[InfoSec MASHUP] 36/2024
[InfoSec MASHUP] 36/2024
CrowdStrike facing multiple lawsuits; D-Link will not fix security flaws in its DIR-846W routers; The US, U.K, and EU signed another AI treaty;
Welcome to the 32 new members from the last 30 days! This newsletter now has 1,516 subscribers.
Partners and Affiliates
🔐 NordVPN — Save up to 75% + 3 Extra Months!
Breaches & Security Incidents
Microchip Technology confirms data was stolen in cyberattack
Transport for London discloses ongoing “cyber security incident”
🇺🇸 🔓 Planned Parenthood of Montana confirmed a cyberattack that occurred in late August, involving the theft of 93 gigabytes of data — The organization is investigating the incident and has reported it to federal law enforcement. RansomHub, the group responsible for the attack, is demanding a ransom by September 11 to avoid publishing the stolen material.
🇺🇸 🔓 Verkada will pay a $2.95 million penalty for security failures that allowed hackers to access live feeds from 150,000 cameras in sensitive locations — The Federal Trade Commission found that Verkada misrepresented its security measures and violated the CAN-SPAM Act by sending promotional emails without opt-out options. Moving forward, Verkada must improve its security practices and report any cyber incidents to the FTC within 10 days.
🇺🇸 🔓 CBIZ Benefits & Insurance Services reported a data breach where hackers accessed client information between June 2 and June 21, 2024 — Nearly 36,000 individuals had their names, contact details, Social Security numbers, and other sensitive data stolen. Although there is no evidence of misuse, CBIZ is offering credit monitoring and identity theft protection to affected clients.
🇺🇸 ⚖️ CrowdStrike is facing multiple lawsuits after a faulty software update disrupted companies worldwide, with Delta potentially seeking up to $500 million in damages — Shareholders are also suing, claiming the company misled them about its software testing practices. Legal experts believe a class action suit may emerge as more companies join the fight against CrowdStrike, which must balance defending itself and maintaining good relationships with clients.
Cybercrime, Cyber Espionage, APT’s
🇺🇸 🇷🇺 The U.S. has charged five members of a Russian military intelligence unit for engaging in destructive cyber operations and hacking campaigns — These individuals are accused of using malware to attack various systems, including Ukrainian government networks, since 2020. The U.S. is offering a reward for information on their whereabouts and is sending a strong message to Russian military intelligence about their actions.
👀 🦠 Predator spyware has shown new signs of activity after a quiet period, according to Recorded Future — The spyware, linked to the company Intellexa, has targeted various officials and may have a new customer in the Democratic Republic of the Congo. Despite sanctions and media exposure affecting its operations, the spyware continues to operate with some adjustments.
🇳🇬 ⚖️ A Nigerian man named Franklin Ifeanyichukwu Okwanna was sentenced to five years in prison for his involvement in business email compromise schemes that caused over $5 million in losses. He pleaded guilty to the charges, while his co-defendant received a ten-year sentence. Okwanna expressed regret for his actions, stating he was blinded by financial problems.
💸 Sextortion scams have become more personal by including photos of victims' homes in threatening emails — The scammers claim to have recorded embarrassing videos and demand a Bitcoin ransom of nearly $2,000. The FBI warns that victims should never send compromising images and should report any sextortion attempts.
🇷🇺 🇧🇾 A hacktivist group called Head Mare is targeting organizations in Russia and Belarus using a new WinRAR vulnerability — They employ various malicious tools and methods, including ransomware attacks, to extract sensitive data and demand ransoms. Their tactics are part of the ongoing cyber conflict related to the Russo-Ukrainian war.
🔐 💸 Cicada3301 is a new ransomware group that targets companies worldwide, using double-extortion tactics to steal data and encrypt systems. This ransomware specifically attacks VMware ESXi environments and employs similar techniques to the known ALPHV/BlackCat group, suggesting a possible connection between them. By disrupting virtual machines and encrypting critical files, Cicada3301 aims to maximize damage and pressure on victims to pay ransoms.
🇺🇸 ⚖️ Daniel Rhyne, a 57-year-old former engineer from Missouri, was arrested for attempting to extort his former employer for $750,000 in Bitcoin — He is charged with extortion, intentional damage to a protected computer, and wire fraud after threatening to shut down the company's servers. If convicted, Rhyne could face up to 35 years in prison.
🇬🇧 ⚖️ Three men in the UK pleaded guilty to running OTP Agency, a service that helped scammers intercept one-time passcodes needed for online accounts. The service operated for 18 months before being shut down by authorities, who found it targeted over 12,500 people. Despite its closure, other similar services continue to operate.
Government, Politics, and Privacy
🇺🇸 🇷🇺 The U.S. Justice Department has accused Russia of trying to interfere in the 2024 elections — They indicted two employees from Russia Today for using fake companies to spread disinformation online. The government also seized 32 internet domains linked to a campaign aimed at influencing American voters.
🇺🇸 The White House has released a new plan to improve the security of internet routing, specifically targeting vulnerabilities in the Border Gateway Protocol (BGP). Officials warn that BGP is at risk from hackers and that better protections are needed. The plan includes recommendations for network operators and government agencies to adopt stronger security measures to safeguard internet infrastructure.
🇺🇸 The Cybersecurity and Infrastructure Security Agency (CISA) is focusing on improving election security for the 2024 elections and will not push social media companies to remove false information. Instead, CISA plans to work with state and local election officials to provide accurate information to voters. This marks a shift from their previous approach, which included flagging misinformation for removal.
