vulnerability – Apache fixed a source code disclosure vulnerability (CVE-2024-39884) in Apache HTTP Server, urging users to upgrade promptly. https://securityaffairs.com/165422/security/apache-source-code-disclosure-flaw-apache-http-server.html

CISA Corner

🏭 CISA Releases Seven Industrial Control Systems Advisories vulnerability – Johnson Controls, mySCADA, ICONICS, Mitsubishi Electric https://www.cisa.gov/news-events/alerts/2024/07/02/cisa-releases-seven-industrial-control-systems-advisories

🛜 Juniper Networks Releases Security Bulletin for Junos OS: SRX Series vulnerability – Juniper Networks issued a security bulletin for Junos OS: SRX Series to fix a vulnerability leading to denial-of-service. https://www.cisa.gov/news-events/alerts/2024/07/02/juniper-networks-releases-security-bulletin-junos-os-srx-series

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog – Cisco NX-OS warning – CISA added a known exploited vulnerability (CVE-2024-20399) to its catalog, emphasizing the risks and need for prompt mitigation. https://www.cisa.gov/news-events/alerts/2024/07/02/cisa-adds-one-known-exploited-vulnerability-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 26/2024

June 30, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlights

🔒 Brauchst du wirklich ein VPN? privacy – Share article on privacy with friends via social media. https://www.kuketz-blog.de/brauchst-du-wirklich-ein-vpn/

💔 Europe and Australia will both not break encryption! We’ve interviewed Patrick Breyer – the guy who coined the term Chat Control. privacy – Germany and Australia push back against encryption legislation. https://tuta.com/blog/interview-patrick-breyer-on-chat-control

⚠️ Angriffen gegen österreichische Unternehmen und Organisationen Published warning – DDoS-Angriffe gegen österreichische Unternehmen und Organisationen. https://www.cert.at/de/aktuelles/2024/6/akute-welle-an-ddos-angriffen-gegen-osterreichische-unternehmen-und-organisationen

News For All

🎵 Music industry giants allege mass copyright violation by AI firms security news – Music labels sue AI firms for copyright infringement in training data. https://arstechnica.com/?p=2033128

⛔ Watchlist Internet – Falscher Ryanair-Support auf X warning – Scamming customers by requesting passenger details for further checks, apologizing for inconvenience. https://www.watchlist-internet.at/news/falscher-ryanair-support-auf-x/

🚨 French police shut down chat website reviled as 'den of predators' cybercrime – shut down chat website Coco for serious crimes. https://therecord.media/coco-website-takedown-cybercrime-france

🐝 The inside view of spyware’s 'dirty interference,' from two recent Pegasus victims cybercrime – Activists and journalists targeted by Pegasus spyware face privacy violations and assert their determination. https://therecord.media/pegasus-spyware-victims-sannikov-erlikh

👁️ Tagesschaukommentar zur Chatkontrolle: Empörte Ahnungslosigkeit privacy – Criticism towards public coverage of the chat monitoring proposal. https://www.kuketz-blog.de/tagesschaukommentar-zur-chatkontrolle-empoerte-ahnungslosigkeit/

🔞 Lawsuit Claims Microsoft Tracked Sex Toy Shoppers With 'Recording in Real Time' Software privacy – Microsoft accused of tracking sex toy shoppers without consent. https://www.404media.co/lawsuit-claims-microsoft-tracked-sex-toy-shoppers-with-recording-in-real-time-software/

💰 Predators steal additional $10M from crypto scam victims cybercrime – Crypto scammers pose as lawyers to defraud victims out of $10 million in a year, taking advantage of the vulnerable to extract further payments. https://www.theregister.com/2024/06/25/predators_steal_additional_10m/

🖲️ Organized crime and domestic violence perps buy trackers security research – Australian study reveals top tracker purchasers linked to organized crime and domestic violence, using devices to facilitate acts like murder, kidnapping, and drug theft. https://www.theregister.com/2024/06/26/criminals_use_gps_bluetooth_trackers/

🦠 If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately malware – Malicious code injected via Polyfill.io https://www.theregister.com/2024/06/25/polyfillio_china_crisis/

