[InfoSec MASHUP] 01/2025
U.S. Army Soldier Arrested in AT&T, Verizon Extortions; Volkswagen’s Software Company Leaked Data; Apple Will Pay $95 Million to Settle a Privacy Lawsuit;
Welcome to the 20 new members from the last 30 days! This newsletter now has 1,621 subscribers.
Partners and Affiliates
🔐 NordVPN Christmas Campaign (Dec 10 - Jan 8) - Save up to 74% + 3 Extra Months!
Breaches & Security Incidents
🇺🇸 The Brain Cipher ransomware gang has leaked stolen data from Rhode Island's RIBridges social services platform, affecting about 650,000 people. The breach exposed sensitive personal information, including names, addresses, and Social Security numbers. State officials are advising residents to monitor their credit and be cautious of phishing scams.
🇩🇪 Volkswagen’s software company, Cariad, accidentally exposed data from around 800,000 electric cars, including precise vehicle locations and driver information. The issue was caused by incorrect IT configurations and was discovered by ethical hackers, who informed Cariad about the vulnerability. Cariad quickly fixed the problem and stated that they found no evidence of data misuse by anyone other than the hackers.
🔊 Interested in Reaching a Cybersecurity Audience?
Amplify your brand’s presence by sponsoring the InfoSec MASHUP newsletter!
Reach dedicated readers in the cybersecurity field with each issue! Contact us to explore sponsorship opportunities.
Cybercrime, Cyber Espionage, APT’s
🇺🇸 🇨🇳 The U.S. Department of Treasury confirmed that several of its workstations were hacked by a group linked to China through a third-party software provider. The hackers accessed a key that allowed them to remotely view certain unclassified documents. The Treasury is investigating the incident with help from various security agencies and believes they have since secured their systems.
🇷🇺 🇩🇪 Three Russian-German nationals have been charged with espionage for working as agents for the Russian secret service. One of them, Dieter S., is accused of planning sabotage against German military infrastructure and gathering intelligence on potential targets. The case highlights increasing concerns about espionage activities involving foreign agents in Germany.
Government, Politics, and Privacy
🍏 💰 Apple will pay $95 million to settle a lawsuit over privacy violations involving its Siri voice assistant. Users who had accidental Siri activations can claim $20 for each eligible device. The lawsuit arose after reports that Apple shared users' private conversations with third parties.
🇺🇸 The U.S. Department of Justice has implemented a new rule that stops the bulk transfer of Americans' personal data to countries like China, Russia, and Iran. This rule aims to protect citizens' sensitive information from being exploited by foreign adversaries for malicious purposes. It will take effect in 90 days and outlines specific restrictions and penalties for violating these data protections.
🇺🇸 🇷🇺 🇮🇷 The U.S. State Department has sanctioned two foreign organizations and one individual for trying to interfere in the 2024 U.S. general election on behalf of Russian and Iranian intelligence. These groups aimed to create social tensions and spread disinformation using advanced technology, including generative AI. U.S. officials believe these efforts had varying impacts, with some being more successful than others in influencing American public opinion.
🇺🇸 The White House reported that the Salt Typhoon hacks occurred because telecom companies did not have basic cybersecurity measures in place — They emphasized the need for improved security practices and shared guidelines to help these companies protect their networks. The attackers, believed to be affiliated with China, targeted sensitive information, including communications of government officials.
🇺🇸 🩺 The U.S. Department of Health and Human Services has proposed new HIPAA rules to improve cybersecurity in healthcare organizations, requiring data restoration within 72 hours and annual compliance audits. These changes aim to protect sensitive patient information from rising ransomware attacks, which have significantly increased in recent years. Healthcare entities must also implement measures like encryption, multi-factor authentication, and regular vulnerability testing to enhance their security.
Partners and Affiliates
🌐 Stay connected and secure on the go with Airalo's global eSIMs — Use the code NEWTOAIRALO15 if you’re new to Airalo to get an additional 15% discount.
Malware & Threats
🦠 🎠 Researchers found a malicious npm package called ethereumvulncontracthandler, which pretends to detect Ethereum vulnerabilities but actually installs a remote access trojan named Quasar RAT on developer systems. The package is heavily obfuscated to evade detection and connects to a command-and-control server to control infected machines. This discovery highlights the risks in the open-source software supply chain and the unreliability of GitHub star counts as a measure of reputation.
AI, Crypto, Tech & Tools
🇮🇳 🔐 Several VPN apps, including Cloudflare's 1.1.1.1, have been removed from India's app stores due to government orders. The Indian Ministry of Home Affairs enforced this action under new rules requiring VPN providers to keep extensive user data. This has led some VPN companies to withdraw their services or stop marketing in India.
🤖 🔓 The "Bad Likert Judge" technique allows users to manipulate large language models (LLMs) into generating harmful content by having them evaluate responses on a Likert scale. This method significantly increases the success rate of jailbreak attempts, allowing bypassing of LLM safety measures. Results show that it can enhance attack success rates by over 60% across various harmful categories.
🔐 💰 A recent survey found that 63% of security leaders believe CISOs are not investing enough in code security, especially with the rapid increase of AI-generated code. Many organizations are struggling with tool sprawl and a lack of visibility in their security efforts, leading to plans for consolidating security tools. As a result, security budgets are expected to increase by 50% in the coming year to address these challenges.
🔑 Passkey technology aims to solve the problem of secure and reliable account login — While it presents a strong defense against phishing and hacking, many users still find it challenging to implement. The struggle to manage unique passwords and security remains a common issue for the average person.
Vulnerabilities, Research, and Threat Intelligence
Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API
📤 🔓 Over 3 million mail servers using POP3 and IMAP are at risk because they lack TLS encryption, making them vulnerable to attacks. Without TLS, usernames and passwords can be intercepted as they are sent in plain text. Security experts are urging server operators to enable TLS to protect user information from eavesdropping.
🧩 🔓 Hackers targeted Chrome extension developers with a phishing campaign, compromising at least 35 extensions and injecting data-stealing code. The attack began with deceptive emails that tricked developers into granting access to a malicious OAuth application. This led to stolen Facebook data from users of the affected extensions, impacting around 2.6 million people.
🔓 Hackers are exploiting a vulnerability in Palo Alto Networks firewalls that causes them to reboot, which can lead to service disruptions. This issue affects devices with 'DNS Security' logging enabled, and manual intervention is needed to restore normal operations. The company has released patches for most affected versions but will not update the outdated PAN-OS 11.0.
ICS, OT & IoT
🪳 🔓 A serious vulnerability in over 15,000 Four-Faith routers allows attackers to exploit the system if default credentials are not changed. This flaw, known as CVE-2024-12856, can lead to unauthorized command execution and persistent remote access. There are currently no available patches for this issue, and attacks may have started as early as November 2024.