← Cybersecurity Today
Cybersecurity Today
Ransomware Insider Threats, AI Vulnerabilities, and Major Security Gaffes
00:10:14
Loading summary
Transcript1 lines
- [00:02]
A
Cybersecurity Today we'd like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST ransomware negotiators are accused of turning into hackers Malware hides inside windows AI stack backdoor uses OpenAI's assist API for covert control Flaws could weaken encryption keys and the Louvre heist exposes shocking security sloppiness. This is Cybersecurity Today. I'm your host Jim Love. Imagine hiring someone to negotiate with ransomware gangs and finding out they've been the ones running the attack. That's what prosecutors say might have happened at Digital Mint, a Chicago company that helps victims negotiate and pay ransoms. Two of its ransomware negotiators, Kevin Tyler Martin and another unnamed employee, have been charged with carrying out attacks using ALF V, also known as Black Cat ransomware. They weren't alone. A third man, Ryan Clifford Goldberg, who once worked as an incident response manager at Signia, was also indicted. Prosecutors say the trio hacked at least five U.S. companies, stole data and demanded payment, netting more than $1.2 million from a Florida medical device maker. Other victims included a Virginia drone manufacturer and a Maryland pharmaceutical firm. Digital Mint's president, Mark Gren, said Martin acted completely outside the scope of his employment, and we hope so. Signia confirmed Goldberg's termination. Both companies are cooperating with the FBI. It's a stunning insider threat. Case professionals hired to stop ransomware accused of joining it. A new proof of concept shows that Windows built in artificial intelligence Stack can become an attack vector one most defenders haven't even considered. A researcher called HXR1, in work shared with the security blog Dark Reading, demonstrated how malware can be hidden inside onnx, the open neural network exchange format used by Windows features like Windows, hello Photos, and Office. For a few years now, Microsoft has pushed more AI processing to run locally for privacy and speed. But that same shift has had an unintended consequence in widening the attack surface. In HXR1's demo, the malicious code was embedded in a neural network's internal data and reconstructed in memory using trusted Windows components. And because onnx files aren't signed or scanned, the payload slipped past antivirus tools completely. In fact, this turns into what might be a textbook living off the land attack using what's already built into Windows. But this highlights a huge problem that is becoming evident in AI security. While the cybersecurity community has worked to try to install the idea that security needs to be built in and not bolted on. The reality is that the run fast and break things culture of AI appears to be deploy first, patch later, which gives HXR1's comments more validity when he says these models are not trustworthy. Don't blindly trust any model sitting on the Internet. And as if to echo that, there was a second major AI related attack vector uncovered this week showing that attackers may be starting to weaponize the AI infrastructure enterprises are starting to depend on Microsoft's detection and response team, or DART, discovered a new backdoor called SesameOp, a net based malware strain that used OpenAI's assistance API as a hidden command and control channel. The Assistance API was announced with some fanfare, and it allows developers to build custom AI assistants that can store context and call tools, a valuable tool in integrating AI and other systems. In this case, the attackers exploited those same features to fetch encrypted commands and send stolen data back disguised as legitimate API traffic. The malware was found during a July espionage investigation, and Microsoft said it gave attackers persistent access for months by abusing trusted cloud services instead of using new or different infrastructure that might be detected or shut down. We need to stress this wasn't a flaw in OpenAI systems, it was a misuse of legitimate features, and Microsoft and OpenAI have worked together to disable the compromised account. But the affected API is still active, although it's scheduled for deprecation in August of 2020. And AMD has confirmed a high severity flaw in its Zen 5 CPUs that could cause hardware random number generators to produce predictable encryption keys. The vulnerability is tracked as AMD SB7055, and it affects the RDC'd instruction. Now that's one of two CPU routines used to generate random numbers. RDSEED is designed to produce true randomness, While its counterpart RD Rand is a pseudo random generator. RDC'd is affected. RD Rand is not RDCed can sometimes output zeros while still reporting success, and that leads to the possibility of predictable numbers. That's a serious issue, since unpredictability of random values underpins cryptographic security. This was discovered by a meta engineer in October, prompting Linux developers to disable RDC'ed entirely on Zen 5 systems. AMD says firmware updates addressing the issue will roll out between now and January 2026, with patches for Ryzen 9000 and Threadripper 9000 processors starting November 25th. Now this is a stark reminder that even at the deepest layers of modern processors, the ones we trust for things like randomness, human oversight remains essential, and we need to encourage the curiosity and creativity that that meta engineer had that uncovered this issue. And finally, the Louvre, home of the Mona Lisa, is facing a crisis of credibility after investigators found that its surveillance network used simple passwords like Louvre and Thales, which is the name of the security system. According to the security blog Red Hot Cyber, those credentials date back to 2014 and were still active as late as 2024. The museum's technology may have been sophisticated, but its maintenance and oversight were anything but. You might remember that on October 20th, two men used an automated lift truck to break into the Apollo Gallery, cutting open display cases and escaping in minutes with 88 million euros in jewels. The cameras, which should have been state of the art, failed to capture clear footage. Seven people were later arrested. Four now face charges of organized robbery and criminal conspiracy. France's National Agency for Information Systems Security had warned as early as 2014 that control of the museum's network could facilitate art theft, a prediction now haunting officials. Culture Minister Rachita Dati has admitted to security lapses and ordered a full investigation. We'll wait for that investigation to pan out, but if the stories of the passwords are true, this is a classic case of advanced technology undermined by basic human error or sloppiness. Proof that the greatest tech in the world is worthless if you neglect the basics like strong passwords and regular audits. And that's our show. Once again, we'd like to thank Meter for their support in bringing you this podcast. Meter delivers a full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Working with their partners, Meter designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage, deploy and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses all the way to data centers. Book a demo@meter.com CST that's M E T E R.com CST if you like what we're doing, please share the podcast. You've done that generously in the past and our numbers have grown. And if you can, give us a like or comment on your favorite app, whether it's Apple or YouTube or wherever. Those reviews, thumbs ups and subscriptions have a big impact on our ability to attract new listeners. And if you've got something you want to contribute, we love hearing from you. Reach me at the Contact US page at TechNewsDay CA or leave us a comment under the video on YouTube. I'm your host, Jim Love. Thanks for listening.