← Cybersecurity Headlines
Loading summary
Transcript1 lines
- [00:00]
Sean Kelly
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, November 11, 2024. I'm Sean Kelly. U.S. financial regulator calls for reduced cell phone use at work A US Regulator, the Consumer Financial Protection Bureau, or cfpb, has issued a directive to employees to reduce the use of their phones at work due to the growing threat of China linked APT Group SALT Typhoon. The threat actor is alleged to have recently breached several major telecom providers. Instead, CFPB is asking its workforce to use Microsoft Teams and Cisco WebEx for meetings and conversations involving non public data. The CFPB clarified that the directive is a risk mitigation measure and that there is no evidence that the agency has been impacted by the Telcom incidents. The CFPB was created in 2011 to protect consumers in the financial sector, ensuring fair, transparent and competitive financial markets. FBI warns of spike in hacked police emails and fake subpoenas the FBI is urging police departments and governments worldwide to bolster email safeguards, citing a recent rash of hacked police email accounts to send unauthorized subpoenas and customer data requests to US Based technology companies. Authorities make these requests, known as emergency Data requests or EDRs, to obtain an array of user account information such as email addresses and what sites users have visited. EDRs largely bypass any official review and do not require the requester to supply any court approved documents. The FBI says it's seen an uptick of government and law enforcement credentials as well as EDR request process info emerging on cybercrime forums. One cybercriminal who uses the nicknames Pwnestar and Ponipotent is selling fake EDR scam packages for between 1,000 and $3,000 per successful request. The hacker is even offering a full refund if the EDR requests are unsuccessful. A startup called Codex is trying to tackle the fake EDR problem by working with data providers to pool information about EDR submitters to make it easier to spot an unauthorized edr. Codex founder and former FBI agent Matt Donahue said far too many police departments in the US and other countries often do not enforce basic account security precautions such as requiring phishing resistant multi factor authentication. Cyber scoundrels target UK senior citizens with winter fuel payment texts as the winter season kicks in, scammers are targeting senior British residents with bogus winter heating allowance and cost of living support scam texts. The scheme attempts to capitalize on the UK government's recent controversial stance on cutting winter fuel payments for approximately 10 million pensioners across Britain. The dubious texts prompt victims to visit illicit domains that collect personal and payment information. Researchers have identified 597 domains related to this campaign so far. UK citizens should refrain from clicking such links and forward suspected scam texts to 7726. Phishing emails can be forwarded to reportishing.gov.uk New iPhone reboot feature may make it harder for police to unlock them On Thursday, reports surfaced that law enforcement officials were warning one another that iPhones being stored for forensic examination seemed to be rebooting themselves. These reports were subsequently corroborated by security experts. The reboots appear to take place on iPhones running iOS 18.1 after their fourth day in a locked state. After the reboot, it's harder for phones to be unlocked using password cracking tools. Some security experts are hailing the new feature as a huge security improvement, while authorities may find it to be a hindrance to their investigations and now we'd like to thank Today's episode's sponsor ThreatLocker do zero day exploits and supply chain attacks keep you up at night? Worry no more. You can harden your security with threat locker. ThreatLocker helps you take a proactive default deny approach to cybersecurity and provide a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that's T H R E A T L O c k e r.com malicious PyPi package steals AWS keys According to the application security firm Socket, a malicious Python package named Fabrice, spelled F A B R I C E, has been present in the Python package index since 2021 and steals Amazon Web Services credentials from unsuspecting developers. The package has been downloaded more than 37,000 times and executes platform specific scripts on both Windows and Linux. The large number of downloads is likely due to the package using typo squatting to mimic the legitimate S Remote Server Management package fabric, which has more than 200 million downloads. Typosquatting risks can be mitigated through performing both manual and automated checks of PYPI downloads and by limiting permissions to download resources through AWS identity and access management. Recent Windows 11 updates break SSH connections Microsoft has confirmed that last month's Windows security updates are breaking SSH connections on some Windows 11, 2022 H2 and 23 H2 systems. The services are failing with no detailed logging and require manual intervention to run the SSHD EXE process. Microsoft said just a limited number of devices are impacted, but they are still Investigating whether Windows 11 Home or Pro editions are affected until a fix is available. Microsoft has provided customers a temporary fix that updates Access Control list permissions on affected directories. Google says Chrome Enhanced Protection feature now uses AI Google has quietly updated the description for its enhanced protection mode in Chrome's Safe Browsing feature to include AI powered protection, previously referred to as proactive protection. The AI powered protection could allow Google to detect and warn users about potentially harmful sites, even those that Google hasn't previously identified. With enhanced protection turned on, Chrome performs deeper scans on downloads and improves protection across Google's services when users are signed in. Google is currently retesting the AI feature in Chrome Canary with no known timeline for rollout to all Chrome users. Mazda Connect flaw allows some Mazda vehicles to be hacked Trend Micro's Zero Day initiative warned of multiple vulnerabilities in the Mazda Connect infotainment system that could allow attackers to execute code with root privileges. This occurs due to improper input sanitization in the Mazda Connect cmu. The researchers clarified that a threat actor would need to be physically present to connect a specially crafted USB device, such as an ipod or mass storage device to the target system. The vulnerabilities impact systems installed in multiple car models, including the Mazda 3 model year 2014 through 2021. These issues currently remain unpatched and there are no publicly known vulnerabilities in the latest firmware version. And that does it for today's cybersecurity headlines. But if you enjoy listening to our daily news show, you might also enjoy the CISO Series YouTube channel. You can watch our Week in Review video, live stream demo video, original content and clips from our other shows like Defense in Depth. Just head over to YouTube and search for the CISO series. Thank you for listening to the podcast that brings you more of the top cyber news stories and more cowbell. I'm Sean Kelly. Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.