🔓 ID Verification Service for TikTok, Uber, X Exposed Driver Licenses data breach – AU10TIX, an ID verification service for TikTok, Uber, and X users, exposed administrative credentials online, risking access to users' sensitive data like driver's licenses. https://www.404media.co/id-verification-service-for-tiktok-uber-x-exposed-driver-licenses-au10tix/

💸 US boosts reward for info on 'Missing Cryptoqueen' Ruja Ignatova to $5 million cybercrime – The US offers $5 million reward for information leading to the arrest of fugitive cryptocurrency fraudster Ruja Ignatova, indicted for alleged role in defrauding victims of over $4 billion in the OneCoin scam and missing since 2017. https://therecord.media/ruja-ignatova-onecoin-cryptoqueen-us-5million-reward

⚖️ Julian Assange pleads guilty, leaves courtroom a free man security news – Julian Assange pleads guilty to one charge, receives a 62-month sentence which he has already served, leaving him free, following a plea deal, long-standing legal battles, and high-profile leaks through WikiLeaks, including the 'Collateral Murder' video. https://www.theregister.com/2024/06/26/assange_pleads_guilty_sentenced_freed/

📚 Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Plugins malware https://www.wordfence.com/blog/2024/06/supply-chain-attack-on-wordpress-org-plugins-leads-to-5-maliciously-compromised-wordpress-plugins/

💻 How to manage deleted files on iOS, iPadOS, and macOS cyber defense – To manage and permanently delete files on iOS, iPadOS, and macOS, ensure files are deleted across iCloud sync. Check sync status, sync apps, and activate sync on Apple devices. https://www.theverge.com/24188104/ios-icloud-iphone-mac-delete-files

Some More, For the Curious

⛑️ New cyberthreat research for SMB in 2024 security research – Small Medium Business' face rising cyberthreats requiring multifaceted cybersecurity measures. https://securelist.com/smb-threat-report-2024/113010/

💫 CISA confirms hackers may have accessed data from chemical facilities during January incident security news – CISA confirms potential data access from cyberattack on chemical facilities. https://therecord.media/cisa-confirms-hackers-chemical-facilities

⚔️ Troy Hunt – The State of Data Breaches data breach – Challenges in disclosing breaches and notifying victims; bugbears with breach notifications. https://www.troyhunt.com/the-state-of-data-breaches/

🤪 I am Goot (Loader) security research – Cybereason investigates GootLoader malware, part of GootKit family, utilized by UNC2565 for post-exploitation. GootLoader leverages SEO for infection, targets victims with legal document masquerade, believed to be associated with financial incentives. https://www.cybereason.com/blog/i-am-goot-loader

📊 Taking an Evidence-Based Approach to Vulnerability Prioritization security research – VulnCheck's blog emphasizes the importance of prioritizing vulnerabilities based on exploit evidence, recommending Known Exploited Vulnerabilities (KEV), weaponized vulnerabilities, and Proof of Concept (POC) exploit codes as top priorities, alongside additional considerations such as ransomware usage, botnet exploitation, and threat actors' activities. https://vulncheck.com/blog/vulnerability-prioritization

☃️ Snowflake isn’t an outlier, it’s the canary in the coal mine security news – Recent attacks on Snowflake were a result of stolen credentials originating from infostealers, highlighting an industry-wide shift towards identity-focused threats; extensive use of credentials from phishing, infostealers and insider threats; the importance of protecting data with MFA; emphasis on rapid response to infostealer infections, password resets, and secure credential storage. https://blog.talosintelligence.com/infostealer-landscape-facilitates-breaches/

👹 Global Revival of Hacktivism Requires Increased Vigilance from Defenders security news – Mandiant observes a resurgence in hacktivism involving complex tactics, including intrusion, information operations, and physical world tampering. https://cloud.google.com/blog/topics/threat-intelligence/global-revival-of-hacktivism/

👃 LockBit group falsely claimed the hack of the Federal Reserve ransomware – The LockBit ransomware group falsely claimed to have hacked the US Federal Reserve when in fact the victim was Evolve Bank & Trust. Media outlets reported that the Federal Reserve had previously penalized the bank for deficiencies in risk management, anti-money laundering, and compliance practices. https://securityaffairs.com/164988/cyber-crime/lockbit-has-not-hacked-federal-reserve.html

