Transcript
A (0:00)
From the CISO series. It's Cybersecurity Headlines.
B (0:06)
These are the cybersecurity headlines for Monday, December 30, 2024. I'm Steve Prentiss. Cybersecurity Company's Chrome Extension hijacked for data Theft cyberhaven is a data loss prevention company based in Palo Alto. On December 24, it suffered a breach as a result of a successful phishing attack on an administrator account for the Google Chrome Store. This resulted in at least five Chrome extensions being compromised by threat actors who injected information stealer code through a malicious version of the Cyber Haven extension. Cyberhaven's customers include Snowflake, Motorola, Canon, Reddit and mirahealth as well as many others. The company's internal security team removed the malicious package within an hour of detection. Hackers steal Zag customer credit cards in third party breach the Utah based manufacturer of consumer electronics accessories including screen protectors, phone cases, keyboards and power banks is informing customers that their credit card data has been exposed to unauthorized individuals after hackers compromised a third party application provided by the company's e commerce provider BigCommerce Commerce. In this incident, which occurred between October 26th and November 7th, the attacker breached the Fresh Click app provided by BigCommerce and injected malicious code that stole shoppers car details. FreshClick is a third party app not built by BigCommerce, but which helps create applications and responsive websites for the BigCommerce platform. Volkswagen software company Cariad suffers Amazon Cloud breach the breach, discovered by Europe's largest ethical hacker association, revealed that sensitive information for 800,000 electric vehicles from brands such as Audi, Volkswagen and Skoda were left exposed on a poorly secured and misconfigured Amazon cloud storage system. The data stolen includes GPS coordinates, battery charge levels and other vehicle status details, but experts warn that such data can be easily connected to owners personal credentials thanks to additional data accessible through VW Group's online services. The data had been vulnerable for months. However, a carrier representative said that the exposed data affected only vehicles connected to the Internet and which had been registered for online services. The representative continued saying that the data could only be accessed after bypassing several security mechanisms that required significant time and technical expertise. An investigation by the German magazine Spiegel shows that the list of affected customers includes German politicians, entrepreneurs, the entire fleet of the Hamburg police force and even suspected intelligence service employees. Four Faith routers exposed to new exploit due to default credentials According to researchers at Valncheck, this is a high severity flaw being an operating system command injection bug affecting router models F3X24 and F3X36 with a CVE number and a CVSS score of 7.2. The researchers say this vulnerability has come under active exploitation in the wild. However, the exploit only works if the attackers successfully authenticate themselves or if the router's default credentials have not been changed. For faith spelled F O U R F A I T H is a Beijing based manufacturer of wireless communication technology 5G and AI. Thanks to today's episode's sponsor, ThreatLocker. Do zero day exploits and supply chain attacks keep you up at night? Well, worry no more. You can harden your security with ThreatLocker. ThreatLocker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that is T H R E A T L O C K-E R.com White House blames Telcom's lax security for SALT typhoon the White House stated on Friday that as the US Government continues to assess the damage caused by the SALT typhoon hacks, the breach occurred in large part due to telecommunications companies failing to implement rudimentary cybersecurity measures across their IT infrastructure. Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, told reporters that the Biden administration has further zeroed in on how these companies can improve their cybersecurity, particularly by sharing threat hunting guides and instructions for hardening of systems. These guides, shared with telecom companies, have unearthed a new victim, bringing the total of affected telecom companies to nine, although the name of this ninth company has not been mentioned. Furthermore, the White House still cannot definitively say the actors have been removed from the telecom networks. HIPAA to be updated with cybersecurity regulations Additional news from Anne Neuberger's Friday press conference reveals that new cybersecurity rules covering how healthcare institutions protect user data will be proposed under the Health Insurance Portability and Accountability Act. Neuberger described this as the first update to HIPAA's security rule in over a decade and will require entities who maintain healthcare data to encrypt it. In addition, healthcare entities also will have to monitor their networks for threats and do compliance checks to see whether they are abiding by the new HIPAA rules. End quote Pro Russia hacking group targets Italian sites, including airports. The group NoName57 has launched a new series of DDoS attacks against Italian infrastructure, targeting the websites for Malpensa and Linate airports, both near Milan, as well as the site of the Ministry of Foreign affairs and the Turin Transport Group. According to Security affairs, the attacks have had no impact on airport operations. The hacking group stated on its Telegram channel that the attacks were their response to what they call Italian Russophobes. Palo Alto Networks fixes high severity PANOS flaw this flaw, which has a CVE number and a CVSS score of 8.7, could trigger denial of service on vulnerable devices, allowing an unauthenticated attacker to reboot the firewall by sending a malicious packet through its data plane, forcing the firewall into maintenance mode. The vulnerability affects pan OS versions 10 dot anything and 11 anything, but can be exploited only if DNS security logging enabled. Remember to subscribe to the CISO series on YouTube. We publish original demos, interviews and clips from our show and we host our Week in Review livestream there. If you enjoy the CISO series and you haven't checked it out, just search for ciso series on YouTube and you will find us. I'm Steve Prentiss reporting for the CISO series.