Snyk's mysterious package, Baltic cable suspicions, second BeyondTrust vulnerability

Summary

Cyber Security Headlines – January 15, 2025

In this episode of Cyber Security Headlines from the CISO Series, host Steve Prentiss delves into three major topics shaping the cybersecurity landscape: the enigmatic deployment of Snyk’s packages, suspicions surrounding Baltic Sea cable cuts, and a new vulnerability discovered in BeyondTrust’s solutions. This detailed summary captures the key discussions, insights, and conclusions drawn during the episode.

Snyk’s Mysterious Package Deployment

The episode opens with a discussion about suspicious activities involving Snyk, a renowned security company. A researcher from SourceCodered.com uncovered what appeared to be malicious packages targeting Cursor, an AI code editor company.

Researcher [00:18]: "The packages were uploaded to the open-source JavaScript package library npm, and their metadata indicated that they were authored by an individual using a SNYK.IO email address."

Steve Prentiss clarifies the involvement of SNYK.IO, raising questions about the legitimacy of these actions.

Steve Prentiss [00:43]: "That is SNYK.IO."

Analysts weighed in on possible explanations for the incident. The Register noted that NPM has a history of unpredictable behavior, especially when detecting packages with identical names in both public and private repositories. This unpredictability could have inadvertently led to the deployment of these suspicious packages.

Analyst [00:52]: "NPM has a reputation for behaving in unpredictable ways when it detects public and private packages with the same name."

Alternatively, some experts suggested that Snyk might have been conducting controlled testing to identify and report bugs to Cursor, rather than engaging in malicious activities.

Analyst [01:01]: "Snyk may have just been trying to test and later report a bug to Cursor."

While conspiracy theories began to surface, the incident highlights the complexities and potential vulnerabilities within open-source package repositories.

Baltic Sea Cable Cuts Raise Security Concerns

The conversation shifts to geopolitical tensions impacting cybersecurity, focusing on recent incidents involving undersea data and power cables in the Baltic Sea region. EU tech chief Henna Verkunin expressed skepticism about the accidental nature of these disruptions.

Steve Prentiss [01:07]: "Baltic Sea cable cuts can't be an accident, says EU tech chief Henna Verkunin."

Verkunin emphasized the frequency of such incidents, suggesting that they likely result from deliberate actions by hostile entities. This sentiment is echoed by Lithuanian President Gaetanus Nauzeda, who asserted a high probability of these events being intentional.

Researcher [01:39]: "There is a very high probability that those are deliberate actions of hostile countries."

The episode recounts previous reports, including the recovery of the tanker Eagle S by Finnish authorities. This vessel, along with others, is suspected to be part of a Russian shadow fleet transporting petroleum products despite international sanctions.

Analyst [01:55]: "This ship and others are believed to be part of a Russian shadow fleet that transports Russian petroleum products despite sanctions and other restrictions."

As the Baltic region prepares for a NATO summit dedicated to these issues, the episode underscores the escalating tensions and the need for heightened cybersecurity measures to protect critical infrastructure.

CISA Alerts on Second BeyondTrust Vulnerability

Another significant topic covered is the Cybersecurity and Infrastructure Security Agency’s (CISA) warning regarding a new vulnerability in BeyondTrust’s privileged remote access and support solutions. This marks the second major flaw identified in these systems, raising alarms about potential exploitation.

Analyst [02:08]: "CISA is now urging federal agencies to patch a second vulnerability in BeyondTrust privileged remote access and remote support enterprise solutions based on evidence of active exploitation."

The newly discovered vulnerability, assigned a CVE number, is characterized as a medium-severity command injection issue. It emerged during the investigation of the U.S. Department of Treasury incident reported on December 31, which was attributed to Chinese hacker group Silk Typhoon.

Analyst [02:11]: "This new flaw can be exploited by an attacker with existing administrative privileges to upload a malicious file."

