CyberWire Daily: A New Mirai-Based Botnet

Release Date: January 8, 2025

Host: Dave Bittner & Chris Hare
Produced by: N2K Networks

Introduction

On the January 8, 2025 episode of CyberWire Daily, hosts Dave Bittner and Chris Hare delve into a spectrum of pressing cybersecurity issues, ranging from emerging botnets and sophisticated phishing attacks to critical software vulnerabilities and innovative government initiatives. This comprehensive summary encapsulates the key discussions, insights, and expert analyses presented in the episode.

1. Emergence of the "Gay Femboy" Mirai-Based Botnet

Timestamp: [05:00]

Security researchers from Quanxin XLab unveiled a new Mirai-based botnet named Gay Femboy, which marks a significant evolution from its predecessors. Originating in February 2024, this botnet leverages over 20 vulnerabilities, including several zero-day exploits, to compromise industrial routers and smart home devices.

Key Points:

• Sophistication and Reach: The botnet operates through approximately 15,000 active IP addresses spanning China, Russia, the U.S., Iran, and Turkey.
• Targets: It primarily targets sectors involving industrial routers and smart home devices, exploiting devices like Faith, Niterbit routers, and Weimar home devices.
• Impact on Researchers: Even the XLab researchers faced attacks while analyzing the botnet’s command and control domains, ultimately halting their investigation to prevent further disruptions.

Notable Quote:

"The sophistication of Gay Femboy represents a significant leap in botnet capabilities, making mitigation increasingly challenging," said a Quanxin XLab spokesperson at [05:30].

2. Google’s Android Security Update for 2025

Timestamp: [07:15]

Google released its first security update for Android in 2025, addressing 36 vulnerabilities, including five critical remote code execution (RCE) bugs affecting Android versions 12 through 15.

Key Points:

• Patch Details: The update is divided into two parts—fixing 24 issues in the Framework, Media Framework, and System components, and resolving 12 additional vulnerabilities in components from Imagination Technologies, MediaTek, and Qualcomm.
• Pixel Devices: A critical RCE bug in the Pixel Devices’ baseband subcomponent was also patched.
• Urgency: Google has not detected any active exploitation in the wild but urges users to update promptly to safeguard against potential threats.

Notable Quote:

"Promptly applying these updates is crucial to protect your devices from evolving threats," advised a Google spokesperson at [07:45].

3. Sophisticated Voice Phishing Attacks Exploit Apple and Google Services

Timestamp: [09:30]

Cybercriminals have intensified their voice phishing (vishing) strategies by exploiting legitimate Apple and Google services, making these attacks more convincing and harder to detect.

Key Points:

• Methods: Scammers send notifications, emails, and account recovery prompts using spoofed identities to deceive users into believing they are interacting with official Apple or Google channels.
• Notable Incidents: A cryptocurrency investor lost $4.7 million after being tricked through Google Assistant and fake recovery emails. Additionally, a musician’s Apple credentials were compromised, and billionaire Mark Cuban fell victim to a $43,000 scam orchestrated by the Crypto Chameleon group.
• Techniques: The use of leaked data, phishing kits, and tools like autodockers enhances the precision and effectiveness of these scams.

Notable Quote:

"The integration of legitimate platform functionalities into phishing attacks significantly blurs the lines, making user vigilance more critical than ever," noted Krebs on Security at [10:10].

4. Chinese Hacking Group "Mirror Face" Targets Japan

Timestamp: [12:15]

Japan has attributed over 200 cyberattacks since 2019 to the Chinese hacking group Mirror Face, which focuses on national security and advanced technology sectors.

Key Points:

• Targets: Included foreign and defense ministries, the space agency JAXA, Nagoya's port, and Japan Airlines.
• Tactics: Utilizes phishing emails referencing geopolitical topics and exploits vulnerabilities in VPN systems.
• Response: Experts are urging Japan to bolster its cybersecurity infrastructure, especially as it strengthens defense cooperation with the U.S. and other allies.

Notable Quote:

"Strengthening cybersecurity is paramount as Japan enhances its defense collaborations," stated a Japanese cybersecurity expert at [12:50].

5. Cassio Ransomware Attack Compromises Sensitive Data

Timestamp: [14:00]

In October, the ransomware attack on Cassio compromised the personal data of nearly 8,500 individuals, including employees, business partners, and customers.

Key Points:

• Data Compromised: Names, email addresses, taxpayer IDs, and birth dates were exposed.
• Attribution: A Russia-linked underground ransomware gang claimed responsibility, stealing over 200 gigabytes of data.
• Response: Cassio attributed the breach to phishing attacks and has declined to negotiate with the attackers. While most systems have been restored, some services remain offline. Importantly, no credit card data was compromised.

Notable Quote:

"Our priority is restoring services and ensuring such breaches do not recur," affirmed a Cassio spokesperson at [14:30].

6. Fortinet Uncovers Advanced PayPal Phishing Scam

Timestamp: [15:20]

Fortinet's FortiGuard Labs identified a sophisticated phishing scam targeting PayPal users by exploiting the platform’s legitimate functionalities.

