[InfoSec MASHUP] 38/2024
[InfoSec MASHUP] 38/2024
Temu denies breach; AT&T agrees to $13 million fine for 3rd party breach; Hezbollah's biggest security breach; LinkedIn using your data for AI training; An UN office for AI Governance; Dell breached?
Welcome to the 42 new members from the last 30 days! This newsletter now has 1,546 subscribers.
Partners and Affiliates
🔐 NordVPN - Save up to 75% + 3 Extra Months!
Breaches & Security Incidents
🇱🇧 🇸🇾 Pagers used by Hezbollah members exploded in Lebanon and Syria during a remote attack, killing at least nine people. The explosions were likely caused by small explosives built into the pagers, suggesting a planned operation possibly involving a state actor like Israel. Hezbollah had advised its members to avoid cellphones for security reasons, leading them to use pagers instead. “We hold the Israeli enemy fully responsible for this criminal aggression,” Hezbollah said in a statement on Tuesday evening.
Lebanon is rocked again by exploding devices as Israel declares a new phase of war
Iran linked hacker group Handala Hack Team claim pager explosions linked to Israeli battery company
🇺🇸 🔓 Hackers are asking for $6 million in bitcoin from the Seattle-Tacoma International Airport after stealing documents in a cyberattack — The airport has refused to pay the ransom and is working with the FBI to investigate the incident. Some airport operations were affected, but flights continued during the attack.
🇷🇺 Russian cybersecurity firm Doctor Web was recently targeted in a cyberattack but successfully prevented any harm to its users. The company temporarily disconnected its resources and suspended its virus databases to investigate the incident. Doctor Web has not revealed who was behind the attack, which is a growing concern for cybersecurity companies worldwide.
🇺🇸 🔓 AT&T has agreed to pay a $13 million fine for a data breach that affected over 8.9 million customers, linked to a third-party cloud vendor. The breach involved the theft of customer information that should have been deleted years earlier. As part of the settlement, AT&T must improve how it protects customer data and oversee its vendors more closely.
🇨🇳 🔓 Temu denies a hacker's claim of stealing 87 million customer records, stating that their investigation found no matching data. The hacker, who goes by the name 'smokinthashit', insists they breached Temu and has offered the data for sale. Despite these claims, Temu emphasizes its strong security measures and plans to take legal action against those spreading false information.
🔓 Over 1,000 misconfigured ServiceNow instances are exposing sensitive corporate Knowledge Base articles to unauthorized users — This includes personal information and system credentials, putting companies at risk. Security updates have not fully addressed the issue, and administrators need to improve access controls to protect this information.
🇺🇸 🔓 The Port of Seattle confirmed a ransomware attack occurred on August 24, affecting its systems. The criminal group Rhysida is behind the attack, and the Port has refused to pay the ransom. They are investigating what data may have been stolen and will inform affected individuals if necessary.
➝ More breaches:
Cybercrime, Cyber Espionage, APT’s
☁️ Ransomware gangs are using Microsoft Azure tools, like Azure Storage Explorer and AzCopy, to steal data from hacked networks — They store this stolen data in Azure Blob storage, making it harder for security systems to detect. This trend highlights the increasing focus on data theft in ransomware attacks, as it helps attackers extort their victims more effectively.
🇮🇷 An Iranian cyber group known as UNC1860, linked to the Ministry of Intelligence and Security, is facilitating cyber intrusions in the Middle East by providing remote access to target networks — This group has been involved in various attacks since July 2022, using specialized tools to maintain long-term access to high-priority systems. Recent reports highlight their ongoing efforts to influence U.S. elections by stealing and disseminating non-public material from political campaigns.
🎣 ❌ Authorities in Europe and Latin America arrested 17 people involved in a phishing network that affected 483,000 victims — The group operated a platform called iServer, which helped criminals unlock stolen mobile phones. This operation marked the first collaboration between Europol and Ameripol, leading to multiple searches and the seizure of various items.