Steve Prentiss highlights the urgency by noting that this vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies a deadline of February 3rd to implement the necessary patches.

Steve Prentiss [02:47]: "It has now been added to CISA's KEV catalog, giving federal agencies until February 3rd to patch it."

This development underscores the persistent threats posed by sophisticated cyber adversaries and the critical need for organizations to maintain robust patching protocols.

UK Considers Ransomware Payment Ban for Public Sector

The podcast also explores the United Kingdom’s legislative efforts to combat ransomware attacks targeting public sector institutions. The UK government has launched an online survey as part of a Home Office consultation, running from January 14th to April 8th, to gather input on a proposed payment ban.

Analyst [03:30]: "The proposed payment ban is intended to protect hospitals, schools, railways, and other essential public services from the growing ransomware threat by making these critical services unattractive targets for ransomware."

This initiative aims to deter cybercriminals by making it financially unviable to target essential public services. Additionally, the proposal includes guidance for ransomware victims on appropriate response strategies and measures to block payments to known criminal organizations and sanctioned entities.

Researcher [03:35]: "The proposal would also offer guidance to ransomware victims on how to respond, and would also help block payments to known criminal groups and sanctioned entities."

The UK’s efforts follow the October 2024 Counter Ransomware Initiative, which advocates for alternative options to paying ransoms and seeks to disrupt the financial incentives behind ransomware operations.

Russia’s Largest Procurement Platform Hit by Cyber Attack

Turning to international cyber conflicts, the episode reports on a significant attack against Russia’s largest procurement platform, Rozaltorg. This electronic trading operator is pivotal for the Russian government’s public procurement processes.

Analyst [04:19]: "Rozaltorg, one of the largest electronic trading operators used by the Russian government to conduct public procurement for some of its largest companies, announced via Telegram that it had been targeted last Thursday by an extreme attempt to destroy data and the entire infrastructure of electronic trading."

The attack was carried out by the pro-Ukraine hacker group Yellow Drift, which claimed responsibility by stating that they had deleted 550 terabytes of data, including crucial emails and backups.

Steve Prentiss [04:40]: "A pro-Ukraine hacker group named Yellow Drift has claimed responsibility for the attack, stating that they had deleted 550 terabytes of data, including emails and backups."

This assault not only disrupts Russia’s procurement operations but also exemplifies the escalating cyber warfare tactics employed by state-sponsored and politically motivated hacker groups.

Biden’s Second Cybersecurity Executive Order

The discussion then shifts to the United States, where a draft of President Biden’s second cybersecurity executive order has been obtained by CyberScoop. This comprehensive document aims to strengthen the nation’s cybersecurity posture across various domains.

Analyst [04:55]: "The document ranges from cyber defenses in space to the US Federal bureaucracy to its contractors and addresses security risks embedded in subjects like cybercrime, artificial intelligence, and quantum computers."

The executive order builds upon the initial cybersecurity framework established in Biden’s first year in office, introducing 53 new measures with deadlines spanning from 30 days to three years. These measures encompass enhancing cyber defenses, securing federal agencies and their contractors, and addressing emerging threats in AI and quantum computing.

Steve Prentiss [05:20]: "It ranges from cyber defenses in space to the US Federal bureaucracy to its contractors and addresses security risks embedded in subjects like cybercrime, artificial intelligence, and quantum computers."

This proactive approach underscores the administration’s commitment to safeguarding national security and critical infrastructure against evolving cyber threats.

Microsoft’s Patch Tuesday Addresses Multiple Vulnerabilities

Concluding the episode, the focus turns to Microsoft’s recent Patch Tuesday release, which addressed a significant number of security vulnerabilities. The update included patches for 159 flaws, eight of which were zero-day vulnerabilities, with three actively exploited threats.

Analyst [05:29]: "Yesterday was Patch Tuesday, and this one saw security updates for 159 flaws, including eight zero-day vulnerabilities, three actively exploited."

