← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:06]
B
These are the cybersecurity headlines for Friday, January 17, 2025 I'm Rich Stroffelino Biden signed Cybersecurity Executive Order on his way out the door President Biden's latest executive order builds off of President Obama's April 2015 EO13694, updating the criteria used by the Secretary of the treasury in designating a person for sanctions for engaging in speech, specified malicious cyber enabled activities and related conduct. The order also calls on federal government agencies to better secure communications against adversaries, adopt industry cybersecurity best practices across the federal system and promote security with and in AI systems. Deputy National Security Advisor Anne Neuberger said the goal of the order is to make it costly and harder for China, Russia, Iran and ransomware criminals. Star Blizzard targeting WhatsApp New research from Microsoft found that the Russian state sponsored threat group Star Blizzard has made significant changes in its TTPS to incorporate WhatsApp into its phishing campaigns. A mid-November 2024 campaign saw the group sending emails, supposedly from a US government official, with an intentionally broken QR code under the guise of showing support for Ukrainian NGOs. When users requested a new link that actually worked, the operator would send a malicious shortened link that posed as a WhatsApp group invite instead. This took users to a phishing site with an account linking QR code and that opened the door to accessing their WhatsApp messages. Microsoft hasn't seen the campaign in operation since the end of November. This isn't Microsoft's first look into Star Blizzard. It collaborated with the US DOJ to shut down over 180 of its sites used in its previous phishing operations. US healthcare sector saw 585 breaches in 2024. That figure comes from an analysis by Security Week pulled from the US Department of Health and Human Services Office for Civil Rights healthcare breach database. These attacks impacted roughly 180 million user records. The change healthcare breach accounted for roughly 100 million of these. 75% of the attacks targeted healthcare providers, with 17% impacting healthcare business associates. Hacking it incident, which includes ransomware, was cited as the cause in the vast majority of attacks, with unauthorized access a distant second. Healthcare organizations in Texas saw the most incidents last year with 56. More details on the PowerSchool breach Details on how many school districts have been impacted by the breach at the Cloud platform provider PowerSchool have been hard to find. The company hasn't given a comprehensive list with school districts contacting impacted families directly. However, sources at two impacted school districts speaking to TechCrunch said attackers accessed a large amount of personal data from current and former students and staff. One source said PowerSchool did not implement basic security controls like MFA even after seeing evidence of outside access in their logs. PowerSchool spokesperson Beth Keebler said data retention policies for PowerSchool vary widely between districts and even among individuals, but said we expect the majority of involved customers did not have Social Security numbers or medical information exfiltrated. Still no word on what threat actor orchestrated the attack and now, thanks to Today's episode sponsor DropZone AI what if your SoC could handle 10 times the alerts without burning out your team? AI automates Tier 1 investigations and frees your analysts to tackle bigger challenges. It's how smart teams are staying ahead See how it works. Schedule a demo today at dropzone AI that's d r o p z o n e AI law firm discloses breach from 2023 the law firm Wolf Haldenstein, Alder Freeman and hers disclosed it suffered a data breach on December 13, 2023, impacting personal information on roughly 3.4 million people, including names, Social Security numbers, medical diagnoses and claims information. Even though the incident was detected over a year ago, the firm said digital forensic complications delayed its investigation. While it has published a general breach notice and informed Maine's attorney general of the incident, it hasn't been able to send notices to many impacted individuals due to a lack of contact information. The breach notice claimed that there was no evidence of misuse of this data, but Wolff Haldenstein will offer credit monitoring for those that believe they were impacted. Nvidia releases AI safeguard agents Nvidia Inference Microservices, or nim, are a set of containerized, lightweight AI models that can moderate responses from larger models. The company released three new NIM offerings specifically trained around topic control, content safety, and and jailbreak protection. The Topic Control NIM prevents AI agents from getting off topic in things like service interactions. The content safety NIM was trained on the Human Annotated Aegis Content Safety dataset, and the jailbreak service will help users from bypassing system restrictions because they are relatively lightweight. The idea is NIM allows developers to implement multiple guardrails without adding much latency to responses. Tunneling protocol flaws expose millions of hosts New findings from noted WI FI security researcher Matthew van Hoof of KU Leuven University and top 10 VPN show that several tunneling protocols, including IPIP and GRE, can be made to accept tunneling packets without verifying the sender. The researcher said. This could be used to abuse hosts as one way proxies, but conduct DoS attacks and DNS spoofing. The team found 4.26 million vulnerable hosts, including VPN servers, ISP provided home routers and CDN nodes online. Most of the vulnerable nodes were located in China. The researchers published full technical details and defense recommendations for hosts, so look for those in our show Notes Feds need to Speed Up Cloud adoption A bipartisan report from the center for Strategic and International Studies found that the federal government significantly lags the private sector in adopting cloud services, which has created a problem for citizen service delivery and CyberSecurity. As of 2024, only 13% of the $130 billion in federal IT spending went to cloud services. The report calls on the Office of Management and Budget to accelerate the removal of legacy IT systems and include minimum cybersecurity standards in federal contracts for cloud services. As the federal government looks to expand the use of AI in federal projects, cloud services become essential for processing and data storage Just one quick announcement. The CISO series is hiring. We're looking for a production assistant to help out our team. If that sounds like something for you or someone you know, head ON over to cisoseries.com for details. Reporting for the CISO series, I'm Rich Stroffelino, reminding you to have a super sparkly day.
- [07:37]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.