Dave Bittner (0:02)

You're listening to the Cyberwire network, powered by N2K.

Dave Moulton (0:12)

Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Deleteme. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data Privacy is protected. DeleteMe's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your Delete Me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K DOGE's unchecked access to federal networks sparks major cybersecurity fears Senator Hawley's AI ban targets China and raises free speech concerns Apple Service Ticket portal vulnerabilities exposed millions of users data North Korea's Flexible Ferret malware targets macOS via job scams and fake Zoom apps February 2025 Android Security Update fixes 48 vulnerabilities, including an exploited zero day. A Grubhub data breach exposes customer and driver information Abandoned cloud infrastructure creates major security risks Texas is going to launch its own Cyber Command. Dell Power Protect vulnerabilities pose critical security risks on our Threat Vector segment, David Moulton and his guests look at the potential dangers of Deep Seek. The US Government is quietly altering the Head Start database and a moment of inspir inspiration from a space faring poet. It's Tuesday, February 4th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It is great to have you with us. Elon Musk's Department of Government Efficiency Doge has been given unprecedented access to sensitive federal networks, raising severe cybersecurity concerns. Experts warn that allowing Doge workers, many young and inexperienced, to plug personal computers into systems like the Office of Personnel Management and Treasury Department creates massive security risks, including potential breaches by foreign adversaries. Experts like Jason Kitka, former U.S. cyber Command official, say this could be the largest government security breach in history. Doge has unchecked access to OPM's background check and clearance records, Treasuries trillions in payments and systems at usaid. The New York Times also reports Musk aides requested access to Medicare and Medicaid financial systems. Security professionals highlight the lack of oversight. Doge workers may be bypassing cybersecurity controls, using unauthorized devices and storing sensitive data improperly. China and other foreign adversaries are likely watching for vulnerabilities. Experts emphasize that random individuals should not be granted access to federal networks, warning that Musk's actions may have long term security consequences. Senator Josh Hawley, Republican from Missouri, has introduced the Decoupling America's Artificial Intelligence Capabilities from China act, which would criminalize importing, exporting or collaborating on AI with China. The bill would impose up to 20 years in prison and a $1 million fine for knowingly downloading Chinese developed AI models such as Deepseek, which recently surged in popularity. Critics argue the bill stifles scientific collaboration and threatens free speech. Kevin Bankston from the center for Democracy and Technology warns it could penalize AI researchers who publish openly, while the Electronic Frontier foundation says it favors big tech monopolies over open AI research. The bill also bans US Companies from investing in Chinese AI and criminalizes research partnerships with Chinese entities, potentially disrupting AI development in the US Though seen as political posturing, bipartisan support for China related bans suggests legislation like this could gain traction despite its far reaching implications. A critical security flaw in Apple's service ticket portal exposed millions of users sensitive data due to a combination of insecure direct object reference and and privilege escalation vulnerabilities. Researcher Virtuville discovered the issue when submitting a repair ticket and found he could access other users service tickets, Mac serial numbers, IMEI numbers and personal details. By modifying a URL parameter, he bypassed authentication and gained admin access, potentially allowing attackers to alter repair appointments or access customer databases. The lack of rate limiting worsened the risk, enabling automated data harvesting. Apple patched the flaw after disclosure through its Bug Bounty program, reinforcing authorization checks and implementing rate limiting. A new North Korean macOS malware Flexible Ferret is spreading through fake zoom apps, job scams and GitHub bug reports. Linked to the Contagious interview campaign, it tricks job seekers and developers into installing it by disguising itself as legitimate software updates. Discovered by Sentinel Labs, the malware uses a dropper to install itself unnoticed, creates fake zoom apps and establishes persistence after system reboots. Initially signed with a valid Apple developer certificate. It bypassed security checks before Apple revoked it. Flexible Ferret shares code similarities with Chrome update malware but has evolved to evade Apple's XProtect security tool. The February 2025 Android Security Update patches 48 vulnerabilities, including a zero day privilege escalation flaw in the Android kernel's USB video class driver. Actively exploited in the wild, this flaw allows local attackers to elevate privileges through low complexity attacks, potentially leading to arbitrary code execution or system crashes. Another critical flaw affects Qualcomm's WLAN component, enabling remote code execution due to improper validation of array indexes. Attackers could modify memory, execute commands, or