Podcast Summary: Cybersecurity Today Episode: DeepSeek Security Concerns: Cyber Security Today for Friday, February 7, 2025
Host: Jim Love
Release Date: February 7, 2025

Introduction

In this episode of Cybersecurity Today, host Jim Love delves into the latest developments in cybersecurity, focusing on emerging threats, sophisticated attack methodologies, and the ongoing efforts to bolster organizational defenses. The episode covers a range of topics, including Canada’s Cyber Ready Validation program, novel techniques for bypassing Endpoint Detection and Response (EDR) systems, advanced SSH backdoors used by cyber espionage groups, sophisticated zero-click attacks on WhatsApp, and concerns surrounding the Chinese open-source AI platform DeepSeek.

Canada’s Cyber Ready Validation Program

The episode begins with an update on Canada’s Digital Governance Council launching the Cyber Ready Validation program, aimed at enhancing cybersecurity practices among small and medium-sized enterprises (SMEs).

[00:01] Unknown Speaker: “Canada's Digital Governance Council has launched a Cyber Ready Validation program to help build trust in cybersecurity practices. It's designed to help small and medium sized organizations strengthen their cybersecurity posture...”

Jim highlights the significance of this initiative in providing SMEs with comprehensive, independent reviews of their cybersecurity strategies, thereby ensuring they meet baseline security requirements and instilling confidence among stakeholders and the public.

Evasion of Endpoint Detection and Response (EDR) Systems

Jim transitions to discuss a new cyber attack method that allows attackers to bypass EDR systems without needing elevated privileges.

[02:30] Jim Love: “A recent cyber attack method enables attackers to bypass endpoint detection and response or EDR systems while operating under low privilege standard user accounts...”

Key Points:

• Masquerading and Path Obfuscation: Attackers disguise malicious payloads as legitimate processes by manipulating file paths and using techniques like double file extensions and Unicode character manipulation.
• Example: Creating a folder named C Program Files using Unicode characters resembling ASCII, then placing a malicious executable (superjuicy.exe) within this spoofed directory, making it appear as a legitimate process (C Program Files\Windows Defender\superjuicy.exe).
• Challenges for Analysts: Such techniques can deceive both automated systems and human analysts, increasing the likelihood of false positives or overlooked threats.

Jim emphasizes the importance for organizations to ensure their EDR solutions are equipped to handle alternate character sets and to maintain vigilance in monitoring for such sophisticated evasion tactics.

Evasive Panda’s SSH Backdoor Operations

The discussion shifts to a Chinese cyber espionage group, known as Evasive Panda or Daggerfly, which has been deploying a novel SSH backdoor since November 2024.

[05:10] Jim Love: “A Chinese cyber espionage group identified as Evasive Panda, also known as Daggerfly, has been employing a novel SSH backdoor to compromise network appliances since mid November 2024...”

Key Points:

• Attack Mechanism: Injecting malware into the SSH daemon to enable persistent and covert access.
• Dropper Component: Verifies infection status and installs malicious binaries, including libssth.s, the primary backdoor library.
• Capabilities: Allows interception and manipulation of SSH sessions, execution of arbitrary commands, data exfiltration, and maintaining undetected access.
• Obfuscation Techniques: Employs various methods to evade detection and hinder analysis.

Jim advises organizations to keep all software and firmware updated with the latest security patches, limit root-level access, implement the principle of least privilege, and closely monitor SSHD and related processes for suspicious activities.

Sophisticated Zero-Click Attacks on WhatsApp

Next, Jim addresses a significant security concern involving WhatsApp, where a zero-click hacking technique has been discovered.

[08:45] Jim Love: “WhatsApp has alerted users to a sophisticated zero click hacking technique that compromises devices without any user interaction...”

