[InfoSec MASHUP] 39/2024
[InfoSec MASHUP] 39/2024
Microsoft's security reboot; Kaspersky deletes itself; Deloitte breached but clients are safe; Tor Project merges with Tails; Critical vulnerability in the NVIDIA Container Toolkit;
Welcome to the 32 new members from the last 30 days! This newsletter now has 1,549 subscribers.
Partners and Affiliates
🔐 NordVPN - Save up to 75% + 3 Extra Months!
Breaches & Security Incidents
🇬🇧 Police in the UK are investigating a cyberattack on public Wi-Fi networks at major train stations — Passengers saw an offensive message when trying to connect, but no personal data was compromised. The Wi-Fi service has been turned off during the investigation.
🇮🇷 A watering hole attack has compromised 25 Kurdish websites for over a year, aiming to steal sensitive information — The attackers used malicious scripts to gather data from visitors and redirect them to harmful Android apps. The exact perpetrators remain unknown, but the campaign highlights a new threat targeting the Kurdish community.
🇺🇸 🔓 The Centers for Medicare & Medicaid Services (CMS) reported that a data breach affected over 3.1 million health plan beneficiaries due to a ransomware attack last year. Personal information, including names, Social Security numbers, and Medicare details, was stolen from the Wisconsin Physicians Service health insurance corporation. CMS is offering a year of free credit monitoring to those impacted, but there are concerns about the stolen data being sold or shared online.
🇺🇸 💥 MoneyGram's money transfer services are currently down due to a cyberattack that began on September 22 — The company is working to restore its systems after taking some offline for safety, but its website remains inaccessible. They have notified law enforcement but have not confirmed if ransomware was involved in the incident.
🔓 A hacker named IntelBroker claims to have stolen data from a poorly secured server belonging to Deloitte — Deloitte confirmed a data breach but stated that there is no threat to client or sensitive data. Many claims made by hackers on forums are often false or exaggerated.
➝ More breaches:
Cybercrime, Cyber Espionage, APT’s
🇮🇳 Cloudflare has reported that a hacking group with ties to India, known as SloppyLemming, is targeting entities in South and East Asia for espionage — They use phishing emails and malicious cloud services to steal credentials and deliver malware, focusing on sectors like government and law enforcement. The group has been active since at least 2021 and has targeted organizations in countries including Pakistan, Sri Lanka, and Bangladesh.
🇨🇳 🇺🇸 Chinese hackers have breached several U.S. internet service providers in a cyber espionage campaign aimed at stealing sensitive information — The group, known as GhostEmperor, has been linked to past attacks and is trying to maintain access to the networks for future data harvesting. This incident highlights ongoing threats from state-sponsored cyberattacks targeting critical infrastructure in the U.S.
🇮🇷 Mandiant has reported on an Iranian hacking group known as UNC1860, which targets networks in the Middle East, particularly government and telecommunications entities — This group uses advanced tools to gain initial access to victim networks and maintain long-term control. Their operations highlight a significant threat to cybersecurity in the region, as they support various objectives like espionage and network attacks.
💸 The hacker known as "Judische," linked to the Snowflake data breaches, is still active and targeting software providers. Research indicates he has extorted nearly $2 million, affecting companies like AT&T and Ticketmaster. Judische is believed to be a 26-year-old software engineer based in Ontario, Canada.
Government, Politics, and Privacy
Telegram now shares users’ IP and phone number on legal requests
Mozilla Faces Privacy Complaint for Enabling Tracking in Firefox Without User Consent
🇸🇪 🇮🇷 Swedish authorities accused Iran of sending thousands of revenge-seeking text messages over Quran burnings in 2023, which Iran denied. The messages, sent by Iran's Revolutionary Guard, aimed to portray Sweden as Islamophobic and create societal division. Sweden's security agency stated that this incident highlights the growing aggression of foreign powers targeting its stability.
🇮🇷 🇺🇸 An alleged Iranian hacking operation targeting Donald Trump's campaign is still active, as indicated by recent communications sharing stolen campaign materials. The U.S. government has linked these activities to Iran’s efforts to disrupt U.S. elections and sow discord. Hackers have attempted to access personal email accounts of individuals connected to both Trump and Biden's campaigns.
🇺🇸 🇨🇳 🇷🇺 The U.S. Commerce Department is proposing a ban on connected and autonomous vehicles that use Chinese and Russian software and hardware to protect national security. The ban would take effect for software in 2027 and for hardware in 2030, as there are concerns about data security and the potential for foreign control of vehicles. This move aims to prevent vulnerabilities before Chinese and Russian vehicles become common on U.S. roads.
Partners and Affiliates
🌐 Stay connected and secure on the go with Airalo's global eSIMs — Use the code NEWTOAIRALO15 if you’re new to Airalo to get an additional 15% discount.
Malware & Threats
Inside SnipBot: The Latest RomCom Malware Variant - By Palo Alto Unit42
🦠 🇰🇵 North Korean hackers linked to a group called Kimsuky are using new malware called KLogEXE and FPSpy in targeted attacks. KLogEXE acts as a keylogger, while FPSpy can gather system information and execute commands on infected devices. Most attacks have focused on victims in South Korea and Japan.
💸 🐧 A new version of Mallox ransomware, called "Mallox Linux 1.0," is targeting Linux systems using leaked code from the Kryptina ransomware. This marks a shift for Mallox, which previously focused only on Windows. The modified ransomware has the same encryption methods but features a different name and appearance.
🦠 🤖 HP discovered a phishing email campaign using an AI-generated malware dropper, which is a new step in malicious software evolution. The malware was unique because it was neatly structured with comments, suggesting it was created by AI for a human, rather than by a skilled programmer. This indicates that even inexperienced attackers can leverage AI to create malware, raising concerns about future threats from more experienced criminals using similar tools.
