A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST open claw AI agents hijacked through malicious web pages CISA faces a leadership shakeup at a pivotal moment. A coordinated cyber campaign unfolds alongside the US Israeli with Iran, North Korea finds a way to breach even air gapped networks and it turns out robot vacuum security sucks. This is Cybersecurity Today. I'm your host Jim Love. Let's get started. Our first story today highlights a significant vulnerability in OpenClaw's AI agent framework that could have allowed attackers to take full control of local AI agents. Dubbed Claw Jacked by researchers at Oasis Security, this high severity flaw exploited a lack of rate limiting in Open Claw's gateway, enabling an attacker to brute force passwords and gain administrative access. Here's how the attack worked. By using malicious JavaScript embedded in a website, an attacker could open a websocket connection to an Open Claw gateway running locally on a developer's machine. With no rate limiting in place, the attacker could brute force the gateway password, register as a trusted device, and then gain control of the AI agent. This could allow them to access sensitive data, modify configurations, and even manipulate connected systems. The good News is that OpenClaw issued a patch for this flaw within 24 hours of its discovery in late February. If your organization uses OpenClaw, it's critical to update to version February 2, 2026.2.25 immediately and take additional precautions like auditing access permissions and implementing governance controls for non human identities. But remember, friends don't let friends run Open Claw on enterprise systems with any kind of privileged access to anything that matters. Our second story today covers a significant leadership change at the cybersecurity and Infrastructure Security Agency cisa. Madhu Gatumakala, who has been serving as acting director, is stepping down from the role following criticisms of sisa's performance during his tenure and after several reported controversies, the leadership change comes just days after reports highlighted dissatisfaction with SISA's performance during the first year of the Trump administration. While some praised Ghatamakalla's technical acumen and efforts to streamline the agency's operations, his leadership faced backlash from both sides of the aisle. Issues of duplication within the agency were raised, but many believe the administration's cuts to SISA went too far, hampering its effectiveness at a time when Cyber threats continue to escalate Politico reported that at the end of January that Gautamakala uploaded sensitive contracting documents into a public version of ChatGPT last summer, triggering multiple automated security warnings, according to four Department of Homeland Security officials with knowledge of the incident. The apparent misstep from Gautamakala was especially noteworthy because he had requested special permission from SISA's Office of the Chief Information Officer to use the popular AI tool soon after arriving at the agency this May, three of the officials told Politico the app was blocked for other DHS employees at the time, according to four officials, who spoke on the condition of anonymity due to concerns about potential repercussions. None of the files that garamukala shared with ChatGPT were classified. However, the documents did include CISA contracting materials labeled for official use only, a government designation for sensitive information that is not intended for public disclosure. Politico also reported that he canceled agency contracts for tools without considering the importance of the tools or giving agency officials time to put in place workarounds, including canceling a $30 million license for software that agency staff uses to identify vulnerable Internet facing devices. These moves political reports, angered both career staff as well as Trump administration appointees. Gautamakala's boss, Homeland Security Secretary Kristi Noem, is expecting to face a grilling in Washington on Tuesday from both Democrats and Republicans about sisa's turbulent year. The change also comes during the U s Israeli war on Iran and Operation Epic Fury, which has killed senior Iran government officials. As of Sunday afternoon, most of the cybersecurity activity was happening within Iran, but Iranian officials are vowing revenge for the attacks and with little ability to attack the US Directly, cyber attacks on US Critical infrastructure are a key concern. Replacing Gautamakhala as acting director is Nick Anderson, CISA's current executive director for cybersecurity, who has received strong support from industry and government stakeholders. Anderson, who has over two decades of experience in IT and cybersecurity roles, including with the U.S. coast Guard, Navy and Department of Energy, will now steer the agency as it navigates a challenging landscape. Meanwhile, Gautamakala will remain within the Department of Homeland Security, transitioning to the role of director of strategic implementation. Our next story takes us to the Middle east and into what might be a defining moment in modern cyber warfare. As US And Israeli forces launched Roar of the lion against targets inside Iran, a parallel cyber campaign reportedly ripped through Iranian government networks, communication systems and elements of critical infrastructure. Internet connectivity across the country dropped to a fraction of normal levels. State media sites were defaced, government platforms were disrupted. Even widely used applications were hijacked to push anti