🪟 TeamViewer responds to security 'irregularity' in IT network security news – TeamViewer detected a security 'irregularity' in its corporate IT environment, prompting an immediate investigation and implementation of remediation measures. The company downplays the incident, asserting that the product environment and customer data remain unaffected. https://www.theregister.com/2024/06/28/teamviewer_network_breach/

🎑 Sustaining Digital Certificate Security – Entrust Certificate Distrust security news – Chrome to distrust some Entrust certificates due to compliance failures. https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html

🧋 TeamViewer says Russia broke into its corp IT network security news – Russian cyber-spies breached TeamViewer's corporate IT network, contained to non-production systems, no customer data accessed. https://www.theregister.com/2024/06/28/teamviewer_russia/

🏎️ Supply-chain ransomware attack cripples thousands of car dealerships cybercrime – A ransomware attack by the BlackSuit gang targeted CDK Global, a platform widely used by car dealerships, leading to system shutdowns and disruptions in business operations. https://www.exponential-e.com/blog/supply-chain-ransomware-attack-cripples-thousands-of-car-dealerships

🩻 Mitigating Skeleton Key, a new type of generative AI jailbreak technique security research – Skeleton Key, a new type of generative AI jailbreak technique called Explicit: forced instruction-following, bypasses guardrails in AI models, enabling the production of harmful content. Microsoft discovered and mitigated this vulnerability with Prompt Shields. https://www.microsoft.com/en-us/security/blog/2024/06/26/mitigating-skeleton-key-a-new-type-of-generative-ai-jailbreak-technique/

❄️ Russia's Midnight Blizzard stole email of more Microsoft customers security news – Microsoft warns more customers of email theft by Russia-linked Midnight Blizzard hacking campaign. Incident response team reaching out to customer administrators to provide a secure portal to view stolen emails from the cyberespionage group. https://securityaffairs.com/165038/hacking/midnight-blizzard-email-microsoft-customers.html

🔍 Google will address Android’s Find My Device network issues ‘over the coming weeks’ security news – Google addressing issues with Android's Find My Device network. https://www.theverge.com/2024/6/26/24186381/google-find-my-device-tracking-pixel-android

CISA Corner

🔐 CISA Releases Two Industrial Control Systems Advisories security news https://www.cisa.gov/news-events/alerts/2024/06/25/cisa-releases-two-industrial-control-systems-advisories 🔒 CISA Adds Three Known Exploited Vulnerabilities to Catalog security news https://www.cisa.gov/news-events/alerts/2024/06/26/cisa-adds-three-known-exploited-vulnerabilities-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 25/2024

June 23, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

💌 Security bug allows anyone to spoof Microsoft employee emails vulnerability – Bug allows MS employee email spoofing, not yet patched. https://techcrunch.com/2024/06/18/security-bug-allows-anyone-to-spoof-microsoft-employee-emails/?guccounter=1

💳 First million breached Ticketmaster records released for free data breach – Ticketmaster breached records leaked, potential for phishing attacks. https://www.malwarebytes.com/blog/news/2024/06/first-million-breached-ticketmaster-records-released-for-free

🗨️ Signal president Meredith Whittaker criticizes EU attempts to tackle child abuse material privacy – Signal Foundation president criticizes EU proposal. https://therecord.media/european-council-e2ee-proposal-signal-whittaker-criticism

⚖️ Signal, MEPs urge EU Council to drop encryption-eroding law security news – EU Council set to vote on law aiming to fight child exploitation online by requiring client-side scanning of digital communication to prevent dissemination of unlawful content, jeopardizing encryption. Signal and MEPs strongly advocate against the proposal, highlighting privacy and security risks. https://www.theregister.com/2024/06/18/signal_eu_upload_moderation/

🦥 Federal contractors pay multimillion-dollar settlements over cybersecurity lapses security news – Federal contractors fined for cybersecurity failures during NY program. https://therecord.media/federal-contractors-pay-multimillion-settlement

🖼️ AI Images in Google Search Results Have Opened a Portal to Hell privacy – Google Search results show AI-generated images without indication of origin. https://www.404media.co/google-image-search-ai-results-have-opened-a-portal-to-hell/

🪬 Proton is taking its privacy-first apps to a nonprofit foundation model privacy – Proton transitions to nonprofit foundation model with emphasis on privacy. https://arstechnica.com/gadgets/2024/06/proton-is-taking-its-privacy-first-apps-to-a-nonprofit-foundation-model/

