YouTubers Attacked By Malware: Cyber Security Today, Wednesday, January 15, 2025

Wed Jan 15 2025

Cybersecurity Rundown: YouTube Malware, Strava Leaks, UK Ransomware Ban, AWS Exploits & Fortinet Vulnerabilities In this episode of 'Cybersecurity Today,' host Jim Love covers critical cybersecurity topics including YouTubers targeted with malware...

Summary

Cybersecurity Today: YouTubers Attacked By Malware Wednesday, January 15, 2025

Host: Jim Love

Introduction

In the January 15, 2025 episode of Cybersecurity Today, host Jim Love delves into the latest cybersecurity threats impacting businesses and individuals alike. The episode covers a range of topics, including malware attacks on YouTubers, data leaks through fitness applications, proposed ransomware payment bans in the UK, exploitation of AWS encryption tools by ransomware gangs, and zero-day attacks targeting Fortinet firewalls. Love provides insightful analysis, expert opinions, and actionable advice to help listeners safeguard their digital environments in an increasingly perilous cyber landscape.

1. Malware Attacks on YouTubers and Trusted Platforms

Jim Love opens the episode by highlighting a surge in cybercriminal activities targeting YouTubers and leveraging trusted platforms like YouTube and Google search results to disseminate malware links.

Malware Distribution Tactics:
- Trusted Platforms Exploited: Cybercriminals embed malware links within legitimate-looking content on YouTube and Google Search. These links often appear in video descriptions, pinned comments, or search result listings.
- Targeted Users: According to Trend Micro researchers, the primary targets are users searching for cracked or free software. Instead of downloading the intended tools, victims inadvertently install malware such as Luma or Vidar, which are designed to steal sensitive information like passwords and cryptocurrency wallet data.
Clever Schemes:
- File Sharing Sites as Vectors: The malicious links redirect users to reputable file-sharing services like MediaFire or Mega.nz, where malware is concealed within password-protected archives to evade detection.
- Google Search Manipulation: Fake links, such as counterfeit Autodesk downloads, lead unsuspecting users to infostealer payloads.
Expert Insights:
- Trend Micro Analysis: Jim cites Trend Micro, stating, "The real risk is complacency. People chasing free software often overlook security warnings," emphasizing the importance of vigilance among users.
- Preventative Measures: Educating users is paramount. Jim advises, "The best defense is to educate users that free software may come at a high price and almost always does their privacy, their data, and even their money."

2. Data Leaks via Fitness Applications

The episode transitions to discuss significant data breaches involving fitness applications, with a focus on the military implications.

Strava Incident:
- Data Exposure: Le Monde reported that Strava, a popular exercise tracking app, inadvertently revealed sensitive information by tracking the runs of crew members at France's Isle Long base. The sudden cessation of activity corresponded with the submarine's patrol schedule, and activity resumes post-patrol.
- Military Implications: This phenomenon, termed "fit leaking," poses risks by exposing base layouts and troop movements. Similar incidents have been reported in the US and Israel, where fitness data from Strava’s public heat maps exposed military sites.
French Navy's Response:
- The French Navy acknowledged the lapse, raising concerns that foreign intelligence agencies might have accessed the leaked data. This underscores the broader issue of how seemingly innocuous applications can inadvertently compromise national security.
Expert Commentary:
- Jim emphasizes, "Smartphones and even wearables can leak sensitive information, even for high security operations," highlighting the necessity for stringent data handling and reevaluation of device policies within sensitive environments.

3. Proposed UK Ransomware Payment Ban

A significant part of the discussion centers on the UK government's consideration of imposing a ban on ransom payments by public sector organizations.

Policy Proposal:
- The UK government has initiated a 12-week consultation to explore prohibiting public sector entities—including hospitals, schools, and transport networks—from paying ransoms to cybercriminals.
- One of the proposals extends this ban to private companies, requiring them to obtain government approval before making any ransomware payments.
Arguments For the Ban:
- Criminal Disincentive: Supporters argue that preventing ransom payments could disrupt criminal financial pipelines, thereby reducing the incidence of ransomware attacks.
- Policy Insights: David Shipley, head of Beauceron Security and a regular panelist, reinforces this stance by arguing strongly against paying ransoms, suggesting that non-compliance could diminish the profitability of such illicit activities.
Critics' Concerns:
- Unintended Consequences: Opponents worry that a payment ban might drive ransom transactions underground, complicate recovery efforts for victims, and potentially lead to increased cyber extortion activities.
Government Stance:
- Security Minister Dan Jarvis: He states, "These proposals aim to choke off criminals' financial pipelines," indicating a strategic move to weaken the operational capabilities of ransomware gangs.
- Policy Development: Organizations have a limited window of 12 weeks to influence the policy, whether it results in a complete ban, a licensing framework, or mandatory reporting requirements.
Global Implications:
- Jim notes, "The global response to ransomware may be changing. And that change might begin in the UK," suggesting that the UK's approach could set a precedent for other major economies.

