Cyber Security Headlines – Episode Summary

Podcast: CISO Series – Cyber Security Headlines
Episode: Sturnus captures encrypted chats, PowerSchool schools blamed, SEC security bill
Date: November 21, 2025
Host: Steve Prentiss
Guest Segment: Rich Stroffolino (Breaking News)

Episode Overview

This episode dives into some of the most pressing cybersecurity stories as of November 21, 2025. The main themes include a powerful new Android Trojan threatening financial institutions, regulatory findings in the PowerSchool school data breach, a legislative push to bolster security at the SEC, critical vulnerabilities in widely-used routers, and breaking news on the SolarWinds hack SEC case.

Key Discussion Points and Insights

1. Android Trojan ‘Sturnus’ Bypasses Encryption and Hijacks Devices

• [00:06–01:30]
• Trojan Details:
  • Researchers from Threat Fabric have identified a new Android malware named "Sturnus".
  • Bypasses encryption by capturing decrypted message content directly from device screens.
• Messaging Apps at Risk:
  • Targets popular encrypted apps such as WhatsApp, Telegram, and Signal.
• Attack Techniques:
  • Main method includes overlay attacks—superimposing fake login screens over banking apps to steal credentials.
  • Enables full device takeover for fraud, with a primary focus on banking apps in southern and central Europe.
• Memorable Moment:
  • "It is capable of bypassing encrypted messaging by capturing content directly from the device screen after decryption." — Steve Prentiss [00:21]

2. Canadian Regulators Fault Schools for PowerSchool Data Breach

• [01:31–02:16]
• Findings:
  • Ontario and Alberta’s Privacy Commissioners say schools failed to require privacy/security safeguards in contracts and didn’t monitor PowerSchool’s cybersecurity measures.
  • Inadequate multi-factor authentication and a lack of ready breach response plans were highlighted.
• Quotable:
  • "Schools also did not have appropriate breach response plans ready to go, the report said." — Steve Prentiss [02:03]
• Incident Context:
  • The breach impacted schools and students across the US and Canada; a Massachusetts college student responsible has already been convicted and sentenced.

3. Bipartisan Bill to Enhance SEC Cybersecurity Introduced

• [02:17–03:16]
• Legislation Details:
  • Representatives David Scott (D) and Barry Loudermilk (R) introduce the SEC Data Protection Act of 2025.
  • Aims to standardize how the SEC handles sensitive investor data.
  • Seeks alignment with federal and NIST cybersecurity protocols.
• Quotable:
  • "...develop and update data protection cybersecurity protocols consistent with federal and NIST standards and best practices." — Steve Prentiss quoting bill language [03:00]

4. CISA Mandates Rapid Patch for New Fortinet Flaw

• [03:17–03:56]
• Urgency:
  • US government agencies given seven days to patch a critical FortiWeb firewall vulnerability (zero-day).
  • The flaw enables authenticated attackers to execute code as root via low-complexity attacks.
• Action Deadline:
  • Federal Civilian Executive Branch agencies have until Tuesday, November 25, to comply.

5. German Security Agency Warns on LLM Evasion Attacks

• [04:30–05:15]
• Risk:
  • Bundesamt für Sicherheit in der Informationstechnik (BSI) warns of evasion techniques (e.g., prompt injection) threatening AI/LLM (large language model) security.
• Guidance:
  • BSI releases a document recommending technical controls like filters, sandboxing, retrieval augmented generation, and organizational practices (adversarial testing, governance, training).
• Quote:
  • "The Office emphasizes that no single control is sufficient." — Steve Prentiss [05:08]

6. Critical Flaws in Asus DSL Routers Fixed

• [05:16–05:46]
• Vulnerability:
  • A critical authentication bypass (CVSS 9.3) in certain Asus DSL routers could allow remote, unauthenticated access.
• Recommendation:
  • Update firmware and use strong, unique passwords immediately.

7. Massive Malicious Traffic Targeting Palo Alto Networks

• [05:47–06:25]
• Incident:
  • GlobalProtect portals see a 40x spike in traffic over 24 hours (as of November 14), mainly from Germany and Canada.
• Insight:
  • Activity spikes like this often precede vulnerability disclosures—80% lead to public CVEs within six weeks, according to Greynoise.

8. D-Link DIR878 Routers: Unpatched RCE Vulnerabilities

• [06:26–06:57]
• Issue:
  • Three command execution bugs affect all models/hardware of D-Link DIR878 routers, now unsupported (EOL since 2021).
• Advice:
  • No more security updates—users should urgently replace with supported hardware.

9. Breaking News: SEC Drops Charges from 2020 SolarWinds Hack

• [07:01–07:56] Breakdown by guest Rich Stroffolino
• Background:
  • The 2020 SolarWinds Orion supply-chain hack led to high-profile SEC charges against the company and its CISO, Tim Brown, for alleged fraud and control failures.
• Case Update:
  • Most charges dismissed in 2024; as of this episode, the SEC has dropped the case entirely.
• Industry Impact:
  • SolarWinds’ statement: hopes the dismissal "eases the concerns many CISOs have voiced about this case and the potential chilling effect it threatened to impose on their work." — Rich Stroffolino [07:47]

Notable Quotes

• On screen-capturing malware:
  • "It is capable of bypassing encrypted messaging by capturing content directly from the device screen after decryption." — Steve Prentiss [00:21]
• School breach responsibility:
  • "Schools also did not have appropriate breach response plans ready to go, the report said." — Steve Prentiss [02:03]
• On SEC cybersecurity bill:
  • "...develop and update data protection cybersecurity protocols consistent with federal and NIST standards and best practices." — Steve Prentiss [03:00]
• On AI security:
  • "The Office emphasizes that no single control is sufficient." — Steve Prentiss [05:08]
• On SEC dropping SolarWinds case:
  • "Solarwind said it hoped the dismissal eases the concerns many CISOs have voiced about this case and the potential chilling effect it threatened to impose on their work." — Rich Stroffolino [07:47]

Timestamps for Important Segments

• Trojan captures encrypted chats: 00:06 – 01:30
• PowerSchool breach blame: 01:31 – 02:16
• SEC cybersecurity bill introduced: 02:17 – 03:16
• CISA mandates patch for Fortinet flaw: 03:17 – 03:56
• German warning on LLM/AI attacks: 04:30 – 05:15
• Asus DSL router flaw fixed: 05:16 – 05:46
• Mystery traffic targets Palo Alto: 05:47 – 06:25
• Unpatched D-Link router RCEs: 06:26 – 06:57
• Breaking: SEC drops SolarWinds case: 07:01 – 07:56

Episode Tone and Language

The episode maintains a professional, urgent, and occasionally cautionary tone, reflecting the critical nature of cybersecurity news. Steve Prentiss delivers headline summaries in a clear and concise manner, occasionally quoting direct regulatory findings or legislation. Rich Stroffolino provides a succinct breaking news segment with an emphasis on industry impact.