Transcript
Steve Prentiss (0:00)
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, March 10, 2025. I'm Steve Prentiss, ONCD set to consolidate power in US cyber the Office of the National Cyber Director is poised to gain strength and will operate as the Executive Branch for Cybersecurity. Sean Cairncross was selected by the President to lead the office. While he has no experience as a cybersecurity leader, it is believed his close personal ties to the President are a significant asset for the office, which until now has been overshadowed by the National Security Council. The position to be held by Kern Grass was previously held by Harry Coker. The ONCD is being described as the pinnacle guiding the nsc, which does foreign policy and offensive cyber, and cisa, which takes care of doing domestic and defensive Undocumented commands found in Bluetooth chip used by a Billion devices as described in Bleeping computer the ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023, contains undocumented commands that could be leveraged for attacks. The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network and potentially establishing long term persistence. Researchers from the Spanish company Tarlogic security, speaking at RootedCon in Madrid, point out that ESP32 is one of the world's most widely used chips for WI fi and Bluetooth connectivity in IoT devices, so the risk is significant. End quote. Japanese Telecom NTT breach affects 18,000 companies a warning from one of Japan's largest telecoms providers. A breach discovered last month has likely compromised the data of approximately 18,000 corporate customers. The hackers breached NTT's order information distribution system, which contains basic details on corporate customers such as contract numbers, phone physical address and service usage. This did not contain data on individual consumers, nor did it have contracts for corporate smartphones and mobile phones provided directly by ntt. Docomo Signal President Meredith Whitaker calls out Agentic AI on security and privacy Speaking at the south by Southwest conference in Austin, Texas. Whitaker, well known as an advocate for secure communications, described the use of AI agents as putting your brain in a jar and warned that this techni, which AI apps perform tasks on the user's behalf, has a profound issue with both privacy and security, referring to getting AI to deliver such conveniences like looking up concerts, booking tickets and scheduling the event on a calendar. This, she says, becomes a form of root permission that allows the bots to review things like credit card activity and other data. She pointed out that such muddying of the waters is a direct result and intention of the AI industry built on a surveillance model with mass data collection as its objective. Thanks to today's episode's sponsor, Vanta. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get started at vanta.com headlines that is V A N T A Texas Border City Declares State of Emergency after cyber Attack the city of Mission, Texas, which sits on the border with Mexico, filed a state of emergency declaration this past week after a cyberattack forced the shutdown of much of its network. The mayor, Nori Gonzalez Garza, urged Texas governor Greg Abbott on Tuesday to declare a more expansive state of emergency for the city while she filed a local state of disp disaster declaration herself. She described the situation to Governor Abbott as a cybersecurity incident such that the entire city computer server is at a severe risk of a cyber attack that could release protected personal information, protected health information, civil and criminal records, and or any and all other data held by the City of Mission and all departments within the city. End quote. Malicious use of cobalt strike down 80%, says Fortra. A global crackdown has reduced the use of unauthorized copies of cobalt strike by 80% in the past two years, according to the security firm Fortra. Originally developed for penetration testing, older versions of Cobalt Strike have been widely exploited by cybercriminals, as we all know. Since 2023, Microsoft Health ISAC, that is the Health Information Sharing and Analysis center, and Fortra, have worked to disrupt illegal copies used in cyber attacks. A 2023 US court order enabled them to dismantle malicious infrastructure by collaborating with ISPs and CERTs to take down command and control servers. This effort has significantly hindered attackers who rely on Cobalt Strike for spear phishing and network infiltration. UK Banks ordered to compensate customers for outages Nine major UK banks and building societies, which is the UK version of a credit union, were found to have accumulated the equivalent of 30 days of tech outages in the past two years, according to figures published by a parliamentary treasury group, and they must now deliver compensation payments amounting to 12.5 million pounds. This data does not include the Barclays bank outage in January or the Lloyds bank outage of last week. The committee's chair, Dame Meg Hillier, sympathised with working people and companies for whom losing access to banking services on payday can be a terrifying experience. But Patrick burgess of the UK's Chartered Institute for it says the findings once again highlight that the traditional banking sector hasn't kept pace with the investment needed to modernize its infrastructure. Fired developer sabotages company with Killswitch A former senior software developer is now facing up to 10 years in prison for leaving a Killswitch behind following his demotion and termination. Davis Lu, 55, of Houston, Texas, had been a coder for power management company Eaton Corporation between November 2007 and October 2019, following a corporate restructuring in which his position, responsibilities and access were reduced. Lou wrote a Java code that would release an infinite loop, creating more and more non terminating threads that would consume more and more resources until the computer running the code crashed and prevented people from logging in and using the machine. On the day he was let go, the application noticed the revocation of his credentials and launched itself, locking thousands of employees around the world out of the network and causing hundreds of thousands of dollars in damage. If you've been listening to cybersecurity headlines for more than a minute, you know the barrier to entry for cybercrime is getting lower every day. That's why we think this week's Super Cyber Friday conversation is happening just in time. It's all about hacking, the commodification of cybercrime, and how your security program needs to adapt to this reality. It starts at 1pm Eastern this Friday. If you want to join us, head on over to our events page@cisoseries.com to register. I'm Steve Prentiss, reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.