💸 The Financial Dynamics Behind Ransomware Attacks cybercrime – Ransomware attacks evolve with financial incentives using cryptocurrency for anonymity. https://securityaffairs.com/164636/cyber-crime/financial-dynamics-ransomware-attacks.html

🤹 How are attackers trying to bypass MFA? security news – Increased incidents related to MFA bypass attempts, including push notifications and social engineering tactics. https://blog.talosintelligence.com/how-are-attackers-trying-to-bypass-mfa/

🔑 How quickly can attackers guess your password? security research – Study reveals most passwords can be cracked in less than an hour. https://securelist.com/passworde-brute-force-time/112984/

⌛ Meta delays training its AI using public content shared by EU users privacy – Meta postpones training its large language models with public content from adult users in the EU due to a request from the Irish Data Protection Commission, highlighting disappointment over the decision and emphasizing the need to bring the benefits of AI to people in Europe. https://securityaffairs.com/164652/laws-and-regulations/meta-postponing-training-llm-eu-data.html

🚗 Car dealerships hit with massive computer system outage cybercrime – CDK Global cyberattack disrupts car dealerships in North America. https://www.theverge.com/2024/6/20/24182484/car-dealerships-massive-computer-system-outage-cdk-global

🚅 Amtrak forces password changes after user account break-ins security news – Amtrak's Guest Rewards program faces a security breach due to credential stuffing, prompting mandatory multi-factor authentication and password resets for affected users. https://www.theregister.com/2024/06/19/amtrak_has_had_another_breach/

💛 Google Chrome 126 update addresses multiple vulnerabilities security news – high-severity vulnerabilities reported by security researchers at a hacking competition, including type confusion and memory access issues. https://securityaffairs.com/164688/security/google-chrome-126-update.html

😵 Qilin Ransomware: What You Need To Know cybercrime – Qilin, a ransomware-as-a-service operation with Russian links, demands high ransoms; targeted London hospitals sparked attention. https://www.tripwire.com/state-of-security/qilin-ransomware-what-you-need-know

⛔ Biden administration bans sale of Kaspersky software in US security news – The Biden administration bans Kaspersky Labs from selling software in the USA due to concerns about ties to the Russian government and potential exploitation in cyberoperations. https://cyberscoop.com/biden-administration-bans-sale-of-kaspersky-software-in-us/

🐦‍⬛ Australian regulator blames lack of multi-factor authentication for Medibank hack security news https://therecord.media/medibank-hack-australian-government-report-mfa

Some More, For the Curious

🕵️ TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution security research – TikTag exploits ARM's ME for data exposure through speculation. https://arxiv.org/abs/2406.08719

🐮 Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages vulnerability – Mailcow code vulnerabilities lead to remote code execution. https://www.sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messages/

💻 Road to redemption: GhostSec's hacktivists went to the dark side. Now they want to come back security news – GhostSec shifts from hacktivism to cybercrime with ransomware attacks and claims to shift back. https://therecord.media/ghostsec-hacktivism-cybercrime-interview-click-here-podcast

🧃 Multiple vulnerabilities resolved in Juniper Secure Analytics in 7.5.0 UP8 IF03 vulnerability https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-vulnerabilities-resolved-in-Juniper-Secure-Analytics-in-7-5-0-UP8-IF03

🪧 Schneier on Security – Rethinking Democracy for the Age of AI security opinion – Bruce Schneier discusses rethinking governance systems for the age of AI, pointing out the need for new systems that align incentives and resist hacking, addressing issues like misinformation, misaligned incentives, and inadequate governance structures. https://www.schneier.com/blog/archives/2024/06/rethinking-democracy-for-the-age-of-ai.html

🍩 NHS boss says Scottish trust didn't meet attackers' demands data breach – NHS Dumfries and Galloway's CEO informs residents of a cyberattack where data was stolen but not altered; the criminals published the data. https://www.theregister.com/2024/06/18/nhs_dumfries_and_galloway_letter/

🩹 VMware fixed RCE and privilege escalation bugs in vCenter Server security news – VMware patched vCenter Server vulnerabilities allowing remote code execution and privilege escalation, impacting multiple versions. https://securityaffairs.com/164659/hacking/vmware-fixed-vcenter-server-flaws.html

