Sophisticated voice phishing, Opengrep consortium, DeepSeek suspends registrations - Cybersecurity Headlines

Summary9 min read

Cyber Security Headlines: January 28, 2025
Hosted by CISO Series

Introduction

In the latest episode of Cyber Security Headlines by CISO Series, host Rich Stroffel delves into a spectrum of pressing information security issues shaping the landscape in early 2025. From sophisticated phishing schemes to significant data breaches and regulatory changes, this episode provides a comprehensive overview of the current cybersecurity climate. Below is a detailed summary capturing the key discussions, insights, and conclusions presented.

1. Sophisticated Voice Phishing Attack

One of the standout stories discussed is the emergence of a highly sophisticated voice phishing (vishing) attack targeting Google Workspace users. Rich Stroffel highlights the incident involving Zak Lada, the founder of Hack Club, who became the target of what he described as "the most sophisticated phishing attack I've ever seen" (00:07).

Key Details:

Attack Methodology: The attackers impersonated the Google Workspace team, initiating a call about a "suspicious login attempt overseas." The call utilized a genuine Google Assistant number with a caller ID displaying as Google, adding a layer of legitimacy.
Bypassing Verification: Despite the suspicious nature of the call, Lada queried the attackers by requesting an authenticated email to confirm their identity. He received an email from workspace-noreplygle.com, a cleverly crafted domain that mimicked legitimate Google addresses.
Exploitation of Subdomains: The attackers exploited a workspace.GCo subdomain to create an account, enabling them to send a password reset link to Lada, effectively bypassing standard identity verification protocols.

Notable Quote: Zak Lada remarked, “This attack method gets around two fundamental best practices for identity verification,” underscoring the sophistication and effectiveness of the attack (00:07).

Google's Response: Google acknowledged the incident, stating, "We found no widespread use of this tactic but have hardened defenses against abusers, leveraging GCo references at signup going forward." This indicates proactive measures to prevent similar attacks in the future.

2. OpenGrep Consortium Formation

The episode also covers significant developments in static application security testing (SAST) tools, specifically the creation of OpenGrep by a consortium of leading security firms.

Background: Semgrep, launched in 2017, gained popularity for allowing users to create and share custom security rules. However, a licensing change in December 2024 restricted the use of community-contributed rules in its free service, prompting a collaborative response from the cybersecurity community.

Consortium Action: A group of ten prominent security firms, including Endor Labs, JIT Mob, Orca Security, and Amplify Security, spearheaded the launch of OpenGrep—a fork of Semgrep designed to maintain the open, community-driven ethos that Semgrep originally championed.

Key Highlights:

Development and Support: The consortium commits to providing dedicated development, testing, and deployment teams to ensure the robustness and reliability of OpenGrep.
Community Engagement: Regular reviews of community-contributed code will be conducted to maintain high security standards and foster collaborative innovation.
Future Plans: The long-term strategy involves transitioning OpenGrep to a foundation operating under a non-profit model, ensuring sustainability and broad accessibility.

Notable Quote: A representative from the consortium stated, “Our goal is to preserve the open-source spirit that made Semgrep so successful, while enhancing its capabilities through collective expertise” (00:07).

3. DeepSeek Suspends New User Registrations

DeepSeek, an AI startup known for its open-source large language models (LLMs), has recently faced challenges that led to the suspension of new user registrations.

Incident Overview:

Rapid Rise: DeepSeek gained significant attention for its claims of developing an open-source LLM using minimal hardware resources compared to its competitors, leading to its app topping the US iOS App Store.
Malicious Activities: The surge in popularity attracted malicious actors, resulting in large-scale attacks that compromised the platform's integrity.

Company Response: DeepSeek updated its status page announcing a temporary suspension of new registrations to mitigate the impact of these attacks. While specific details were not disclosed, the company assured that existing users remained unaffected.

Implications: This incident underscores the dual-edged nature of rapid technological adoption, where innovation can attract both positive engagement and malicious interference. DeepSeek's proactive stance aims to safeguard its user base while addressing the security vulnerabilities exploited by attackers.

4. Brazil Bans Compensation for Biometric Data Scheme

Regulatory developments in Brazil have significant implications for digital identity projects, particularly those involving biometric data.