🇩🇪 💸 German authorities seized 47 cryptocurrency exchanges that helped cybercriminals, including ransomware gangs, launder money anonymously. These exchanges did not follow regulations, allowing users to hide their identities during transactions. The operation, called "Final Exchange," aims to track down users and prevent future cybercrime by securing extensive data from these platforms.
🇦🇺 Australian police have infiltrated the encrypted messaging app Ghost, leading to the arrest of 38 suspects and its alleged administrator, Jay Je Yoon Jung. The app was reportedly used by various criminal organizations to coordinate illegal activities, including drug importation and violence. Police have prevented numerous serious crimes by monitoring communications through the app since March.
🇷🇺 🇺🇸 Russian influence groups are now targeting the Harris-Walz campaign with fake videos to discredit Vice President Kamala Harris — Microsoft reported that these videos include false claims about her involvement in accidents and attacks. This shift shows that Russia remains active in interfering with the upcoming U.S. presidential election.
U.S. agencies say Iranian hackers tried to pass ‘non-public’ Trump campaign docs to Biden’s campaign
🇺🇸 🇨🇳 The U.S. government has charged a Chinese man named Song Wu for using spear-phishing emails to steal restricted software from NASA and military employees. Song pretended to be U.S. researchers to trick individuals into sharing proprietary software. He faces serious charges, including wire fraud and identity theft, which could lead to 20 years in prison.
Government, Politics, and Privacy
🇺🇦 Ukraine has banned the Telegram messaging app on government and military devices due to security concerns amid the ongoing war with Russia. Officials highlighted that Russian intelligence could access users' data, making it a national security threat. Despite the ban, regular citizens will still use Telegram for communication and news updates.
🇩🇪 🧅 The Tor Project responded to reports that German police successfully deanonymized a user suspected of distributing child sexual abuse materials on the dark web — They noted that this was possible due to the user employing outdated software without recent protective features. Despite this incident, the Tor Project believes users can still trust the network for anonymity, as they have since implemented new protections against such attacks.
🇺🇸 👀 The Federal Trade Commission (FTC) found that popular streaming services and social media platforms collect vast amounts of user data without proper privacy protections, especially for children and teens. The report highlights that these companies often track users even after they leave their sites, creating detailed consumer profiles. It calls for improved data privacy measures, including limiting data collection and increasing transparency.
🇺🇸 🤖 California has passed strict laws to regulate artificial intelligence, particularly focusing on election-related deepfakes and actor clones — One law requires platforms to label or remove AI deepfakes that could influence elections, while others mandate consent from actors before creating AI replicas of their likeness or voice. Governor Newsom is also reviewing additional AI bills that could impact the open-source community.
🇺🇸 👀 The U.S. government has imposed new sanctions on five individuals and a company linked to Intellexa, a maker of spyware — These sanctions target those involved in selling Intellexa's Predator spyware to authoritarian governments. The U.S. aims to disrupt the commercial spyware industry, which has been used to target officials and journalists.
🇺🇸 🗳️ The FBI and CISA warn the public to ignore false claims about hacked U.S. voter registration data — They emphasize that this publicly available information does not indicate any compromise of election infrastructure. Citizens should rely on official sources for accurate information about election security.
Partners and Affiliates
🌐 Stay connected and secure on the go with Airalo's global eSIMs — Use the code NEWTOAIRALO15 if you’re new to Airalo to get an additional 15% discount.
Malware & Threats
🦠 🇰🇵 North Korean hackers are targeting the energy and aerospace industries with a new malware called MISTPEN, using job-themed phishing schemes to lure victims. This group, known as UNC2970, aims to access sensitive information by posing as recruiters and sending malicious files disguised as job descriptions. They have a history of cyber-espionage and have been active since at least 2013, focusing on various countries around the world.
💸 A hacking spree on X accounts has led to a pump-and-dump scheme for the $HACKED crypto token on the Solana blockchain — Prominent accounts, including MoneyControl and People Magazine, were hacked to promote the token, resulting in a rapid increase in its market cap. The exact method of the hacks is unclear, but the situation is evolving quickly as people rush to buy and sell the token.
