← Cybersecurity Headlines
Cybersecurity Headlines
DOGE outrage and lawsuit, CISA KEV additions, DeepSeek encryption lapses
00:09:03
Loading summary
Transcript1 lines
- [00:00]
Steve Prentiss
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, February 10, 2025. I'm Steve Prentiss. Shock and Lawsuit over Security Failures in Doge Takeover following up on a story we were covering last week. This is a triple story. Today, experts in cybersecurity and government process are likening the current activities of the Doge Group, that is the Department of Government Efficiency, as an ongoing data breach, stating that the act of exposing the personal data of millions of federal employees violates federal laws against sharing classified or sensitive information with uncleared individuals and creates new cybersecurity vulnerabilities for malicious hackers to exploit, end quote. Chief amongst these concerns, they say, are efforts by Elon Musk's team to access the Department of the Treasury's payment system housed in the Bureau of Fiscal Service, which controls much of the spending by the federal government, including congressionally mandated programs like Social Security. The White House stated last Monday that Doge employees access to these systems were restricted to read only. In addition, according to Brian Krebs quoting wired magazine, a 19 year old person working for the DOGE group was given given access to sensitive US government systems, even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so. This individual is reported to be a former denizen of the com, an archipelago of discord and telegram chat channels that function as a kind of distributed cybercriminal social network for facilitating instant collaboration, end quote. And thirdly, students at the University of California on Friday sued the federal Education Department to stop the Doge team from accessing federal student financial aid databases, which house sensitive information belonging to more than 42 million Americans. The plaintiffs, who are members of the University of California Student association, which serves all of the system's campuses statewide, argue that the access granted to Doge by Acting Secretary of Education Denise Carter violates the Federal Privacy act and the Internal Revenue Code, end quote. This lawsuit is different from the one we reported on last week from union groups filed against Treasury Secretary Scott Besant on Monday of last week. CISA adds Microsoft Outlook and Sophos XG firewall to its known exploited Vulnerabilities catalog. Five new vulnerabilities have been added to the catalog this last week, being a 7 zip mark of the web bypass vulnerability, a DANTE Discovery Process Control vulnerability, a Cyber Roam OS SQL Injection vulnerability, the aforementioned Sophos XG firewall Buffer Overflow vulnerability, and the Microsoft Outlook Improper Input Validation Vulnerability that we reported on on Friday. This Microsoft Outlook vulnerability and the buffer overflow issue from Sophos XG Firewall each have a CVSS score of 9.8. In addition, according to Trend Micro security researcher Peter Gurness, the 7zip vulnerability has already been actively exploited by Russian cybercrime groups through spearfishing campaigns using homoglyph attacks to spoof document extensions and trick users and the Windows operating system into executing malicious files. Federal agencies must fix these vulnerabilities by February 27th, and a list of the CVE numbers assigned to each is available in the show. Notes to this episode. Thanks to today's episode's sponsor Vanta do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and they help you get security questionnaires done five times faster with AI. Now that's a new way to GRC. You can get started at vanta.com headlines that is V A N T A Deepseek's app transmits sensitive user and device data without encryption A new report from mobile security company Now Secure reveals that Deepsea's mobile app for the Apple iOS operating system contains some serious security issues, including the fact that it sends sensitive data over the Internet without encryption, as well as collecting extensive user and device data. The report said that when data is encrypted, the app uses an insecure symmetric encryption algorithm, a hard coded encryption key, and reuses initialization vectors. Furthermore, the report says the data is sent to servers that are managed by a cloud compute and storage platform named Volcano Engine, which is owned by ByteDance, the Chinese company that also operates TikTok. End Quote UK releases hurricane grade scale for cyberattacks this is a product of a group named the Cyber Monitoring center, which is made up of cyber insurance industry figures and some cybersecurity thought leaders. This rating system parallels that of the Safir Simpson Scale, which identifies the severity of hurricanes. It is intended to help cyber insurance companies and their reinsurers independently define what constitutes a systemic event, which is one that emanates from a single source, such as an attack on a vendor, but has a significant impact on myriad other organizations. Examples of this include NotPetya and the CrowdStrike event. As an independent non profit organization, the CMC will categorize cyber events on a one through five scale, with five being the most severe, based on data around the financial impact of the event and the number of UK organizations affected. Hackers allegedly publish secret Taliban records the Taliban government of Afghanistan is none too happy these days at the fact that hackers successfully carried out a massive cyber attack against its computer systems and published over 50 gigabytes of stolen documents and files online. End quote. The group named TabbyLeaks, that's T A B I, has posted links to its collection on social media. These links point to 21 Taliban ministries and government agencies and include information about prisoners, travel restrictions and many other types of activities and restrictions. For its part, the Taliban's Ministry of Communications says that most of the files had already been publicly accessible for years and that no system has been hacked. Zyxel will not patch newly exploited flaws in end of life Routers According to security company Vulnchek, the Taiwan based Zyxel has issued a security advisory about actively exploited flaws in its Customer Premises Equipment series devices such as modems and routers, warning that it has no plans to issue fixing patches and urges users to move to actively supported models. According to Network Scanning Engines, FOFA and census, over 1500 Zyxel CPE series devices are exposed to the Internet, so the attack surface is is significant. We are taking the week off from our Super Cyber Friday show, but that doesn't mean that you don't get to close out your week with the CISO series. Make sure that you are subscribed to the CISO Series YouTube channel to catch our Week in Review live stream running down the biggest stories of the week with a CISO guest. When you join us live, you can get in on our lively chat room and help shape the conversations on the show. It all starts at 3:30pm Eastern each and every Friday. I'm Steve Prentiss reporting for the CISO Series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.