regime messaging. This wasn't random hacking. It was a synchronized digital disruption layered on top of kinetic force command and control interference, psychological operations and infrastructure degradation happening in parallel. And here's why that matters for the United States and Israel. Iran can hit back. Not hypothetically, not rhetorically. We've already seen Iranian IRGC affiliated actors compromise U.S. water and wastewater facilities by exploiting Internet exposed industrial control systems, default passwords, publicly reachable programmable logic controls and and in multiple documented cases, operators had to move to manual control to maintain safe operations. Water utilities. Not military installations, not defense contractors when geopolitical tensions escalate, cyber retaliation isn't symmetrical. It doesn't mirror the battlefield. It looks for exposed operational technology. It looks for small and medium sized utilities with thin budgets. It looks for aging systems reachable from the public. Internet threat intelligence firms are already reporting reconnaissance and denial of service activity from Iranian aligned actors. History shows that ransomware hack and leak operations and industrial control system probing are well within their capabilities. And cyber retaliation doesn't follow the news cycle. It can be patient. It can take months to stage access, escalate privileges, and wait for the moment of maximum impact. If you've just kicked a cyber hornet's nest, you don't relax when the missiles stop flying. Cyber warfare doesn't end when the shooting stops. It lingers. It probes. It waits. And it strikes when we're least prepared. North Korea's APT 37, also known as Scarcroft, has deployed a new malware toolkit called Ruby Jumper, designed specifically to breach air gapped networks. The campaign begins with a malicious shortcut file that executes PowerShell scripts and deploys tools. From there, it weaponizes USB drives to bridge the physical gap between isolated systems and connected environments, effectively turning removable media into a covert command and control relay. Air gapped networks have long been considered the gold standard of isolation. Ruby Jumper shows that even physical separation can be subverted through clever operational design. If your organization relies on air gapped systems, now is the time to revisit removable media policies, endpoint monitoring, USB restrictions, and of course, employee awareness training. As you know, isolation is not immunity. And as tensions globally continue to escalate, the best time to think beyond air gapping was Saturday. The second best time today. Our final story today is one part cautionary tale and one part a reminder of why cybersecurity needs to be baked into everything. Even your robot vacuum meet Sammy Asdufal, a curious tinkerer who just wanted to control his new DJI Romo robot vacuum with his PS5 game controller. Sounds like a fun Saturday afternoon, doesn't it? Well, in his quest for some high tech fun, Sammy accidentally uncovered a massive security flaw. His homemade app didn't just connect the vacuum, it connected to 7,000 other vacuums across 24 countries. 7,000 robot vacuums started treating him like their new overlord. Sammy could watch their live camera feeds, track their movements in real time, and even generate floor plans of their owners homes. And it wasn't just their movements he could see. Every three seconds. These vacuums sent detailed data packets to DJI's servers, including their serial numbers, obstacles encountered, and even where they were in the world. Thanks to Asdufl's accidental discovery, DJI has since patched the vulnerability. But here's the kicker. This wasn't some obscure, hard to find backdoor. The flaw was a result of DJI's insecure implementation of MQTT, a messaging protocol. It allowed Asdufal to interact with any romovacuum connected to the Internet, no questions asked. DJI claims the issue is fixed, but this incident raises serious questions about IoT security. If a single individual with a PS5 controller and a knack for coding could accidentally gain control of thousands of devices, what happens when a malicious actor with more sinister intentions comes along? We're talking about devices with cameras, microphones, and access to detailed maps of people's homes. The lesson here is simple. Don't assume any device in your home is secure by default. Change default passwords, monitor what's connected to your home networks, and keep firmware up to date and manufacturers. It's time to stop treating IoT security like an afterthought. If your device has an Internet connection, it must have robust security. So the next time your vacuum cleaner starts cleaning a little too enthusiastically, you might want to check who's really driving it. Because as we've learned today, even your robot vacuum could be reporting back to an unexpected master. And we both know that sucks. That's Cybersecurity today for Monday, March 2, 2026. Thanks for listening. Thanks for your continued support. We've seen a big jump in the number of ratings folks are leaving for the show. Thank you. Please keep liking subscribing and leaving these ratings and reviews. We want to continue to reach even more people and we continue to to need your help. We'd also like to thank Meter for their support in bringing you this podcast. Meter delivers a full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments, and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses to data centers. Book a demo@meter.com CST I'm your host, Jim Love. Thanks for listening.