← Cybersecurity Today
Cybersecurity Today
Exposing Cybersecurity Threats: Breaches, Vulnerabilities, and Evolving Malware
00:14:28
In this episode of 'Cybersecurity Today,' host Jim Love discusses several alarming cybersecurity developments. A recent Washington Post breach raises critical questions about Microsoft 365’s enterprise security as foreign government hackers...
Loading summary
Transcript1 lines
- [00:01]
Jim Love
The Washington Post hack exposes critical questions about Microsoft 365's enterprise security. A critical Linux flaw gives attackers root access. The Godfather malware now creates virtual banking apps to steal credentials in real time. A new world record 16 billion logins exposed. This is Cybersecurity Today. I'm your host Jim Love. Major news organizations face relentless cyber attacks, but the Washington Post's latest breach raises uncomfortable questions about Microsoft 365, the platform millions of businesses rely on for email and collaboration. Last Thursday, foreign government hackers compromised Microsoft's email accounts belonging to several Washington Post journalists covering national security, economic policy and China. The targeted attack puts Microsoft Enterprise security under some intense scrutiny. Microsoft offers multiple layers of protection. There's Defender for Office 365. It guards against malicious attachments and phishing attempts, while Entre ID provides multi factor authentication and access controls that limit logins from unknown locations or devices. But here's the problem. Even with these advanced protections, breaches still occur through misconfiguration, user error or zero day vulnerabilities. Security experts note that it requires efforts from both Microsoft and the customer to maintain security. The shared responsibility model creates challenges many organizations struggle with. While Microsoft provides the tools, companies must configure them properly and train employees consistently. The human factor remains the weakest link. Many attacks exploit employees tricked into sharing passwords or sensitive information. Still, Microsoft's popularity makes it a high value target when foreign governments can breach well protected organizations like the Washington Post, it demonstrates that no system is impenetrable. For businesses using Microsoft 365, the incident serves as a wake up call essential measures including mandatory multi factor authentication for all users, strong password policies and regular security training, as well as timely security updates. The Washington Post either doesn't know or isn't disclosing how the breach occurred. Security experts note that similar attacks have involved exploitation of Microsoft Exchange vulnerabilities, forged authentication tokens or advanced techniques used by groups like storm 0558, which is linked to Chinese state sponsored activity. But there's an important principle at play here. It's called Hanlon's Razor for cybersecurity. In the absence of other information never ascribed to sophisticated technology, what might simply be attributable to carelessness or human error? Until we know more, this breach could just as easily have come from a phishing email or weak passwords, or from a zero day exploit where there wasn't an update done. Two chained vulnerabilities discovered by Qualsys researchers allow local attackers to gain root privileges on Ubuntu, Debian, Fedora, and Susee systems with minimal effort. CVE2025 6018 exploits the pluggable authentication modules or PAM framework misconfiguration on SUSE Systems to gain AllowActive user privileges. CVE2025 6019 then exploits LibBlock dev through the uDisk's storage daemon to escalate from AllowActive to root access. The uDisk vulnerability is particularly dangerous because the service ships by default on virtually all Linux distributions, Qualsys True senior manager Saeed Abbasi said in a recent interview. Although it nominally requires allowactive privileges, udisks ship by default on almost all Linux distributions, so nearly any system is vulnerable. He went on to say that Qualsys has developed working proof of concept exploits targeting all major distributions. An attacker, he said, can chain these vulnerabilities for immediate root compromise with minimal effort. This follows a pattern of critical privilege escalation flaws discovered by Qualsys. There was pwnkit in pullkits, pkexec, Looney Tunables in glibsix id, so Loader, Sequoia in the Kernel File systems layer, and Baron Samedit in Sudo. After the Looney Tunables disclosure, attackers quickly weaponized it with kinsing malware to steal cloud service provider credentials. As I'm sure I don't have to tell most of our listeners, root compromise enables complete system control, agent tampering, persistent mechanisms, and lateral movement capabilities as well. As Abbasi explained, one unpatched server endangers the whole fleet. System administrators must patch both PAM configurations and libblock dev udisks immediately. Security patches are available through distribution maintainers and of course I've seen links to patches in other articles, but we all know know that you go to the source yourself and you don't follow a link in an article, even if it's from us. The advice remains that given the ubiquity of udisks and the simplicity of the exploit, organizations must treat this as a critical universal risk and deploy patches without delay. Banking malware has evolved beyond fake login screens into something more dangerous malware that creates virtual instances of your actual banking apps, making detection nearly impossible, Symperium researchers discovered. Upgraded Godfather malware now launches virtualized versions of financial apps from sandboxed environments on infected Android devices. Instead of overlay attacks mimicking interfaces, the malware clones legitimate banking applications when users launch them. The attack methodology is sophisticated. Godfather scans infected devices for banking apps, compares against target lists. Then it intercepts legitimate apps and launches with virtualized versions designed to capture credentials, pins and unlock patterns through fake lock screen overlays, the evolution eliminates previous limitations. Instead of having to rely on a potential victim enabling the necessary permissions, the malware can now essentially