Oracle Denies Hack Despite Hacker's Evidence: Cyber Security Today for March 26, 2025

Summary

Cybersecurity Today: Episode Summary

Title: Oracle Denies Hack Despite Hacker's Evidence: Cyber Security Today for March 26, 2025
Host: Jim Love
Release Date: March 26, 2025
Podcast Description: Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time.

---

1. Oracle Denies Cloud Systems Breached

Timestamp: [00:02]

Jim Love opens the episode by addressing recent claims against Oracle, where a hacker alias rose87168 alleges the theft of 6 million user records from Oracle's cloud systems. The hacker claims to have accessed encrypted passwords, single sign-on credentials, Java key store files, and other sensitive configuration data from Oracle's cloud login servers. Despite these allegations, Oracle firmly denies any breach.

Notable Quotes:

• Jim Love: "Oracle is denying claims that its cloud systems were breached after a hacker alleged they had stolen 6 million user records." [00:02]
• Oracle's Statement: "There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data."

The hacker reportedly demanded 100,000 Monero, citing its privacy-focused and trace-resistant nature, in exchange for the data and instructions to fix the alleged vulnerability. When Oracle did not comply, the data was offered for sale, with an added proposition for companies to pay to have their employee records removed from the dataset before its sale.

Jim Love: "The authenticity of the stolen data has not been independently verified. Oracle continues to insist that its systems remain secure and that no customer data has been compromised." [00:02]

A link provided by the hackers showing a .TXT file uploaded to what appears to be Oracle's cloud servers was presented to Bleeping Computer, who sought clarification from Oracle regarding how the file was placed without server access. As of the episode's airing, Oracle had not responded.

---

2. Leakage of Classified Military Information

Timestamp: [00:02 - 03:50]

Jim transitions to a high-profile incident involving Jeffrey Goldberg, editor-in-chief of The Atlantic. Goldberg was mistakenly added to a Signal Group chat that discussed classified U.S. military strikes in Yemen against the Houthi militant group. The chat included details on targets, weapons, and the timing of a bombing campaign, involving high-level members of the Trump administration.

Notable Quotes:

• Jeffrey Goldberg: "I received the message on March 11 from someone claiming to be National Security Adviser Michael Walsh." [00:02]
• Jim Love: "It's the ultimate in sloppiness." [03:50]

Initially, Goldberg suspected a hoax or foreign disinformation campaign, but subsequent U.S. airstrikes two hours after the group's final message confirmed the plans were real. The messages named several U.S. officials, including Pete Hegseth, JD Vance, Marco Rubio, and Tulsi Gabbard, and discussed diplomatic communications and classified systems.

The leak has caused significant uproar due to several security lapses:

• Use of Signal: Despite being an encrypted app, Signal is deemed inappropriate for transmitting U.S. military secrets.
• Potential Compromise: There is a possibility that communications were intercepted by Russians or others, as Signal has been breached in the past.
• Unauthorized Devices: Communication likely occurred on regular cell phones instead of approved government devices.
• Operational Security: At least one participant may have been in Moscow during the communications, raising concerns about information security.

Goldberg prudently declined to publish the name of an active intelligence officer and withheld other top-secret details to prevent further security breaches.

Jim Love: "Many critics have noted that if the average military officer would have demonstrated this degree of carelessness with top secret records, they would have been court-martialed and possibly even jailed." [03:50]

---

3. Troy Hunt's Phishing Attack and Data Breach

Timestamp: [03:50 - 07:50]

Jim discusses a phishing attack targeting Troy Hunt, the founder of Have I Been Pwned? Hunt's Mailchimp account was compromised, leading to the exposure of approximately 16,000 email subscribers' information, including around 7,500 unsubscribed individuals. Hunt expressed frustration over Mailchimp's retention of unsubscribed users' data and is investigating whether a configuration issue on his part contributed to the breach.

Notable Quotes:

• Troy Hunt: "The breach affected both active subscribers and around 7,500 individuals who had previously unsubscribed." [03:50]
• Troy Hunt: "While two-factor authentication via one-time passcodes offers some security, it remains vulnerable to automated phishing attacks that can relay these codes in real time." [06:20]
• Jim Love: "The moral Stay humble. We all make mistakes. Stay open. Talk to people about them when you make them." [07:30]

The phishing attack involved a crafted email that created a sense of urgency, prompting Hunt to log into a fraudulent page where he entered his credentials and a one-time passcode. Although Hunt realized the deception moments later, the automated attack had already succeeded in exporting his mailing list within minutes.

Hunt highlighted the limitations of traditional two-factor authentication (2FA) methods, emphasizing that Mailchimp does not support phishing-resistant options like hardware security keys or pass keys. He criticized the Outlook iOS app for displaying the email sender name as Mailchimp Account Services while hiding the domain, making the fraudulent email appear legitimate.

Jim reflects on the incident, acknowledging that even well-trained individuals like Hunt can fall victim to phishing attacks. He shares a personal anecdote about almost clicking a fake link, thanks to his wife's intervention, emphasizing the universal vulnerability to such attacks.

Jim Love’s Takeaways:

• Stay Humble: Acknowledge that mistakes happen.
• Stay Open: Communicate openly about errors to foster better security practices.
• User vs. Defense Layers: The strength of security doesn't solely depend on users but on effective communication and layered protections.

---

4. Closing Thoughts

Timestamp: [07:50]

Jim wraps up the episode by reinforcing the importance of humility, open communication, and the continuous improvement of security practices. He underscores that maintaining robust cybersecurity requires collective awareness and vigilance.

