Cyber Security Headlines - April 11, 2025

Host: Steve Prentiss
Podcast: CISO Series
Title: Cyber Security Headlines
Description: Daily stories from the world of information security. To delve into any daily story, head to CISOseries.com.

1. President Orders Probe of Former CISA Director Chris Krebs

Timestamp: [00:00]

In a significant move, President Donald Trump signed an executive order aimed at revoking the security clearance of Chris Krebs, the former Director of the Cybersecurity and Infrastructure Security Agency (CISA). Krebs was dismissed in 2020 after publicly stating that there were no technological issues affecting the integrity of the presidential election.

Key Points:

• The executive order mandates all agencies to revoke Krebs' security clearance.
• It also targets individuals associated with Krebs, including personnel from SentinelOne, where Krebs holds the position of Chief Intelligence and Public Policy Officer.
• The directive awaits a review to determine if maintaining Krebs' security clearances aligns with national interests.

Quote: Steve Prentiss highlighted the severity of the order: "The executive order not only directs agencies to revoke Krebs' security clearance but also to suspend those held by individuals at entities associated with Krebs" (00:00).

2. Nissan Leaf Vulnerable to Remote Hacking

Timestamp: [00:58]

Researchers at PC Automotive uncovered vulnerabilities in the second-generation Nissan Leaf (manufactured in 2020) that could allow hackers to remotely spy on and take physical control of the vehicle. Presented at Black Hat Asia 2025, the team demonstrated how exploiting the car's Bluetooth capabilities could grant access to the vehicle's internals.

Key Points:

• Access through the infotainment system's Bluetooth allows escalation of privileges.
• Hackers can establish a command and control channel via cellular communications.
• Potential capabilities include controlling the steering while the car is in motion.

Implications: This development underscores the increasing risks associated with connected vehicles and the need for robust security measures in the automotive industry.

3. Infosec Experts Warn of China's Potential Cyber Retaliation Against Tariffs

Timestamp: [02:10]

Following the White House's imposition of tariffs on China, cybersecurity advisor Tom Kellerman issued a stern warning regarding possible cyber retaliation from China. Speaking to The Register, Kellerman emphasized China's growing foothold within critical infrastructure, which could be exploited for destructive cyber attacks.

Key Points:

• China may utilize systemic cyber attacks as a modern instrument of power in trade wars.
• Kellerman stated, "Trade wars were a historical instrument of soft power. Cyber is and will be the modern instrument of choice" (03:45).

Additional Insights: Annie Fixler from the Center on Cyber and Technology Innovation noted that any hesitation by China to engage in cyber attacks might diminish, increasing the threat landscape.

4. Germany Attributes Cyberattack on Research Group to Russian Hackers

Timestamp: [04:30]

German authorities have linked a recent cyberattack on the Berlin-based German Association for Eastern European Studies (DGO) to a Russian state-backed hacking group, likely APT 29, also known as Cozy Bear. This incident marks the second such breach targeting the organization within a few months.

Key Points:

• The March attack was highly sophisticated, bypassing enhanced cybersecurity measures implemented after an October breach.
• The attacks specifically targeted the DGO's email systems.
• Authorities suspect Russian involvement based on the nature and targets of the breaches.

Quote: Describing the attack, Steve Prentiss reported, "This second attack, which happened in March, as highly professional and which targeted email systems, bypassing enhanced cybersecurity measures put in place after a previous breach in October with suspected Russian links" (04:30).

5. Sensata Suffers Ransomware Attack Impacting Operations

Timestamp: [06:05]

Sensata, a sensor and electrical component manufacturer based in Attleborough, Massachusetts, disclosed a ransomware attack detected on April 6. The breach led to the encryption of files on certain devices and the theft of data from their systems.

Key Points:

• The attack has disrupted various operations, including shipping, receiving, manufacturing, and production.
• Sensata has notified the Security and Exchange Commission and is investigating the full extent of the data stolen.
• With operations spanning 14 countries and over 18,000 employees, the impact on Sensata's global operations remains under assessment.

6. Akira Bot Campaign Utilizes OpenAI to Bypass CAPTCHA

Timestamp: [07:45]

Researchers at SentinelOne have identified a new AI-powered bot, named Akira Bot, which employs OpenAI technologies to generate spam that can bypass traditional CAPTCHA systems. This bot targets website chats, comment sections, and contact forms to promote dubious SEO services.

Key Points:

• Akira Bot crafts tailored outreach messages based on the website's purpose.
• Its ability to generate coherent and contextually relevant content allows it to evade spam filters effectively.
• The campaign primarily promotes services like Akira and Service Wrap Go.

7. Senator Wyden Blocks Trump's CISA Nominee Over Missing Telecoms Report

Timestamp: [09:20]

Oregon Senator Ron Wyden has formally blocked the nomination of Sean Planky to lead CISA. Wyden cited the agency's failure to release an unclassified 2022 report that details security issues within U.S. telecommunications companies.

Key Points:

• Wyden criticized the action as a "multi-year cover up of the phone company's negligent CyberSecurity" (11:10).
• He disputes CISA's claim of withholding the report due to deliberative process privilege, asserting that the report is a technical document containing factual information about U.S. telecom security.

Implications: This move increases pressure on CISA to enhance transparency and address security vulnerabilities within the telecommunications sector.

8. Cyber Experts Scrutinize Voluntary Pall Mall Code for Commercial Hacking Tools

Timestamp: [12:50]

The Pall Mall process, a collaborative initiative led by France and the UK, recently introduced a voluntary code of conduct signed by 21 countries. This code aims to guide the responsible use of commercial hacking tools, particularly in combating spyware and other intrusive cyber activities.

Key Points:

• While the guidelines represent modest progress, experts advocate for establishing complementary guidance for the private sector.
• The initiative seeks to foster responsible partnerships between governments and industry, ensuring cyber tools are not misused against dissidents or journalists.
• Participants include former exploit brokers and vendors like NSO Group, indicating broad industry engagement.

Perspective: Cybersecurity professionals view the Pall Mall code as a foundational step toward more comprehensive governance of cyber intrusion capabilities.

Upcoming Events

Live Streams:

• Super Cyber Friday: Focus on hacking social engineering, emphasizing the financial risks of inadequate controls.
  Time: 1:00 PM
• Week in Review: Featuring Carla Sweeney, SVP InfoSec at Red Ventures, providing expert commentary.
  Time: 3:30 PM Eastern
  Access: Visit the Events Page on CISO Series’ website.

Conclusion

The April 11, 2025 episode of Cyber Security Headlines delves into a range of critical topics, from high-profile government actions and state-sponsored cyber threats to vulnerabilities in consumer vehicles and innovative cyberattack methodologies. Host Steve Prentiss provides a comprehensive overview, enriched with expert insights and timely updates, ensuring listeners are well-informed about the evolving landscape of information security.

For more detailed stories behind these headlines, visit CISOseries.com.