Partners and Affiliates
🌐 Stay connected and secure on the go with Airalo's global eSIMs — Use the code NEWTOAIRALO15 if you’re new to Airalo to get an additional 15% discount.
Malware & Threats
🦠 🍑 Hackers are using a fake OnlyFans tool that pretends to help steal accounts but actually infects users with dangerous malware called Lumma — This malware steals sensitive information like passwords and two-factor authentication codes from its victims. The operation highlights the risks even experienced cybercriminals face from their peers in the dangerous world of hacking.
🦠 🇰🇵 North Korean hackers have created a fake video conferencing app to trick job seekers into downloading malware during supposed job interviews — This campaign, called Contagious Interview, uses deceptive tactics to steal sensitive information, including data from cryptocurrency wallets and web browsers. The hackers are constantly evolving their methods and expanding their targeting to various job search platforms.
🦠 🇧🇷 A new malware called Rocinante is targeting Android users in Brazil by posing as banking apps to steal sensitive information — It uses keylogging and phishing techniques to gain access to personal data and can take over infected devices. The malware is spread through phishing sites, tricking users into installing fake apps that request accessibility privileges.
🦠 🧩 Roblox developers are being targeted by attackers using fake npm packages that mimic the legitimate 'noblox.js' library to steal sensitive data. These malicious packages, such as noblox.js-async and noblox.js-thread, are designed to appear trustworthy and can install malware like Quasar RAT on developers' systems. Developers need to remain cautious as new malicious packages continue to emerge despite efforts to remove them.
AI, Crypto, Tech & Tools
Microsoft gives deepfake porn victims a tool to scrub images from Bing search
🤖 🇺🇸 A North Carolina musician named Michael Smith was charged with defrauding streaming services out of $10 million using AI to create fake songs — He allegedly set up a scheme with bots to stream these songs and collect royalties for seven years. If convicted, Smith could face up to 20 years in prison for wire fraud and money laundering.
🤖 🇺🇸 🇬🇧 🇪🇺 The U.S., U.K., and EU have signed a treaty by the Council of Europe aimed at ensuring AI use aligns with human rights and democracy — This treaty is the first legally binding international agreement on AI safety, focusing on protecting individuals and maintaining the rule of law. Countries that signed must now ratify the treaty before it takes effect, which could take time.
🤖 🇮🇪 Ireland's privacy watchdog has ended its legal battle with X (formerly Twitter) after the company agreed to permanently limit how it uses European users' data for AI training — This agreement comes after X faced legal action for using personal data without consent. Similar data protection issues have also affected other companies like Meta in the EU.
🇺🇸 🇰🇵 The FBI warned that North Korean hackers are targeting cryptocurrency companies and their employees with sophisticated social engineering attacks to steal crypto assets. These attackers conduct extensive research on potential victims and often impersonate familiar contacts to gain trust. Since 2017, North Korean hacking groups have stolen an estimated $3 billion in cryptocurrency through various attacks.
🇺🇸 🏧 In 2023, U.S. Bitcoin ATM scams caused over $110 million in losses, a dramatic increase from previous years. Scammers often impersonate government officials to trick victims into depositing cash into these ATMs. The FTC warns consumers, especially older adults, to be cautious and verify any unexpected requests for money before acting.
🇳🇱 💰 Clearview AI has received its largest GDPR fine of €30.5 million from the Dutch data protection authority for violating privacy laws by using people's images without consent — The company may face an additional penalty of €5.1 million if it continues to ignore compliance requests. The Dutch regulator is also considering holding Clearview's executives personally liable for these violations.
🎣 💸 In August, the crypto market lost over $313 million due to scams and hacks, with pig butchering scams becoming a major concern. The largest hacks were phishing attacks, which accounted for 93.5% of the stolen funds.
🍎 🚢 Apple filed a DMCA takedown request, leading to the removal of the popular Docker-OSX project from Docker Hub, which allowed virtualization of macOS on non-Apple hardware. The project, used by many developers and security researchers, faced this action because it allegedly violated Apple's copyright by reproducing its macOS installer without authorization. Although the Docker-OSX images are gone, the project's code remains available on GitHub.
Vulnerabilities, Research, and Threat Intelligence
Android’s September 2024 Update Patches Exploited Vulnerability
Cisco Fixes Two Critical Flaws in Smart Licensing Utility to Prevent Remote Attacks
Veeam Releases Security Updates to Fix 18 Flaws, Including 5 Critical Issues
🪳 🔓 A critical security flaw has been found in the LiteSpeed Cache plugin for WordPress, allowing unauthenticated users to take control of accounts. This vulnerability affects versions up to 6.4.1 and can be fixed by updating to version 6.5.0.1. Users are advised to check for exposed debug log files and take steps to secure their installations.
🤷🏻♂️ D-Link will not fix four serious security flaws in its DIR-846W routers because the product is no longer supported — Users are advised to replace the router immediately, as continuing to use it poses a security risk. If replacement isn't possible, D-Link recommends updating firmware, using strong passwords, and enabling WiFi encryption.
🪳 🔓 The YubiKey 5, a popular device for two-factor authentication, has a cryptographic flaw that makes it vulnerable to cloning if someone gains physical access — This issue affects all models in the YubiKey 5 series and possibly other devices using the same microcontroller. Unfortunately, affected YubiKeys cannot be updated or patched, leaving them permanently at risk.
🪳 🔓 Eight vulnerabilities in Microsoft apps for macOS could allow hackers to access sensitive data and gain elevated privileges without user consent. These flaws affect applications like Outlook, Teams, and Word, enabling attackers to misuse permissions granted to these apps. Microsoft has acknowledged the issues but considers them low risk and is working on fixes for some affected applications.