4. Exploitation of AWS Encryption Tools by Ransomware Gang 'Code Finger'

The episode introduces a sophisticated ransomware operation known as Code Finger, which exploits Amazon Web Services' (AWS) encryption tools to carry out attacks.

Attack Mechanism:
- AWS Encryption Exploitation: Code Finger leverages AWS's server-side encryption with customer-provided keys (SSE-C). By compromising credentials, the attackers lock victims out of their S3 storage buckets using the AES-256 key.
- Privacy and Data Sovereignty: AWS's encryption strategy, which ensures that only clients possess the encryption keys, is undermined when attackers obtain these keys, rendering victims unable to decrypt their data without the attackers' intervention.
Research Insights:
- Halcyon Researchers: They warn that this tactic represents a systemic risk to cloud users. At least two AWS native developers have fallen victim to these attacks, with criminals imposing a seven-day payment deadline or threatening immediate data deletion upon contacting authorities.
Preventative Measures:
- AWS Recommendations: To mitigate such risks, AWS advises customers to minimize key exposure by rotating credentials using IAM roles and avoiding the use of SSE-C wherever possible.
Implications for Cloud Security:
- The exploitation of legitimate cloud features like AWS’s encryption tools illustrates that even robust security mechanisms can be weaponized if not adequately managed. This highlights the need for continuous monitoring and stringent credential management practices.

5. Zero-Day Attacks Targeting Fortinet Firewalls

Jim Love concludes the episode by discussing a wave of zero-day attacks targeting Fortinet firewalls, emphasizing the critical nature of timely patching and vigilant monitoring.

Attack Overview:
- Arctic Wolf Labs Report: In December, cybercriminals accessed and exposed firewall management interfaces, created super admin accounts, and utilized SSL VPN tunnels to navigate through networks. Indicators of compromise included suspicious login activity and altered configurations.
- Zero-Day Vulnerability: These activities suggest the exploitation of a zero-day vulnerability, culminating in Fortinet issuing a critical patch on January 14th for CVE 2020455591, an authentication bypass flaw.
Immediate Actions:
- Patch Deployment: Fortinet emphasizes the urgency of applying the patch immediately and advises administrators to review logs for any unusual activity that may indicate a breach.
Key Lessons:
- Monitoring and Patch Management: The attack underscores the importance of continuous monitoring of login attempts and the prompt application of security patches, especially for essential infrastructure like firewalls.
- Future Vigilance: Fortinet users are urged to remain alert for further developments, as the threat landscape continues to evolve.

Conclusion

In this episode of Cybersecurity Today, Jim Love provides a comprehensive overview of current cybersecurity threats, ranging from malware distribution on popular platforms to sophisticated ransomware operations exploiting cloud services. The discussions emphasize the critical need for user education, robust security practices, timely patching, and strategic policy measures to combat the ever-evolving tactics of cybercriminals. As businesses and individuals navigate these challenges, staying informed and proactive remains paramount in safeguarding digital assets and sensitive information.

Notable Quotes:

Jim Love (00:01): "Cybercriminals are planting malware links on trusted platforms like YouTube and even Google search results."
Jim Love (via Trend Micro): "The real risk is complacency. People chasing free software often overlook security warnings."
Jim Love (On Fitness Apps): "Smartphones and even wearables can leak sensitive information, even for high security operations."
Security Minister Dan Jarvis: "These proposals aim to choke off criminals' financial pipelines."
Jim Love (On AWS Attacks): "Even legitimate cloud features can be weaponized by criminals."

For insights, tips, comments, or constructive criticism, listeners are encouraged to reach out to Jim Love at editorial@echnewsday.ca.