crash devices without user interaction. Google has released two security patch levels, with Pixel devices receiving immediate updates, while other manufacturers may take longer to deploy fixes. Grubhub has disclosed a data breach caused by a compromised third party contractor account exposing customer merchant and driver data. The breach linked to unauthorized access within a customer support provider's systems, prompted grubhub to revoke access and launch an investigation. Exposed data includes names, emails, phone numbers, hashed passwords and partial payment details. For some users, however, full payment card numbers, Social Security numbers and bank details were not accessed. The incident highlights supply chain security risks as attackers increasingly target third party vendors to bypass direct security controls, Grubhub says they've strengthened defenses. They're rotating credentials and enhancing anomaly detection and improving vendor risk management to prevent future breaches. An investigation by Watchtower revealed that abandoned Amazon S3 buckets once used by governments, Fortune 500 companies and cybersecurity firms still receive sensitive data requests, posing serious security risks. Over four months, researchers took control of 150 neglected AWS assets, which were still being pinged by organizations worldwide for software updates, system configurations and critical infrastructure files. Attackers could hijack these assets to launch supply chain attacks, distribute malware or steal credentials. Examples include an abandoned CISA advisory S3 bucket, which could have been misused to distribute malicious patches, and outdated SSL VPN configurations, allowing attackers to impersonate users. The research underscores systemic weaknesses in cloud security, emphasizing that abandoned cloud resources without proper decommissioning leaves organizations vulnerable. AWS has since sinkholed the compromised infrastructure, but Watchtower warns that these issues persist across the industry, making neglected cloud assets a growing cybersecurity threat. Texas governor Greg Abbott announced plans to establish the Texas Cyber Command to combat the growing wave of cyberattacks targeting the state, highlighting recent attacks on a city, hospital and business. Abbott warned of threats from China, Russia and Iran. Headquartered in San Antonio. The command will anticipate threats, coordinate incident response and support post attack investigations. It will also focus on cybersecurity training and awareness. Texas, a major economic and military hub, remains a lucrative target for cybercriminals and nation state actors. No official launch date has been set. Dell Technologies has disclosed multiple critical vulnerabilities affecting its PowerProtect product line, including data domain appliances and PowerProtect Management Center. These flaws, with CVSS scores up to 9.8, could enable privilege escalation, arbitrary code execution and system compromise. Key vulnerabilities include an arbitrary code execution flaw and another which impacts Docker's MOBI project. Exploits could allow remote attacks with minimal privileges. Dell urges organizations to update, implement network segmentation and monitor systems for suspicious activity. A story from 404 Media examines a quiet but deliberate shift where software engineers managing a government database for the Department of Health and Human Services Head Start program have been tasked with systematically removing references to diversity, equity and inclusion. The effort, part of a project called Remove dei, aligns with Trump's executive orders restricting any mention of race or gender in federal agencies. The Updates visible in GitHub commits reveal discussions among engineers on how best to eliminate forbidden words from the system. This includes removing the ability to search for or filter programs that support families affected by systemic discrimination. Though thousands of government data sets are disappearing from the Internet, even those that remain are being subtly altered, undermining their original purpose without public awareness. Head start, which spends $12 billion annually to help disadvantaged children prepare for school, has already faced uncertainty under Trump's spending freezes. Now its tracking systems are being stripped of key tools used to evaluate program effectiveness for marginalized communities. The coding changes were executed by Ad Hoc LLC, a government contractor paid $7.2 million to manage the database. Internal messages show engineers asking colleagues to scan for other forbidden words to delete. HHS declined to comment, citing a pause on public communications under the new administration. These database alterations are part of a larger Trend. With over 2,000 datasets disappearing from data.gov and federal scripts, actively removing gender pronouns from employee emails, the erasure of DEI language is happening quietly, but at a sweeping scale. Coming up after the break on our Threat Vector segment, David Moulton and his guests look at the potential dangers of deep seek and a moment of inspiration from a space faring poet. Stay with us. Foreign cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. In this segment from the Threat Vector podcast, host David Moulton sits down with Sam Rubin, senior vice president of consulting and threat intelligence at unit 42, and Kyle Wilhoit, director of threat research, to explore the vulnerabilities of Deep seq, the new large language model from China. Foreign.