Among the critical fixes were twelve vulnerabilities encompassing information disclosure, privilege elevation, and remote code execution. Notably, the actively exploited zero-day vulnerabilities are linked to a Windows Hyper-V NT kernel integration, posing severe risks if left unpatched.

Analyst [06:08]: "The actively exploited zero-day vulnerability in yesterday's updates are sequential and all related to a Windows Hyper-V NT kernel integration VSP elevation of privilege vulnerability."

Additionally, the update addressed publicly disclosed zero-day issues, including a Windows themes spoofing vulnerability and a Microsoft Access remote code execution flaw, highlighting the broad spectrum of threats Microsoft is addressing to protect its user base.

Analyst [06:15]: "These include a Windows themes spoofing vulnerability and a Microsoft Access remote code execution vulnerability."

Other major companies such as Adobe, Cisco, and Ivanti also released critical updates during the same period, emphasizing the ongoing need for organizations to stay vigilant and apply security patches promptly.

Conclusion

This episode of Cyber Security Headlines from the CISO Series provides a comprehensive overview of pressing cybersecurity issues, from suspicious software deployments and geopolitical cyber tensions to critical vulnerabilities and legislative measures aimed at combating ransomware. By highlighting these key developments, host Steve Prentiss ensures that listeners are well-informed about the evolving cyber threat landscape and the strategic responses necessary to mitigate these risks.

For those interested in exploring these topics further, detailed stories and analyses are available at CISOseries.com.

Transcript

[CISO Series Host]

From the CISO series, it's Cybersecurity Headlines.

[Steve Prentiss]

These are the cybersecurity headlines for Wednesday, January 15, 2025. I'm Steve Prentiss Sneak mysteriously deploys apparently.

[Researcher]

Malicious packages the security company is facing.

[Analyst]

Some damage control after a [e-mail] discovered what seemed to be malicious packages that appeared to be targeting Cursor, an AI COD editor company.

[Researcher]

The packages were uploaded to the open.

[Analyst]

Source JavaScript package library npm, and their metadata indicated that they were authored by an individual using a SNYK IO email address.

[Steve Prentiss]

That is SNYK IO.

[Researcher]

Although conspiracy theories are already circulating, the Register points out that NPM has a.

[Analyst]

Reputation for behaving in unpredictable ways when.

[Researcher]

It detects public and private packages with the same name, while others pointed out that Sneak may have just been trying.

[Analyst]

To test and later report a bug to Cursor. Baltic Sea cable cuts can't be an.

[Steve Prentiss]

Accident, says EU tech chief Henna Verkunin.

[Analyst]

The European Union's new digital chief with the title of the European Commission's executive vice president for technological sovereignty, security and democracy, has told Bloomberg News that incidents resulting in damage to undersea data and power cables are happening too frequently to.

[Steve Prentiss]

Be purely accidental as leaders from the.

[Analyst]

Baltic region prepare to gather for a.

[Researcher]

NATO summit devoted to the topic. He echoes the sentiments of Lithuanian President Gaetanus Nauzeda, who said there is a.

[Analyst]

Very high probability that those are deliberate actions of hostile countries.

[Researcher]

Last week on Cybersecurity Headlines, we reported.

[Analyst]

On the tanker Eagle S, whose anchor has now been recovered from the seabed by Finnish authorities.

[Researcher]

This ship and others are believed to.

[Analyst]

Be part of a Russian shadow fleet that transports Russian petroleum products despite sanctions and other restrictions. CISA warns of second Beyond Trust vulnerability.

[Researcher]

CISA is now urging federal agencies to.

[Analyst]

Patch a second vulnerability in Beyond Trust privileged remote access and remote support enterprise solutions based on evidence of active exploitation. This new flaw, which has a CVE number already, is described as a medium severity command injection issue that was discovered during the investigation into the US Department of Treasury incident disclosed on December 31 and which was attributed to Chinese hackers Silk Typhoon. This second flaw can be exploited by.