Jim Love: "Stay humble. We all make mistakes. Stay open. Talk to people about them when you make them. And let's remember that the difference between whether a user is the weakest link or another layer of protection doesn't depend on them totally, but how well we communicate." [07:30]

Jim thanks listeners for tuning in and signs off, leaving them with actionable insights and reflections on the discussed cybersecurity incidents.

---

Overall Summary: In this episode of Cybersecurity Today, Jim Love delves into three significant cybersecurity incidents: Oracle's denial of a cloud system breach amidst hacker allegations, a serious leak of classified U.S. military information involving The Atlantic's editor, and a phishing attack targeting Troy Hunt resulting in a substantial data breach. The discussions highlight the evolving challenges in cybersecurity, the importance of robust security protocols, and the human element's role in safeguarding sensitive information. Through detailed analysis and expert insights, listeners gain a comprehensive understanding of current cybersecurity threats and best practices to mitigate them.

Transcript

[Jim Love]

Oracle denies its cloud systems were hacked Top secret military details were sent by accident to the editor of the Atlantic magazine and Troy Hunt, who created the site. Have I been pwned? Has well been pwned. This is Cybersecurity Today. I'm your host Jim Love. Oracle is denying claims that its cloud systems were breached after a hacker alleged they had stolen 6 million user records. We covered this in our last episode of Cybersecurity Today. The hacker, using the alias rose87168, had posted on a dark web forum claiming they had accessed encrypted passwords, single sign on credentials, Java key store files and other sensitive configuration data from Oracle's cloud login servers. In a public statement, Oracle said there has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data. The hacker reportedly demanded 100,000 Monero, a privacy focused cryptocurrency known for being difficult to trace, in exchange for the data and instructions on how to fix the claimed vulnerability. After Oracle did not respond, the data was offered for sale. The hacker also invited companies to pay to have their employee records removed from the dataset before it was sold. The authenticity of the stolen data has not been independently verified. Oracle continues to insist that its systems remain secure and that no customer data has been compromised. However, Bleeping Computer, which first reported the story, was given a link by the hackers showing a. TXT file uploaded to what appears to be Oracle's cloud servers. The outlet has asked Oracle to explain how the file was placed there when without having access to the server. As of the time we went to air, Oracle had not responded. The Atlantic's editor in chief, Jeffrey Goldberg said he was mistakenly added to a Signal Group chat discussing classified U.S. military strikes in Yemen. The chat included high level members of the Trump administration and detailed targets, weapons and timing for a bombing campaign as against the Houthi militant group in Yemen. According to Goldberg, he received the message on March 11 from someone claiming to be National Security Adviser Michael Walsh. Two days later he was added to a group titled Houthi PC Small Group where other users, apparently acting as US Cabinet officials, began coordinating responses and designating staff contacts. Initially, Goldberg suspected a hoax or foreign disinformation campaign. But the details of the message combined with the subsequent launches of U.S. airstrikes two hours after the group's final message confirmed the plans were real and the messages named US officials including Pete Hegseth, JD Vance, Marco Rubio and Tulsi Gabbard and discussed diplomatic communications, military sequences, and classified systems. Not surprisingly, the leak has caused a huge uproar. First and most obvious, although Signal is an encrypted app, it is not in any way an appropriate channel for US military secrets. Russians and others have managed to break into signal communications in the past. You can also add to this that it was most likely communicated on regular cell phones, as you can't install Signal on approved government communication devices. And as a third strike, at least one of the people involved in this chat may have been in Moscow at the time of the communications. In addition, to add insult to injury, they included a journalist in their discussions. It's the ultimate in sloppiness. Fortunately, Goldberg, the Atlantic editor, declined to publish the name of the active intelligence officer who was mentioned in the chat, and he kept other top secret details confidential. Many critics have noted that if the average military officer would have demonstrated this degree of carelessness with top secret records, they would have been court martialed and possibly even jailed. Troy Hunt, renowned information security expert and founder of have I Been Pwned? Has reported a phishing attack that compromised his Mailchimp account, leading to the exposure of approximately 16,000 email subscribers information. The breach affected both active subscribers and around 7,500 individuals who had previously unsubscribed. Hunt expressed frustration over Mailchimp's retention of unsubscribed users data and is investigating whether this was due to a configuration issue on his part. Hunt noted that he was jet lagged when he got the phishing email, which was crafted to create a sense of urgency, prompting him to log into a fraudulent page where he entered his credentials and a one time passcode. They did realize the deception moments later, but when he attempted to secure his account in that few minutes, the mailing list had already been exported. The automated attack was executed within minutes. Hunt highlighted the limitations of traditional two factor authentication methods, noting that mailchimp does not support phishing resistant options like hardware security keys or pass keys. He emphasized that while two factor authentication via one time passcodes offers some security, it remains vulnerable to automated phishing attacks that can relay these codes in real time. Hunt also expressed his frustration at Outlook's iOS app, which put the email sender name as Mailchimp Account Services and hid the domain hr group f be that would have given it away as a fake. Now while we can parse this in hindsight and we can look for the things that Hunt should have caught, the real lesson is that if someone this well trained can fall victim to a phishing attack all of us are vulnerable. We also have to give Hunt full credit for blogging about this immediately, providing screenshots and a full disclosure that can't have been an easy thing to do. And for full disclosure, although I try to be absolutely careful, I've been fooled as well. I almost clicked on a link last week when my wife, who has no interest at all in tech and security, asked if I was nuts, telling me this link was obviously a fake. And I smiled because somebody who I'd made aware of security issues had learned enough to stop me from making a mistake. The moral Stay humble. We all make mistakes. Stay open. Talk to people about them when you make them. And let's remember that the difference between whether a user is the weakest link or another layer of protection doesn't depend on them totally, but how well we communicate. And given my earlier story, the examples we set with our own behavior. And that's our show. I'm your host, Jim Love. Thanks for listening.