Key Points:

• Scam Mechanics: Scammers send authentic-looking emails from legitimate sender addresses, directing users to counterfeit PayPal login pages under the guise of investigating payment requests.
• Technical Exploits: Utilizes Microsoft 365’s sender rewriting scheme and genuine URLs to bypass traditional phishing detection.
• Preventative Measures: Fortinet CISO Carl Windsor emphasized the importance of verifying URLs, avoiding unsolicited links, and enabling two-factor authentication (2FA).

Notable Quote:

"Enhanced vigilance and robust authentication methods are essential to counter these increasingly sophisticated phishing tactics," advised Carl Windsor at [15:50].

7. SonicWall Addresses Critical Vulnerabilities in SonicOS

Timestamp: [16:45]

SonicWall has issued a security advisory addressing four critical vulnerabilities within its SonicOS software, which affects various firewall models and cloud platforms.

Key Points:

• Vulnerabilities: Include a weak pseudo-random number generator, improper authentication in SSL VPN, server-side request forgery (SSRF), and privilege escalation in Gen7 cloud platforms, with CVSS scores ranging from 6.5 to 8.2.
• Impact: Potential for attackers to bypass authentication, escalate privileges, or establish unauthorized connections.
• Recommendations: SonicWall urges immediate software updates and limiting SSL VPN and SSH management access to trusted sources.

Notable Quote:

"Immediate action is required to mitigate these vulnerabilities and safeguard your network infrastructure," warned a SonicWall representative at [17:25].

8. CISA Warns of Exploitation in Mitel MyCollab

Timestamp: [18:00]

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of two vulnerabilities in Mitel MyCollab.

Key Points:

• Vulnerabilities:
  • Critical: A path traversal flaw with a CVSS score of 9.8, allowing unauthorized administrative actions.
  • Low Severity: Requires admin credentials but cannot modify files or escalate privileges.
• Mitigation: Mitel addressed the critical flaw and patched the other vulnerability in MyCollab version 9.8 SP2.
• Directive: Organizations are urged to apply patches by January 28 to comply with federal mandates.

Notable Quote:

"Timely patching is crucial to prevent unauthorized administrative access and ensure system integrity," emphasized CISA at [18:20].

9. US Launches Cyber Trustmark Initiative

Timestamp: [19:40]

The US government has initiated the Cyber Trustmark Initiative, a voluntary labeling program designed to help consumers identify smart devices with robust cybersecurity protections.

Key Points:

• Purpose: To reduce vulnerabilities in connected devices such as baby monitors, security cameras, fitness trackers, and smart appliances.
• Features: The label includes a shield logo and a QR code providing detailed security information, including software update provisions.
• Participation: Major brands like Amazon, Google, and Samsung are on board, with labeled products expected to roll out later in the year.
• Inspiration: Modeled after the Energy Star program, it aims to inform consumers and incentivize manufacturers to enhance device security.

Notable Quote:

"With the average home containing 21 connected devices, Cyber Trustmark aims to significantly reduce potential entry points for cybercriminals," explained a US government spokesperson at [20:10].

10. CertBytes Segment: Understanding Networking Protocols

Timestamp: [21:00]

In the CertBytes segment, Chris Hare and Stephen Burnley discuss a practice test question from N2K's ISC2 certified cybersecurity exam, focusing on identifying protocols based on well-known TCP ports.

Practice Question:

You use a computer on a TCP/IP network and transfer data through well-known TCP port 80. Which protocol is most likely being used to transfer data?

Options: FTP, POP3, SMTP, HTTP

Discussion Highlights:

• Correct Answer: HTTP, as it is assigned to port 80 and used to transfer data between browsers and servers on the web.
• Study Tips: Utilizing mnemonics and focusing on key aspects of acronyms to aid memorization.
• Expert Insights: Both hosts emphasize the importance of understanding protocols and their associated ports for certification exams.

Notable Quote:

"When dealing with acronym soup, focus on singular, memorable elements to aid recall," advised Chris Hare at [21:50].

11. Privacy Concerns over Motorola’s Automated License Plate Readers

Timestamp: [24:00]

Motorola’s automated license plate readers (ALPRs) have unintentionally become live-streaming surveillance tools due to misconfigurations, raising significant privacy concerns.

Key Points:

• Exposure: ALPRs were found broadcasting video and license plate data online without requiring login credentials.
• Research Findings: Security researcher Matt Brown utilized the IoT search engine Census to locate exposed streams, including color and infrared footage.
• Privacy Implications: Privacy advocate Will Freeman developed a tool that decodes and timestamps car movements, allowing for real-time tracking of individuals.
• Response: Motorola has committed to releasing a firmware update to address these vulnerabilities, though some devices remain insecure until then.

Notable Quote:

"The unintended streaming capabilities of ALPRs pose a significant threat to personal privacy, transforming them into tools for potential surveillance abuses," stated Will Freeman at [24:20].

Conclusion

The January 8, 2025 episode of CyberWire Daily underscores the ever-evolving landscape of cybersecurity threats and defenses. From the sophistication of new botnets and phishing scams to critical software vulnerabilities and proactive government initiatives, the episode provides valuable insights for industry leaders, IT professionals, and cybersecurity enthusiasts. Staying informed and vigilant remains paramount in navigating the complexities of digital security.

For more detailed information and updates, listeners are encouraged to visit thecyberwire.com and engage with the CyberWire community.

This summary was crafted based on the transcript provided and aims to highlight the essential discussions and expert insights shared during the podcast episode.