clone financial apps to more easily steal credentials. According to a security analyst, the malware includes remote control capabilities enabling real time fraud. Hackers can unlock devices while victims sleep or carry phones in their pockets, stealing passwords and transferring funds without immediate detection. Currently this is targeting Turkish Android users exclusively, but security experts warn expansions to the us, UK and Canadian markets are likely. The virtualization approach evades traditional detection while appearing completely legitimate. Protection requires disabling install apps from unknown sources in Android settings, enabling Google Play Protect for automated scanning, and perhaps even running a dedicated anti malware suite. Additional safeguards include limiting installed apps and maintaining current Android security updates. The Broader Threat Godfather's virtualization technique could be adopted by other banking malware strains, fundamentally changing mobile security landscapes and forcing new detection methodologies for virtualized attack environments Remember the good old days when 180 million stolen IDs seemed like a big number? Well, that was like so two days ago. Security researchers have just discovered what they're calling one of the largest data breaches in history, a staggering 16 billion. Yes, billion with a B Logins exposed Including Apple accounts, The researchers found 30 separate exposed data sets, each containing tens of millions to over 3.5 billion records. Even accounting for the potential overlap between the databases, this remains one of the biggest stolen login discoveries of all time. What's especially concerning is the structure and recency of these data sets. They aren't just the old breaches being recycled. This is fresh weaponizable intelligence at scale. The clean organization of the stolen data URL, username, password all points to infostealers as the source. These are specialized malware programs designed specifically to harvest login credentials in exactly this format, making the data immediately usable for cybercriminals. The breach is connected to a discovery last month that we reported on a few days ago, when Apple login credentials were found amongst 184 million records sitting unprotected on a web server. Well, that massive database turned out to be just the tip of the iceberg, with researchers uncovering the 29 additional data sets. Upon further investigation, the stolen credentials give cybercriminals unprecedented access to personal credentials that can be used for account takeover, identity theft and highly targeted phishing, according to the research team. For Apple users specifically, this represents a serious threat. Apple accounts control access to icloud data, payment information, device locations, and personal communications across the entire Apple ecosystem. The scale of this breach highlights a critical reality. No service is immune to credential theft, and the stolen data is becoming increasingly organized and accessible to bad actors. Traditional password based security is fundamentally broken when breaches of this magnitude can occur. The bottom line? If you're still relying solely on passwords for account security, you're essentially gambling with your digital life. Despite its failings, Two Factor Authentication might be a good thing to have, especially with Apple accounts that can control your entire digital ecosystem. And Apple does have a better system of Two Factor Authentication. I'll be thrilled to hear from any listeners out there, but I think this is one of the most significant things we've seen in the past year or two. And if you do as well, please share this podcast with your friends and people who need to know. And if there are people out there with specific expertise or have misstated any of this, please get in contact with me. There's a contact form on our site tech newsday.com and as in the last story, we're all talking about Two Factor Authentication. But I think we also have to acknowledge that that SMS two factor authentication is now fundamentally broken. A whistleblower revealed 1 million two FA codes were intercepted by Fink Telecom services. I didn't make the name up. They're a Swiss company. The intercepted codes came from Google, Meta, Amazon, European banks, Tinder, Snapchat, binance signal and WhatsApp. Recipients spanned 100 plus countries during June 2023, according to data provided by Bloomberg and Lighthouse reports. SMS communications are often completely unencrypted, making codes vulnerable to telecom network interception. Security experts linked Fink to incidents where intercepted SMS codes enabled account breaches, despite company claims that it only provides routing capabilities. This proves what security professionals have warned SMS authentication creates systemic vulnerabilities. Criminal hackers and state surveillance operations can capture codes at multiple points within the telecom infrastructure. If surveillance companies can systematically intercept authentication codes from major platforms, SMS based security is an illusion. Apple's device 2 FA system remains secure by bypassing SMS infrastructures and entirely. Organizations should transition to app based authentications or hardware keys as soon as possible. But as much as it pains me to say this, I would not go removing 2fa from any place until they were prepared to replace it with a better system. Remember the old adage better to do something than nothing? And that's our show in case you have kids in the room. I'm just going to say holy crap. What a lot has happened or surfaced this week. I always knew that two factor was potentially problematic, but I never thought about it at this level. And I'm starting to wonder if we shouldn't just identify the two IDs in the world that haven't been compromised and call it a day. But if I've depressed the hell out of you, cheer up. The weekend is coming, and in my part of the world, it's summer. So if you think that we're not just coming out to depress you and we're bringing you some real value, Please go to buymeacoffee.com techpodcast we're struggling to pay our bills. We need your help, and if you are contributing or have contributed, God love you, as my dad used to say. But for me, I'll just say I'm your host, Jim Love thanks for listening. Sam.