Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:07)
These are the cybersecurity headlines for Thursday, December 5, 2024. I'm Steve Prentice. FBI and CISA urge Americans to use encrypted apps rather than calling Further developments from the SALT typhoon attack on U.S. telecommunications companies. Officials from both agencies, the FBI and CISA are recommending that Americans start using encrypted messaging. Speaking to the media on Tuesday, Jeff Green, executive assistant director for cybersecurity at cisa, along with a senior FBI official who asked not to be named, said they plan to use the same message as they use inside their respective organizations, which is encryption is your friend, whether it's on messaging or encrypted voice communications. They also suggest people consider using a cell phone that automatically receives timely operating system updates, responsibly managed encryption and phishing resistant multi factor authentication for email, social media and collaboration tools accounts Iverify Scanner finds seven Pegasus spyware infections A report published by the mobile device security firm Iverify puts into question the idea that commercial spyware is used to target a small number of people. It says that out of 2,500 devices offered by customers to be inspected, seven devices contained the Pegasus malware manufactured by the NSO Group. Rocky Cole, chief operating officer of Iverify and a former U.S. national Security Agency analyst, stated that the owners of these targeted devices were not journalists and activists, but business leaders, people running commercial enterprises, people in government positions. Wired magazine, which ran the story, points out that although 7 out of 2500 is a small percentage quote, the fact that the tool has already found a handful of infections at all speaks to how widely the use of spyware has proliferated around the world. Japan warns of IO data Zero Day router flaws exploited in attacks Japan's Computer Emergency Response Team, AKA cert CERT is warning of zero day vulnerabilities in the I O data router devices. These can be exploited to modify device settings, execute commands, or even turn off the firewall. The vendor has acknowledged the flaws in a security bulletin published on its website, but the fixes are only expected to land on December 18, which means users will be exposed to risks until then unless mitigations are enabled. The three flaws, which were identified on November 13 and which all have CVE numbers, relate to information disclosure, remote arbitrary os, command execution, and the ability to disable firewalls. Huge thanks to our sponsor Vanta. As third party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews with VANTA Questionnaire Automation the security and compliance teams can complete security reviews up to five times faster, giving you time back to focus on running your security and compliance programs. Over 8,000 global companies like ZoomInfo, smart recruiters and NOIBU use Vanta to save time on security reviews. Visit vanta.com to learn more about questionnaire automation, I.e. vanta.com UK law enforcement uncovers major Russian ransomware Related money laundering operation On Wednesday, British law enforcement announced the discovery of a large Russian money laundering system used by transnational drug traffickers, cybercriminals, Moscow elites evading sanctions, and even the Kremlin's espionage operations. The discovery follows an investigation into how a ransomware gang was cashing out extorted cryptocurrency. More than 80 people have been arrested thus far in this operation, which is named Operation Destabilize and which has exposed billion dollar money laundering networks operating in a way previously unknown to international law enforcement. The head of this particular snake belongs to two Russian businesses, one called SMART and the other TGR Group, both based in Moscow's Federation Tower. They are accused of providing critical liquidity and logistics services, allowing criminals to collect funds in one country and make the equivalent value available in another. Still lots of Security Risks in Open Source ecosystem A new report from the Linux Foundation, OpenSSF and Harvard University has found that significant security risks continue to be prevalent in open source software practices. The Census 3 project made more than 12 million observations of free and open source software libraries used in production apps at over 10,000 companies. The issues included ongoing reliance on Python 2 language, a lack of standardized naming for software components, the fact that security is dependent on a handful of accounts, and that individual developer accounts tend to have fewer protections associated with them than organizational accounts. Backdoored Solana library downloaded by Developers Solana Web3js is a popular JavaScript library used to build decentralized applications for Node Web and React Native. On Tuesday, two malicious versions of the library were discovered as available for download. The Backdoored iterations, version 1.9, 5.6 and 1.95.7, contained code that allowed the attackers to steal private key material and drain funds from decentralized applications. They remained available for about five hours through the official repository. Developers who downloaded either of these versions are advised to update to Solana's Web3JS version 1.95.8 and rotate any suspect keys and account credentials. Microsoft stands firm on TPM requirements for Windows 11 Microsoft is pushing hard on its upgraded security culture by dashing the hopes some may have about lower hardware requirements for Windows 11. The Windows 10 end of support is approaching in October 2025, and Microsoft says that its Trusted Platform Module TPM 2.0 requirement for Windows 11 is non negotiable. This PM2.0 is a hardware level chip or firmware capability that helps encrypt or decrypt data, confirm digital signatures, and assist with any other cryptographic operations. Why have we conflated vulnerability discovery with vulnerability management? There are lots of tools that classify what's out there, but they don't help you take the next step. We'll be trying to disentangle these two on our latest episode of Defense in Depth. It just dropped this morning, so look, vulnerability management does not equal vulnerability discovery. Wherever you get your your podcasts, I'm Steve Prentice reporting for the CSO series.