🦠 💸 Binance has warned users about a rise in clipper malware attacks that steal cryptocurrency by replacing wallet addresses in the clipboard. This malware is often spread through unofficial apps, especially on Android devices, leading to significant financial losses. Users are advised to be cautious about downloading software from unofficial sources and to check for suspicious activity.
🦠 💻 A new malware locks users in their browser's kiosk mode, forcing them to enter their Google credentials, which are then stolen. The malware disables the Escape and F11 keys, making it hard to exit the login page. Victims should avoid entering sensitive information and try alternative methods to regain control of their computer.
AI, Crypto, Tech & Tools
Discord rolls out end-to-end encryption for audio, video calls
Google rolls out automatic passkey syncing via Password Manager
➝ LinkedIn and generative AI (GAI) FAQs
➝ LinkedIn scraped user data for training before updating its terms of service
🤖 ☂️ A UN report highlights the urgent need for coherent global governance of artificial intelligence, which currently lacks consistency and faces challenges from vested interests. The report warns that while AI can be powerful, it can also cause significant harm due to poor inputs and lack of regulation. Recommendations include creating international standards, fostering cooperation among governments, and establishing a dedicated UN office to oversee AI governance efforts.
🔐 Google is developing end-to-end encryption for RCS messaging between Android and iPhone users. This new feature aims to improve security and protect users from scams and fraud. Google is committed to making secure messaging available to all RCS users, regardless of their platform.
🤖 🇬🇧 Meta will start training its AI models using public posts from adult users on Facebook and Instagram in the U.K. — Users will receive notifications about this and can opt out if they don't want their data used. The company ensures it won't use private messages or data from minors, and it is working with the U.K. Information Commissioner's Office to comply with regulations.
🔐 Google is updating Chrome's encryption to a NIST-approved system called ML-KEM to enhance security against quantum computer attacks. This change will replace the previous method, Kyber, as ML-KEM is more reliable and standardized. The update is set to be released in Chrome version 131 on November 6, 2024.
🇨🇳 🇹🇭 Two Chinese men were arrested in Thailand for using a remote jammer to steal from parked cars — They distracted victims while blocking their car locks, allowing them to steal valuables. Police also arrested a Thai woman linked to the suspects and found drugs in her home.
Vulnerabilities, Research, and Threat Intelligence
SolarWinds Patches Critical Vulnerability in Access Rights Manager
VMware Patches Remote Code Execution Flaw Found in Chinese Hacking Contest
🔓 A security flaw known as PKfail affects about nine percent of tested firmware images, leaving many devices vulnerable to malware attacks — This issue arises from the use of non-production cryptographic keys that were meant to be replaced by manufacturers but were still used. While some companies have released patches, many devices remain at risk, and users should limit access to unsupported devices.
☁️ 🔓 Tenable revealed a vulnerability called CloudImposer that could have allowed attackers to execute remote code on Google Cloud Platform services — This issue arose from a Python argument that made it possible for attackers to upload malicious packages, hijacking legitimate ones. Google has since patched the vulnerability and updated its documentation to reduce the risk of such attacks.
💥 🩹 A critical vulnerability (CVE-2024-29847) in Ivanti Endpoint Manager has been publicly exploited, making it essential for users to update their devices immediately — This flaw allows remote attackers to execute arbitrary code due to insecure deserialization within the software. Ivanti has released security patches for affected versions, and applying these updates is the only recommended solution.
ICS, OT & IoT
🕸️ 🛜 Researchers have discovered a large IoT botnet called Raptor Train, which has compromised over 200,000 devices globally since at least May 2020. Operated by a Chinese hacking group known as Flax Typhoon, this botnet targets various IoT devices and is capable of conducting sophisticated attacks. The botnet's structure allows it to efficiently manage and exploit a vast number of vulnerable devices, raising significant cybersecurity concerns.
U.S. government ‘took control’ of a botnet run by Chinese government hackers, says FBI director