Project Background: Tools for Humanity, the company behind the World digital identity project (formerly Worldcoin), relaunched in Brazil in November 2024. The project involves collecting biometric data, such as iris scans, in exchange for financial compensation, including cryptocurrency.

Regulatory Action: The National Data Protection Authority (ANPD) of Brazil has ruled that offering financial compensation for biometric data violates privacy regulations. The agency concluded that such practices may "interfere with the free expression of the will of individuals," effectively banning the exchange of compensation for biometric information.

Company's Standpoint: In response, Tools for Humanity contended that their use of iris scans serves as proof of personhood and that they do not store personal data, including biometrics. They expressed confidence in collaborating with regulators to adapt their services and comply with Brazilian laws.

Notable Quote: A spokesperson from Tools for Humanity stated, “Our iris scans qualify as proof of personhood, and we do not store any personal data, including biometrics,” emphasizing their commitment to privacy and regulatory compliance (00:07).

5. Microsoft Teams to Roll Out Phishing Alerts

Microsoft is enhancing its security features within Teams to combat phishing threats, reflecting the growing need for robust protection in collaboration tools.

Feature Introduction: Starting mid-February, Microsoft 365 admins will witness the rollout of brand impersonation protection features within Teams Chat. These features are enabled by default and aim to detect and alert users about potential phishing attacks originating from external teams.

Functionality:

Alerts Display: Users will see alerts for messages flagged as high risk, allowing them to preview and decide whether to accept or block the content.
Admin Tools: These alerts will also be accessible in Teams logs, providing administrators with insights and the ability to review flagged communications.

Best Practices Recommendation: Microsoft advises Teams administrators who do not engage in regular external tenant communications to disable external access or implement allow lists for specific domains, thereby minimizing exposure to potential phishing attempts.

Notable Quote: A Microsoft representative articulated, “These alerts empower users to make informed decisions about the legitimacy of external communications, enhancing overall security posture” (00:07).

6. Ukraine Denies Involvement in Cyber Attack

Geopolitical tensions continue to influence cyber activities, as evidenced by recent allegations and denials surrounding cyber attacks.

Allegation: Slovak Prime Minister Robert Fico accused Ukraine of orchestrating a massive cyberattack targeting General Health Insurance, Slovakia's largest insurance provider. The stated objective was espionage, though Fico noted the attack was unsuccessful.

Denial: Ukraine's Foreign Ministry officially denied any involvement in the alleged cyberattack, challenging the credibility of the accusations.

Context: This incident occurs against a backdrop of deteriorating relations between Slovakia and Ukraine, particularly following Ukraine's suspension of Russian gas transit through Slovakia and meetings between Fico and Russian President Vladimir Putin.

Local Media Perspective: Local outlets have interpreted the incident as a phishing attack, suggesting that the complexity of attributing cyberattacks in geopolitical conflicts remains a significant challenge.

7. Talk Talk Confirms Data Breach

Data breaches continue to pose significant risks to organizations and their customers, as demonstrated by the recent incident involving UK telecommunications company Talk Talk.

Breach Details: Talk Talk confirmed a data breach resulting from a third-party platform compromise. The breach exposed data of approximately 18.8 million customers, including names, phone numbers, and IP addresses. This disclosure followed actions by threat actor Bond, who attempted to sell the data on a hacking forum.

Company's Clarification: Talk Talk asserted that the figure of 18.8 million was substantially inflated, stating that the actual number of affected customers was around 2.4 million. Additionally, the company did not confirm whether the breached data originated from CSG's Ascendant platform, despite forum screenshots suggesting so.

Impact and Response: The discrepancy in the reported data size highlights the complexities in accurately assessing and communicating the scope of data breaches. Talk Talk’s prompt confirmation aims to maintain transparency while addressing customer concerns.

8. Salting Techniques Disrupt Brand Detection Systems

In the ongoing battle between cybersecurity defenses and threat actors, new tactics such as salting are emerging to evade detection systems.

Cisco Talos Report: Cisco Talos published a report detailing how threat actors manipulate email content to bypass security measures. Techniques include:

Concealing Malware: Embedding irrelevant comments within base64-encoded strings in email attachments to evade typical scanning methods.
Invisible Language Use: Hiding email content by mixing languages or embedding hidden words, such as disguising English emails as French by incorporating invisible French text.
Suspicious HTML Structures: Employing complex HTML with suspicious CSS properties or inline styles to mask malicious content.