🎠 🏦 A new Android banking trojan called Octo2 has been discovered, featuring enhanced capabilities for taking over devices and conducting fraud — It has been found in various malicious apps across several European countries and is based on the leaked source code of the original Octo malware. Octo2's advanced features make it a significant threat to mobile banking users worldwide.
🦠 🤖 Two apps on Google Play, Wuta Camera and Max Browser, were found infected with the Necro trojan, affecting around 11 million downloads — This malware can display ads, install unwanted applications, and subscribe users to paid services. Kaspersky reported that it spreads through both official and unofficial app sources, targeting users in several countries.
🦠 A cybercriminal group called "Marko Polo" has launched a large infostealer malware campaign targeting crypto users and gamers through various tactics like phishing and brand impersonation. They spread multiple types of malware that can steal sensitive personal and financial information, affecting thousands of devices worldwide. Experts warn that this operation could lead to significant financial losses and pose risks to privacy and business security.
🦠 🇰🇵 North Korean hackers are using fake Python packages to spread a new malware called PondRAT, targeting software developers. This malware is part of a campaign known as Operation Dream Job, which tricks victims into downloading malicious software through enticing job offers. The attackers aim to gain access to supply chain vendors and their customers' systems, posing a significant risk to organizations.
AI, Crypto, Tech & Tools
The US Secret Service Spent $50,000 on OpenAI and Won’t Say Why
🧅 🔀 The Tor Project is merging with Tails, a privacy-focused Linux operating system. This merger aims to improve collaboration and sustainability in the fight against digital surveillance and censorship. Together, they will enhance tools for users needing privacy and security.
🪳 🤖 Google's AI assistant, Gemini, can help users in Workspace but also has security vulnerabilities that could be exploited for phishing attacks — An AI security firm, HiddenLayer, demonstrated how indirect prompt injections could manipulate Gemini's outputs in Gmail, Slides, and Drive. Although Google considers these issues "intended behaviors," they pose significant risks to users.
🦀 Google's switch to the Rust programming language has significantly reduced memory vulnerabilities in Android, dropping from 76% to 24% over six years — This approach emphasizes Safe Coding, which helps make code safer and more secure over time. By focusing on memory-safe development, Google aims to further enhance security and address vulnerabilities proactively.
🪳 🤖 A security researcher found a vulnerability in ChatGPT that let attackers store false information in users' long-term memory. This flaw could allow hackers to steal user data indefinitely. OpenAI has since issued a partial fix for the issue.
🇺🇸 🇷🇺 Kaspersky has removed its antivirus software from U.S. customers' computers and replaced it with UltraAV without prior notice — This change follows Kaspersky's decision to shut down its U.S. operations due to national security concerns and a government ban. Many users were alarmed to find UltraAV installed, fearing it might be malware, and faced difficulties uninstalling it.
🔐 Microsoft has prioritized security for all employees after a critical report highlighted past issues — The company has launched the Secure Future Initiative, employing 34,000 engineers to improve security processes and culture. Microsoft has also appointed new deputy CISOs and created a security training program to enhance employee awareness and accountability.
Vulnerabilities, Research, and Threat Intelligence
Second Pwn2Own Automotive Contest Offers Over $1 Million in Prizes 💰💰
Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug
🪳 🔓 Wiz Research found a critical security vulnerability in the NVIDIA Container Toolkit that affects many AI applications using NVIDIA GPUs — This vulnerability allows attackers to escape from containers and access the underlying host system, putting sensitive data at risk. Organizations are urged to update to the latest version of the toolkit to protect against potential exploits.
💥 A critical vulnerability in Ivanti's Virtual Traffic Manager is being exploited, marking the third warning for Ivanti customers in two weeks — This flaw allows attackers to create an administrator account without authentication. Ivanti has released patches and recommendations, but the threat remains significant as the vulnerability has been added to CISA's Known Exploited Vulnerabilities list.
🔓 🗣️ Jen Easterly, the head of CISA, claims that software developers who release insecure code are the real culprits in cybercrime — She emphasizes the need for better software quality and urges buyers to pressure vendors to prioritize security. Easterly believes that instead of blaming victims for cyberattacks, we should hold technology companies accountable for their product defects.
ICS, OT & IoT
🇮🇱 🇱🇧 A pro-Israel hacker group called Red Evil claims to have hacked water systems used by Hezbollah in Lebanon, but experts question the validity of their claims. The U.S. cybersecurity agency CISA warns that simple methods can be used to hack industrial control systems, yet many hackers exaggerate their impact. Recent events suggest this could be more of a misinformation campaign rather than a significant cyberattack.
🏥 🔓 A researcher claims that a US healthcare facility has left its door access system vulnerable to hacking for over a year — Despite the researcher’s findings, the healthcare organization, Cedars-Sinai, denies any issues, stating that the vulnerabilities do not affect its facilities. The researcher, who has a history of mental health struggles, is now focused on exposing security flaws in access control systems to improve safety.
🔓 ⛽️ Vendors of automatic tank gauge systems have been warned about serious software vulnerabilities that could allow hackers to gain full control of critical networks — Some companies have ignored these alerts, putting systems in airports, gas stations, and hospitals at risk. While a few vendors have responded with fixes, others have not addressed the issues, leaving many systems vulnerable.
🔓 ⚡️ Hackers can exploit unpatched vulnerabilities in Riello UPS devices to gain control, according to the cybersecurity firm CyberDanube. Two serious flaws in the NetMan 204 network card allow unauthorized access and potential shutdown of the UPS systems. Riello has not yet fixed these issues, even after being informed in June, prompting CyberDanube to publicly disclose the vulnerabilities.