Key Points:

• Nature of the Attack: Bypasses traditional phishing by infiltrating smartphones silently, without requiring user interaction.
• Targeted Individuals: Approximately 90 individuals, including journalists and human rights activists, have been compromised.
• Spyware Capabilities: Access to personal data, messages, and activation of the device’s camera and microphone without detection.
• Previous Incidents: Similar attacks used spyware from Paragon Solutions delivered via malicious PDF files, highlighting WhatsApp as a prime target.

Jim underscores the necessity for users to keep WhatsApp updated to the latest version and remain vigilant for any unusual activity on their devices. In response, WhatsApp is enhancing its security measures and collaborating with cybersecurity experts to prevent future vulnerabilities.

DeepSeek and Concerns Over Chinese Open-Source AI

The episode concludes with a discussion about DeepSeek, a Chinese open-source AI platform, and the security concerns surrounding it.

[15:25] Jim Love: “...the web login page of Deepseek's chatbot contains heavily obfuscated computer script that when deciphered, shows connections to computer infrastructures owned by China Mobile...”

Key Points:

• Obfuscated Scripts: DeepSeek’s login page contains scripts linked to China Mobile, a state-owned telecommunications company banned from the US.
• Allegations vs. Evidence: No concrete evidence has been found that information is transmitted to China Mobile, suggesting possible false flags or code reuse without malicious intent.
• Security Debate: Jim advocates for nuanced discussions, emphasizing that the presence of certain code signatures doesn’t inherently imply maliciousness.
• User Caution: Advises against inputting sensitive corporate or personal information into new or unverified platforms, regardless of their geographic origin.
• Industry Response: Perplexity is using a hosted version in the US, and Microsoft is integrating DeepSeek into its Copilot service, indicating mainstream adoption despite concerns.
• Future Discussions: Jim announces upcoming sessions featuring experts to foster informed and balanced debates on AI and open-source security risks.

[20:50] Jim Love: “Security discussions are nuanced... Our workforce needs to be educated in AI and we have to teach them how to do that safely...”

Jim expresses his commitment to facilitating informed discussions and encourages listener engagement to navigate the complex landscape of AI and cybersecurity.

Conclusion

Jim Love wraps up the episode by reiterating the importance of staying informed and proactive in the face of evolving cybersecurity threats. He invites listeners to contribute to future discussions, aiming to equip the workforce with the necessary knowledge and tools to address challenges posed by AI and other emerging technologies.

[22:15] Jim Love: “I proudly have 40 years of IT experience and I'll try to ask the right questions, but I'm not a God, so your input is welcome...”

Listeners are encouraged to reach out via email, LinkedIn, or YouTube comments to participate in shaping the conversation around critical cybersecurity topics.

Notable Quotes:

• Cyber Ready Validation Program:

  • Unknown Speaker [00:01]: “Canada's Digital Governance Council has launched a Cyber Ready Validation program to help build trust in cybersecurity practices...”

• EDR Evasion Technique:

  • Jim Love [02:30]: “This new EDR evasion technique is just another example of how cyber attackers are continually adapting to attack our cybersecurity defenses.”

• DeepSeek Security Discussions:

  • Jim Love [15:25]: “Security discussions are nuanced...”
  • Jim Love [20:50]: “Our workforce needs to be educated in AI and we have to teach them how to do that safely...”

Key Takeaways

1. Empowering SMEs: Initiatives like Canada’s Cyber Ready Validation program are crucial in enhancing the cybersecurity posture of small and medium-sized businesses.
2. Sophisticated Attack Techniques: Cyber attackers continuously evolve their methods, such as leveraging low-privilege accounts and obfuscated paths to evade detection systems.
3. Persistent Threats from State-Sponsored Groups: Groups like Evasive Panda employ advanced backdoor techniques to maintain unauthorized access to networked systems.
4. Zero-Click Exploits Representing New Challenges: The emergence of zero-click attacks on widely used applications like WhatsApp underscores the need for robust security measures and user vigilance.
5. Nuanced Approach to AI Security: Discussions around AI platforms, especially those with ties to state actors, require a balanced and evidence-based approach to assess potential risks accurately.

End of Summary