Recommendations: The report advises the implementation of advanced filtering techniques that analyze the HTML structure of emails, looking for anomalies or hidden elements that standard security protocols might overlook.

Notable Quote: A Cisco Talos analyst noted, “Attackers are increasingly sophisticated in their methods to bypass traditional email security measures, necessitating more advanced and nuanced detection strategies” (00:07).

9. Cloned Leak Hits Git Platforms

A concerning discovery by security researcher Ryota K reveals vulnerabilities across Git-based platforms, potentially exposing stored credentials.

Attack Details: Ryota K identified three related vulnerabilities that could allow attackers to extract credentials stored within Git repositories:

Git Credential Manager Flaw: Misinterpretation of carriage return characters enables malicious URLs to redirect credentials to unauthorized servers.
Git LFS Security Bypass: Utilization of newline characters in configuration files allows attackers to circumvent security checks.
GitHub CLI Vulnerability: Overly permissive sharing of authentication tokens to different hosts exposes credentials to potential misuse.

Current Status: As of now, there are no indications of active exploitation of these vulnerabilities. All three issues have been promptly patched, mitigating the immediate risks.

Implications: This incident underscores the critical importance of securing development platforms and the need for ongoing vigilance to identify and remediate vulnerabilities that could compromise sensitive information.

10. Building and Measuring Security Culture

Transitioning from specific incidents to broader organizational practices, the episode touches upon the challenge of cultivating and assessing a robust security culture within organizations.

Discussion Highlights:

Cultural Metrics: Unlike the more quantifiable aspects of cybersecurity, such as metrics-driven performance indicators, security culture encompasses intangible elements like employee attitudes, behaviors, and awareness.
Evaluation Challenges: Measuring the effectiveness of a security culture is inherently difficult due to its qualitative nature. Organizations must develop innovative approaches to gauge and improve their cultural resilience against cyber threats.

Upcoming Content: Rich Stroffel hints at an upcoming podcast episode focused on evaluating and quantifying security culture, emphasizing its foundational role in organizational resilience. He teases, “How do you evaluate the cultural aspects of your security program? That’s one of the topics we’ll be digging into in our latest episode.”

Conclusion

The January 28, 2025 episode of Cyber Security Headlines presents a multifaceted overview of the current cybersecurity environment, highlighting sophisticated attack methods, collaborative defensive initiatives, regulatory changes, and the ongoing significance of building a resilient security culture. Hosts and contributors provide valuable insights into both the threats and the strategies being employed to mitigate them, offering listeners a well-rounded understanding of the challenges and advancements in the field of information security.

For those seeking to delve deeper into any of these topics, additional resources and detailed stories are available at CISOseries.com.

Transcript Reference: All timestamps and quotes are sourced from the episode's transcript.