🪼 AMD is investigating claims of stolen company data security news – AMD is investigating allegations of stolen company data, including future product information, being offered for sale by a threat actor known as IntelBroker. https://www.theverge.com/2024/6/18/24181406/amd-investigating-claims-stolen-company-data-sale-intelbroker

🚨 Qilin has ‘no regrets’ over the healthcare crisis it caused security news – The ransomware gang Qilin, responsible for a deliberate and politically motivated attack on London hospitals to leverage against political elites of specific countries, demanded a $50 million ransom. They claim to have stolen over one terabyte of data to be leaked, potentially causing a healthcare crisis in the UK capital. https://www.theregister.com/2024/06/20/qilin_our_plan_was_to/

🔐 High severity bugs in Confluence vulnerability – Atlassian fixed nine high-severity vulnerabilities in Confluence, Jira, and Crucible products, including improper authorization flaws and SSRF issues. https://securityaffairs.com/164743/security/atlassian-confluence-crucible-jira-flaws.html

⚡ UK's largest nuclear site denies being hacked but pleads guilty over cybersecurity failures cybercrime – Sellafield nuclear site in UK faces charges related to cybersecurity failings under Nuclear Industries Security Regulations 2003. https://therecord.media/sellafield-guilty-plea-uk-nuclear-facility-cybersecurity

🔍 SCCM Exploitation: Evading Defenses and Moving Laterally with SCCM Application Deployment security research – SCCM exploitation risks and attacks explained. https://www.guidepointsecurity.com/blog/sccm-exploitation-evading-defenses-and-moving-laterally-with-sccm-application-deployment/

🐥 A Bird’s-eye view: ShareFinder-How Threat Actors Discover File Shares (The DFIR Report) security research – Attackers exploit file shares, Canaries detect malicious activity. https://blog.thinkst.com/2024/06/a-birds-eye-view-sharefinder-how-threat-actors-discover-file-shares-the-dfir-report.html

🐴 Polish investigators seize Pegasus spyware systems as part of probe into alleged abuse security news – investigations ongoing regarding the legality and purchase of the software, which allegedly targeted opposition politicians in Poland. https://therecord.media/poland-seizure-pegasus-spyware-systems

🦟 Phoenix UEFI bug affects long list of Intel chip families vulnerability – A UEFI firmware vulnerability, CVE-2024-0762, affecting Phoenix Technologies UEFI firmware used across various Intel chip families poses threats such as buffer overflow and code execution. https://www.theregister.com/2024/06/21/uefi_vulnerability_intel_chips/

🛡️ Threat actors exploited SolarWinds Serv-U vulnerability vulnerability – CVE-2024-28995, a directory traversal issue allowing access to sensitive files; GreyNoise reports extensive attempts following public disclosure and availability of proof-of-concept code. https://securityaffairs.com/164806/hacking/solarwinds-serv-u-cve-2024-28995-exploit.html

CISA Corner

🦮 CISA Releases Guidance on Single Sign-On (SSO) Adoption for Small and Medium-Sized Businesses: (SMBs) security news – CISA shared a detailed report on challenges to SSO adoption by SMBs and suggested ways to enhance security. https://www.cisa.gov/news-events/alerts/2024/06/20/cisa-releases-guidance-single-sign-sso-adoption-small-and-medium-sized-businesses-smbs

🦮 CISA and Partners Release Guidance for Modern Approaches to Network Access Security security news – advocate for modern security solutions like Zero Trust, SSE, and SASE for improved network access security. https://www.cisa.gov/news-events/alerts/2024/06/18/cisa-and-partners-release-guidance-modern-approaches-network-access-security

🔒 RAD Data Communications SecFlow-2 vulnerability – RAD Data Communications' SecFlow-2 device is vulnerable to path traversal, allowing attackers to retrieve files from the operating system remotely. https://www.cisa.gov/news-events/ics-advisories/icsa-24-170-01

🔒 CISA Releases Three Industrial Control Systems Advisories security news – security issues affecting Yokogawa CENTUM, CAREL Boss-Mini, and Westermo L210-F2G. https://www.cisa.gov/news-events/alerts/2024/06/20/cisa-releases-three-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 24/2024

June 16, 2024

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

📢 Android: Werbung/Tracker schnell und einfach systemweit loswerden privacy https://www.kuketz-blog.de/android-werbung-tracker-schnell-und-einfach-systemweit-loswerden/