[Researcher]

An attacker with existing administrative privileges to.

[Analyst]

Upload a malicious file.

[Steve Prentiss]

It has now been added to CISA's.

[Researcher]

Kev catalog, giving federal agencies until February.

[Steve Prentiss]

3Rd to patch it, thanks to today's episode's sponsor. DropZone AI does your sock feel like.

[Researcher]

It'S drowning in alerts?

[Steve Prentiss]

Dropzone AI cuts through the noise, triaging.

[Analyst]

100% of alerts and giving you clear, actionable insights ready to break free. Check out the demo at dropzone AI that is Drop Z O N E.

[Steve Prentiss]

AI.

[Analyst]

UK Mulling over public Sector ransomware.

[Steve Prentiss]

Payment ban this proposed payment ban is.

[Analyst]

Part of a home office consultation, essentially an online survey launched yesterday January January.

[Steve Prentiss]

14 and running until April 8.

[Researcher]

The proposed ban is intended to protect.

[Analyst]

Hospitals, schools, railways and other essential public services from the growing ransomware threat by making these critical services unattractive targets for ransomware. The proposal would also offer guidance to ransomware victims on how to respond, and would also help block payments to known criminal groups and sanctioned entities. The proposals follow guidance issued by the Counter Ransomware Initiative in October 2024, which encourages organizations consider other options before making ransomware payments to cybercriminals Russia's largest procurement.

[Steve Prentiss]

Platform hit by cyber attack Rozaltorg, one.

[Analyst]

Of the largest electronic trading operators used by the Russian government to conduct public procurement for some of its largest companies, announced via Telegram that it had been.

[Steve Prentiss]

Targeted last Thursday by an extreme attempt to destroy data and the entire infrastructure of electronic trading. A pro Ukraine hacker group named Yellow.

[Analyst]

Drift has claimed responsibility for the attack, stating that they had deleted 550 terabytes.

[Steve Prentiss]

Of data, including emails and backups.

[Analyst]

Draft of second cybersecurity executive order on.

[Steve Prentiss]

President Biden's desk According to CyberScoop, who.

[Analyst]

Obtained a copy of the draft executive order, it ranges from cyber defenses in space to the US Federal bureaucracy to its contractors and address addresses security risks embedded in subjects like cybercrime, artificial intelligence and quantum computers. The document is a follow up to one published in the first year of the Biden presidency and gives agencies 53.

[Steve Prentiss]

Deadlines stretching from 30 days to three years.

[Analyst]

Microsoft's Patch Tuesday fixes eight zero days.

[Steve Prentiss]

And 159 flaws yesterday was Patch Tuesday.

[Analyst]

And this one saw security updates for 159 flaws, including eight zero day vulnerabilities, three actively exploited. Also fixed are 12 critical vulnerabilities including information disclosure, privilege elevation and remote code execution flaws. The actively exploited zero day vulnerability in yesterday's updates are sequential and all related to a Windows Hyper V NT kernel integration VSP elevation of privilege vulnerability. Among the publicly disclosed zero days are a Windows themes spoofing vulnerability and a.

[Steve Prentiss]

Microsoft Access remote code execution vulnerability.

[Analyst]

Other companies, of course, also released updates in this same period.

[Steve Prentiss]

These include Adobe, Cisco, Ivanti and many others.

[Analyst]

A link to a summary from Bleeping.

[Steve Prentiss]

Computer is available in the show Notes to this episode. We would love to get feedback about.

[Analyst]

Cybersecurity headlines and we hope that you will reach out to the CISO series on CISO series on LinkedIn or on YouTube to let us know how we are doing.

[Steve Prentiss]

You can also shoot us an [e-mail] and we really would appreciate your feedback and recommendations. I'm Steve Prentiss reporting for the CISO series.

[CISO Series Host]

Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.