Loading summary

Transcript3 lines

[00:00]
A
From the CISO series. It's Cybersecurity Headlines.
[00:07]
B
These are the cybersecurity headlines for Tuesday, January 28, 2025. I'm Rich Stroffelino Google Responds to most sophisticated voice phishing Attack Last week, Hack club founder Zak Lada published details about the most sophisticated phishing attack I've ever seen. This saw attackers posing as the Google Workspace team in a call to Lada claiming to investigate a suspect suspicious login attempt overseas. The call came from a genuine number associated with Google Assistant with a caller ID of Google. Still suspicious, Lada asked for an authenticated email to confirm identity and received one from workspace-noreplygle.com the attackers appeared to get access to a workspace G Co subdomain, which was used to create an account for Lada to send the password reset. Lada said this attack method gets around two fundamental best practices for identity verification. Google said it found no widespread use of this tactic, but hardened its defenses against abusers, leveraging G Co references at signup going forward Security Consortium creates Open Grep the static application security testing tool. Semgrep launched in 2017, becoming popular partly because users could write custom rules that could be shared with the broader community. However, in December 2024, the company changed its licensing to restrict the use of community contributed rules in its Free engine service. Now, a consortium of 10 security firms including Endor Labs, JIT Mob, Orca Security and Amplify Security, launched a fork of semgrep, creatively named opengrep. The consortium says it will provide dedicated development, testing and deployment teams for the new project, and regularly reviews community contributed code. The plan is to eventually move Open GREP to a foundation on a non profit model for long term viability. Deepseek suspends new user registrations the AI startup Deepseek has been making headlines in the last few days on claims of an open source LLM created using a fraction of the hardware resources that competitors use. This attention led to the app topping the US iOS app store, but it also seems to have attracted malicious activity. Deepseek updated its status page to say it's temporarily limited registrations due to large scale malicious attacks. Although it offered no other specifics, the company said the attacks did not impact existing users. Brazil bans compensation for biometric data scheme Tools for Humanity is the company behind the digital identity project. World, formerly known as worldcoin World, relaunched in Brazil in November, sparking an investigation from the country's National Data Protection Authority. That agency has now ruled that World cannot offer financial compensation, including cryptocurrency in exchange for biometric data, saying that this may interfere with free expression of the will of individuals. In response to that decision, Tools for Humanity said that iris scans used by the organization qualify as proof of personhood and that the company doesn't store any personal data, including biometrics. The company said it's confident it can work with the regulator to ensure it can offer world services in Brazil and now, thanks to our sponsor for today, Conveyor does trying to get the security questionnaire done and back to your customer ever feel like you're herding cats? It's not answering questions. Most of you have automation software for that. It's all of the manual back and forth that becomes a slog, like communicating between teams, tracking people down to get the review, updating sources and updating systems. Conveyor just launched an AI agent, Sue, to do all of these things for you and more. Learn about sue@conveyor.com that's C-O-N V E-Y-O-R.com Teams to roll out phishing alerts Microsoft reminded Microsoft 365 admins that it will launch new brand impersonation protection features in Teams Chat as of mid February. This will be enabled by default. This feature will display alerts for suspected phishing attacks for organizations with external teams. Access enabled users must preview messages flagged as high risk and select whether to accept or block them. These alerts will also be available in Teams logs for admin review. Microsoft still recommends that Teams admins that don't need regular external tenant communication to disable external access or add specific domains to an allow list. Ukraine Denies involvement in cyber Attack Late last week, Slovak Prime Minister Robert Fico alleged that Ukraine was involved in a massive cyberattack on General Health Insurance company, The largest insurance provider in Slovakia. FICO said the attack's goal was espionage and was ultimately unsuccessful. Ukraine's Foreign Ministry flatly rejected any hints that it participated in the attack. Local media reported this as a fishing attack. This comes against a background of shifting relations between the two countries, with Ukraine recently suspending the transit of Russian gas through Slovakia and FICO meeting with Russian President Vladimir Putin. Talk Talk Confirms Breach Breach the UK Telco confirmed it suffered a data breach involving a third party platform. This comes after a threat actor known as Bond attempted to sell data on 18.8 million talk talk customers on a hacking forum. This data allegedly included names, phone numbers and IP addresses. Toktoc has only roughly 2.4 million customers and the number cited in the sales post was wholly inaccurate and very significantly overstated, according to the company. Screenshots from the forum post indicate the Data came from CSG's Ascendant platform, but Talk Talk did not confirm this. Salting disrupts brand detection systems Cisco Talos released a report showing the tactics threat actors use to get around email security measures. One observed method included concealing malware in email attachments by embedding irrelevant comments in base 64 strings to get around typical attachment scanning. The report recommends using advanced filtering for analyzing HTML structure to look for things like suspicious CSS properties or inline styles. The report also highlighted how attackers can hide email content with irrelevant or invisible language such as English emails disguised as French by embedding hidden French words. Cloned Leak Hits Git GMO Flat Security researcher Ryota K published details about three related attacks allow an attacker to get Git leak stored credentials One flaw in the Git Credential Manager misinterprets carriage return characters, allowing for malicious URLs to send credentials to a third party server a flaw in Git LFS allows bypassing security checks when using new line characters in a config file and a flaw in GitHub CLI allowed for over permissive sharing of authentication tokens to a different host. There's no signs of active exploitation and the three vulnerabilities have have since been patched. While building a security culture is a bedrock for overall resilience, identifying it and quantifying it are quite difficult. It's quite unlike the more metrics driven side of cybersecurity. How do you evaluate the cultural aspects of your security program? That's one of the topics we'll be digging into in our latest episode of the CISO Series podcast. Look for the episode as long as we keep moving the goalposts, we have a great security culture wherever you get your podcasts. Reporting for the CISO series, I'm Rich Stroffolino reminding you to have a super sparkly day.
[08:07]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.