News For All

⚕️ Microsoft, Google pledge 'low cost' cybersecurity services to rural hospitals security news – Microsoft and Google, in collaboration with the White House, are offering reduced-price cybersecurity services to rural hospitals to address the rising cyber threat in the healthcare sector. https://therecord.media/microsoft-google-rural-hospital-cybersecurity

🗳️ AI and the Indian Election “security” research – Indian election features (legitimate) AI, including deepfakes and personalized communication. https://www.schneier.com/blog/archives/2024/06/ai-and-the-indian-election.html

🧬 Privacy authorities in Canada and UK announce joint probe of 23andMe data breach data breach – privacy regulators launch a joint investigation into the global data breach at genetic testing company 23andMe, which exposed the genetic data of at least 5 million users in October 2023. https://therecord.media/23andme-data-breach-canada-uk-privacy-investigation

🚗 One of the major sellers of detailed driver behavioral data is shutting down privacy https://arstechnica.com/cars/2024/06/one-of-the-major-sellers-of-detailed-driver-behavioral-data-is-shutting-down/

⚔️ China state hackers infected 20,000 Fortinet VPNs, Dutch spy service says security news – The backdoor malware CoatHanger was installed, persisting despite reboots. Fortinet's delayed disclosure of the vulnerability impacted response. https://arstechnica.com/security/2024/06/china-state-hackers-infected-20000-fortinet-vpns-dutch-spy-service-says/

🫗 Cylance clarifies breach, dodges questions about the source data breach – Cybersecurity firm Cylance confirms a data breach related to marketing data from 2015-2018 before BlackBerry acquisition. Data allegedly includes customer, partner, and employee names and email addresses, with no compromise to current systems. https://www.theregister.com/2024/06/11/cylance_clarifies_data_breach_details/

⏺️ Patch Tuesday, June 2024 “Recall” Edition – Krebs on Security security news – including a critical flaw in Microsoft Message Queuing that could allow attackers to remotely control a system. Adobe also released security updates for multiple products. https://krebsonsecurity.com/2024/06/patch-tuesday-june-2024-recall-edition/

🦾 Semiconductor giants Nvidia and Arm warn of new flaws in their graphics processors security news – Arm warns of an actively exploited zero-day flaw in its Mali GPU Kernel Driver, CVE-2024-4610, allowing unauthorized access to sensitive information. Nvidia discloses 10 new vulnerabilities in its GPU Display Driver and vGPU software. https://therecord.media/nvidia-arm-semiconductor-flaws-patches

📶 Microsoft fixes hack-me-via-Wi-Fi Windows security hole security news – Microsoft's June Patch Tuesday addresses multiple CVEs, including a publicly known DNSSEC flaw, a severe remote code execution flaw in MSMQ, and a Wi-Fi driver remote code execution hole. Adobe releases 10 patches covering 166 CVEs, addressing various critical vulnerabilities. SAP issues a dozen security notes, including high-priority alerts for bugs affecting NetWeaver. PHP, Arm, Apple, Google, SolarWinds, Fortinet, and Cisco also release security updates. https://www.theregister.com/2024/06/12/june_patch_tuesday/

👿 CISA adds Android Pixel, Microsoft Windows, Progress Telerik Report Server bugs to its Known Exploited Vulnerabilities catalog security news – CISA lists exploited vulnerabilities in Android, Windows, and Telerik. https://securityaffairs.com/164525/security/cisa-adds-android-pixel-microsoft-windows-progress-telerik-report-server-known-exploited-vulnerabilities-catalog.html

🦹 Ukrainian police identify suspected affiliate of Conti, LockBit groups cybercrime – Ukrainian cyber police identify a Kyiv resident, specializing in developing cryptors to evade antivirus detection. The Dutch police expressed gratitude for the cooperation in apprehending the suspect. https://therecord.media/ukraine-suspected-lockbit-conti-affiliate

🏮 How China’s Cyber Ecosystem Feeds Off Its Superstar Hackers security research – Analysis highlights China's leveraging of civilian talent for state-sponsored cyber operations through hacking contests and bug bounties. Chinese researchers dominate hacking competitions, leading to vulnerability research being harnessed by state operations. https://news.risky.biz/how-chinas-cyber-ecosystem-feeds-off-its-superstar-hackers/