Transcript

Jim Love (0:01)

Youtubers are targeted with malware links. Fitness apps are leaking military secrets. A UK ransomware payment ban is proposed. AWS encryption tools are exploited by a new ransomware gang. And fortnet firewalls are hit by possible zero day attacks. This is cybersecurity today. I'm your host, Jim Love. Cybercriminals are planting malware links on trusted platforms like YouTube and even Google search results. Trend Micro researchers say these attackers target users searching for cracked software instead of downloading the promised tool. Victims unknowingly install malware such as Luma or Vidar that steals passwords and crypto wallet data and more. The scheme is clever. There are videos with tutorials claiming to provide free software, including links and descriptions or pinned comments. These links direct users to file sharing sites. Some legitimate sites like mediafire or Meganz, where malware hides in password protected archives to evade detection. The same tactics are appearing in Google search results. For instance, one fake autodesk link led to an infostealer download. Security experts warn that the real risk is complacency. People chasing free software often overlook security warnings. Enterprises are especially vulnerable if employees fall for these scams. The best defense Educate users that free software may come at a high price and almost always does their privacy, their data, and even their money. And in a world where home and office boundaries are at best in flux, this free software could cost their company big time. The journal Le Monde reported that Strava, a popular exercise tracking app, tracked runs by crew members at France's Isle Long base. And when their activity suddenly stopped, it revealed the nuclear submarine was on patrol. Weeks later, when the crew returned, Strava lit up again. One sailor even made a joke about returning from the sea. This type of leak is called fit leaking. Experts warn that fitness apps can reveal sensitive information, from base layouts to troop movements. And this isn't the first incident. The US and Israel have seen similar issues where fitness data exposed military sites on Strava's public heat map. The French Navy acknowledges the security lapse, and experts caution that foreign intelligence agencies may have accessed this data. So what's the lesson to be learned? Smartphones and even wearables can leak sensitive information, even for high security operations. And where phones might even be banned, smartwatches can get in. And it's not just fitness apps. On Monday's show, we had a story that showed that thousands of apps have been used to collect location data and have disclosed it to the American government and maybe more. While today's example is definitely a breach of security, there is a much bigger problem. Tackling these risks requires more than banning devices. It means rethinking how we handle location data. In our last weekend show, our panelist and frequent guest David Shipley, the head of Beauceron Security, made an impassioned argument against paying ransoms. It turns out the UK government might agree with him. The UK government has launched a 12 week consultation on whether to stop public sector organizations from from paying ransoms. This would include hospitals, schools, transport networks and more. One proposal goes even further, requiring private companies to get government approval before making ransomware payments. Supporters say cutting off ransom payments could reduce a tax. Security Minister Dan Jarvis says these proposals aim to choke off criminals financial pipelines. Critics worry about unintended consequences like driving payments underground or making it harder for victims to recover. If the UK moves forward, it would be the first major economy to introduce such sweeping measures. Organizations have 12 weeks to shape this policy. Whether it's a full ban, a licensing system or mandatory reporting, One thing is clear. The global response to ransomware may be changing. And that change might begin in the uk. I woke up this morning and caught up on the news as I normally do, and I couldn't get this song out of my head. It was the theme for Goldfinger. And then I realized the story that I'd been reading. A new ransomware gang called Code Finger is targeting Amazon web service users. But just like a James Bond story, there's a twist. The hackers are using AWS's encryption tools to carry out the attack. They exploit AWS's server side encryption with customer provided keys known as SSE C. They gain access by using compromised credentials to lock S3 storage buckets out with the AES 256 key. Now, one of the strengths of AWS's approach to encryption is that their company does not retain these keys. Only their clients have that info. The idea was rooted in privacy and data sovereignty. A government or other party can't demand that AWS give them access to client data. It's encrypted. They don't have the keys. But if attackers get control, victims can't decrypt their data without the attacker's key. Halcyon researchers warn that this tactic could pose a systemic risk to cloud users. At least 2 AWS native developers have been hit. In one case, the criminals gave victims a seven day deadline to pay before deleting their data. And they were warned that if they contacted legal authorities or anyone else, their data would be immediately deleted. AWS advises customers to minimize key exposure by rotating credentials using IAM roles and avoiding SSC wherever possible. The attack shows that even legitimate cloud features can be weaponized by criminals. Arctic Wolf Labs reports a wave of attacks in December. Criminals accessed, exposed firewall management interfaces creating super admin accounts and used SSL VPN tunnels to move through networks. Suspicious login activity and altered configurations point to a likely zero day vulnerability and on January 14th Fortinet stepped up and issued a critical patch for CVE 2020455591 which they described as an authentication bypass flaw. It has a huge severity and admins are urged to patch immediately and review logs for unusual activity. The attack highlights a key lesson. This was caught because people were monitoring login attempts and you need to apply patches promptly, especially for firewalls. Fortnet users should stay alert for future developments. And that's our show for today. You can reach me with tips, comments and yes, even some constructive criticism at editorialechnewsday ca I'm your host Jim Love. Thanks for listening.