Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K. We've all been there.
Rick Howard (0:15)
You realize your business needs to hire someone yesterday. How can you find amazing candidates fast?
Dave Bittner (0:22)
Well, it's easy.
Rick Howard (0:23)
Just use Indeed when it comes to hiring, Indeed is all you need. Stop struggling to get your job post noticed Indeed Sponsored Jobs helps you stand.
Dave Bittner (0:33)
Out and hire fast.
Rick Howard (0:35)
Your post jumps to the top of.
Dave Bittner (0:36)
Search results so the right candidates see it first. And it works.
Rick Howard (0:41)
Sponsored Jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed plus with Sponsored Jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data Worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility at indeed.com cyberwire just go to indee indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need.
Dave Bittner (2:01)
The White House is urging federal agencies not not to lay off cybersecurity teams. Google doesn't deny receiving a secret legal order from the UK government. Microsoft researchers identify a simple method to bypass AI safety guardrails. Scammers are impersonating the Clop ransomware gang. Cisco issues security advisories for multiple iOS XR vulnerabilities. CISO warns of multiple ICS security issues. A lock bit ransomware developer has been extradited to the U.S. gCHQ's former director calls for stronger cybersecurity collaboration. Rick Howard and Kim Jones pass the mic for the CISO Perspectives podcast and Sniffing out stingrays. It's Friday, March 14th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. We begin today with a quick correction. Earlier this week we reported on a security advisory from CISA highlighting vulnerabilities from Avanti and Veracor. I misspoke tagging Vera code in our reporting instead of Veracort. We regret the error and appreciate the kind note from the fine folks at Veracode bringing it to our attention. Turning to today's news, the White House is urging federal agencies not to lay off cybersecurity teams as they submit budget cut plans. US federal CIO Greg Barbaccia emphasized in an email that cybersecurity is national security and should be protected. The warning comes amid concerns that deep budget cuts mandated by President Trump and adviser Elon Musk could weaken national cyber defenses. Former NSA cybersecurity director Rob Joyce warned that mass layoffs would be devastating. The Musk led Department of Government Efficiency has also drawn criticism for granting unusually broad access to sensitive government data. At the Social Security Administration officials raised alarms about the security risks posed by Doge. Meanwhile, the Department of Homeland Security's CISA has already lost over 130 positions as of mid February. Elon Musk reportedly visited the NSA on Wednesday, meeting with leadership to discuss staff cuts and operations. The nsa, a key player in US cybersecurity and home to Cyber Command, is under Musk's scrutiny as he pushes for government downsizing. His visit signals potential changes to intelligence and cyber operations. While Musk recently called for an NSA overhaul, he hasn't detailed specific reforms. Intelligence officials are bracing for swift changes that could impact national cybersecurity. Google has refused to deny receiving a secret legal order from the UK government, raising concerns among US lawmakers. A bipartisan group in Congress fears that British authorities may be demanding access to encrypted messages from US tech companies. This follows reports that Apple received a similar order known as a technical capability notice, which it is reportedly contesting in a closed court hearing. Lawmakers criticize the secrecy surrounding these orders, arguing it hinders congressional oversight and threatens Americans Privacy. Under the UK's Investigatory Powers act, companies that receive a technical capability notice are barred from confirming it. Experts, including from Britain's intelligence community, have called for more transparency, with academics warning that the government's refusal to clarify the situation is unsustainable and unjustifiable. Microsoft researchers have identified a simple yet effective method to bypass AI safety guardrails called the Context Compliance Attack, or cca. Unlike complex prompt engineering techniques, CCA manipulates AI systems by injecting fabricated conversation history, making them perceive restricted content as a legitimate follow up request. This vulnerability affects major AI models including GPT, Claude Llama and Gemini, highlighting a fundamental flaw in systems that rely on client supplied chat history. Open source models are especially vulnerable as they cannot verify message authenticity. While stateless architectures improve scalability, they also allow attackers to manipulate context. Microsoft suggests mitigating this risk through cryptographic signatures and server side conversation. Tracking the attack's effectiveness underscores the need for a more comprehensive AI security strategy beyond traditional input filtering. Microsoft has made CCA available for research via its Pirate Toolkit. Barracuda researchers warn that scammers are impersonating the CLOP ransomware gang to extort businesses. Unlike real CLOP attacks, fake extortion emails lack key elements like payment deadlines, secure chat links and company names. These scams reference media reports about actual CLOP breaches to seem legitimate. Similar fraud tactics have been seen with Bean Lian ransomware impersonations. Cisco has issued security advisories for multiple iOS XR vulnerabilities highlighting a critical BGP confederation memory corruption flaw. With a CVSS score of 8.6. The bug allows remote attackers to cause denial of service by sending crafted BGP updates containing excessively long as Confed sequence attributes. This impacts multiple versions. Cisco has released patched versions and provided a workaround for restricting as path lengths. While no known exploits exist, organizations should update immediately or implement mitigation policies to prevent potential network wide disruptions. CISA has issued multiple ICS security advisories warning of critical vulnerabilities in Siemens, Philips and Sungrow products. These flaws affecting industrial control systems, include memory corruption, authentication, bypass privilege escalation and unauthorized file access. Key risks include remote code execution, data exposure and denial of service attacks across manufacturing, energy and healthcare sectors. CISA urges immediate updates, network segmentation and access restrictions to mitigate threats the US Justice Department announced the extradition of Rostislav Paniev, a Lockbit ransomware developer from Israel to the United States. Paniev, a Russian Israeli national, admitted to developing malware features that disable security software, spread infections and printed ransom notes. He worked for Lockbit from 2022 to 2024, earning over $230,000 in cryptocurrency. Lockbit, which extorted $500 million from over 2,500 victims worldwide, suffered a law enforcement takedown in 2024. The US has charged seven individuals offering rewards of up to $10 million for fugitives. Sir Jeremy Fleming, former GCHQ director, warns that geopolitical tensions and cyber threats are at an all time high, requiring stronger cybersecurity collaboration. Speaking at Palo Alto Network's Ignite event in London, he stressed the growing impact of nation state cyber attacks, ransomware and disinformation campaigns. Critical infrastructure attacks, mega breaches and covert cyber intrusions are increasing, with ransomware remaining the top cybercrime threat. While basic cybersecurity measures help against most threats, nation state attacks are harder to prevent. Fleming urged organizations to integrate geopolitical intelligence with cyber threat analysis and enhance cyber information sharing across the industry. He emphasized that no single company can combat threats alone, advocating for faster, broader collaboration to detect nation state cyber activity before it escalates. Coming up after the break, Rick Howard and Kim Jones pass the mic for the CISO Perspectives podcast and sniffing out Stingrays. Stick around.