🛤️ Google faces GDPR complaint over Privacy Sandbox privacy – Privacy campaigner noyb files a GDPR complaint against Google, alleging that the 'Privacy Feature' in the Chrome browser resulted in unwanted tracking, contrary to its promotion of eliminating third-party tracking cookies through the Privacy Sandbox API. https://www.theregister.com/2024/06/13/noyb_gdpr_privacy_sandbox/

🥸 Watch Out! CISA Warns It Is Being Impersonated By Scammers warning – CISA warns of rising impersonation scams where scammers pretend to be trusted entities to trick victims into sharing sensitive information or money, using social engineering tactics. https://www.tripwire.com/state-of-security/watch-out-cisa-warns-it-being-impersonated-scammers

⏸️ Meta hits pause on EU AI training plans under pressure privacy – Meta postpones plans to train AI models on EU Facebook and Instagram posts after privacy complaints, affecting launch of Meta AI in the economic zone, but continues with plans for other regions. https://www.theregister.com/2024/06/14/meta_eu_privacy/

📔 CERT.at – How we cover your back cyber defense – CERT.at proactively informs network operators about potential security issues affecting Austrian companies. https://www.cert.at/en/blog/2024/6/how-we-cover-your-back

HIBP Corner 🆕 Telegram Combolists and 361M Email Addresses security news – 151M mail new addresses with passwords some connected websites. https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/

Some More, For the Curious

🕵️ Bypassing Veeam Authentication CVE-2024-29849 security research – authentication bypass vulnerability explained with code analysis. https://summoning.team/blog/veeam-enterprise-manager-cve-2024-29849-auth-bypass/

⏳ 1/6 | How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension hacking write-up – Creators developed malicious VSCode extension in 30 minutes, exposing source code to remote server. https://medium.com/@amitassaraf/the-story-of-extensiontotal-how-we-hacked-the-vscode-marketplace-5c6e66a0e9d7

🪞 Microsoft Refused to Fix Flaw Years Before SolarWinds Hack — ProPublica security news – Microsoft ignored critical security flaw for years pre-SolarWinds hack. https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers

🕵️ How scammers bypass 2FA cybercrime – Scammers utilize OTP bots and phishing kits to bypass 2FA by social engineering victims and intercepting OTPs. OTP bots automate scam calls to victims for obtaining codes, providing various features. https://securelist.com/2fa-phishing/112805/

📳 Hacking Millions of Modems (and Investigating Who Hacked My Modem) hacking write-up https://samcurry.net/hacking-millions-of-modems

🛡️ Windows flaw may have been exploited with Black Basta ransomware before it was patched security research – Symantec evidence suggests pre-patch exploitation. https://therecord.media/black-basta-ransomware-zero-day-windows

👑 Alleged Boss of ‘Scattered Spider’ Hacking Group Arrested – Krebs on Security cybercrime – A 22-year-old UK man was arrested in Spain. The group is accused of hacking into multiple organizations, accessing critical data and funds. Noyb and UK authorities accuse him of SIM-swapping and heading the notorious gang involved in cyber theft activities, including costly ransom attacks at casinos. https://krebsonsecurity.com/2024/06/alleged-boss-of-scattered-spider-hacking-group-arrested/

👟 Ransomware Group Exploits PHP Vulnerability Days After Disclosure vulnerability https://www.securityweek.com/ransomware-group-exploits-php-vulnerability-days-after-disclosure/

👋 ASUS fixed critical remote authentication bypass bug in several routers security news https://securityaffairs.com/164549/security/asus-router-models-critical-rce.html

CISA Corner

🔐 Fortinet Releases Security Updates for FortiOS https://www.cisa.gov/news-events/alerts/2024/06/11/fortinet-releases-security-updates-fortios 🛡️ Microsoft Releases June 2024 Security Updates https://www.cisa.gov/news-events/alerts/2024/06/11/microsoft-releases-june-2024-security-updates 🔓 CISA Adds Two Known Exploited Vulnerabilities to Catalog CVE-2024-4610 ARM Mali GPU Use-After-Free and CVE-2024-4577 PHP-CGI Command Injection. https://www.cisa.gov/news-events/alerts/2024/06/12/cisa-adds-two-known-exploited-vulnerabilities-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub