Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network.
Danny Allen (0:04)
Powered by n2k.
Amazon Sponsor (0:10)
This episode is brought to you by Amazon. Sometimes the most painful part of getting sick is the getting better part. Waiting on hold for an appointment, Sitting in crowded waiting rooms, Standing in line at the pharmacy? That's painful. Amazon One Medical and Amazon Pharmacy remove those painful parts of getting better with things like 24. 7 virtual visits and prescriptions delivered to your door. Thanks to Amazon Pharmacy and Amazon One Medical Healthcare just got less painful.
Dave Bittner (0:46)
The Biden administration is finalizing an executive order to bolster US Cybersecurity Avante releases emergency updates to address a critical zero day vulnerability. A critical vulnerability is discovered in Krio Control firewall software. Palo Alto Networks patches multiple vulnerabilities in its retired migration tool. Fake exploits for Microsoft vulnerabilities lure security researchers. A medical billing company data breach affects over 360,000 a cyber attack disrupts the city of Winston Salem. CrowdStrike identifies a phishing campaign exploiting its recruitment branding. Our guest is Danny Allen, CTO from Sneak Sharing how a balanced approach between AI and human oversight can strengthen cybersecurity and the worst of the worst from CES it's Thursday, January 9th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us. It is great to have you with us here today. The Biden administration is finalizing an executive order to bolster U.S. cybersecurity in its final days following major breaches during Biden's term, including a Treasury Department hack attributed to the Chinese group Silk Typhoon. The order emphasizes strong identity authentication and encryption for government communications. This would protect sensitive information even if systems are breached by ensuring hackers cannot access encrypted documents. The treasury hack reportedly involves stolen digital keys from Beyond Trust, a third party provider granting access to unclassified sanctions related data. The executive order also proposes securing cryptographic keys via hardware security modules and tightening access management for federal contractors. Additionally, it mandates that software vendors demonstrate adherence to cybersecurity standards like fixing known vulnerabilities and using multi factor authentication. It's unclear if the incoming Trump administration will retain the order as Trump has signaled intentions to roll back federal regulations, including on artificial intelligence safeguards. Ivanti has released emergency updates to address a critical zero day vulnerability actively exploited by suspected Chinese nation state attackers. The flaw affects Ivanti Connect secure VPN devices and allows remote code execution. Avanti recommends factory resetting devices before applying the update to remove potential malware that may fake the update process. A second vulnerability, also a stack based Buffer overflow has a high severity rating but hasn't been exploited in the wild. Ivanti also warns that similar vulnerabilities exist in its Policy Secure and neurons for zero trust access gateways with patches expected by January 21. Attackers have used malware to block legitimate updates, creating a fake update facade. Ivanti credits Mandiant and Microsoft's Threat Intelligence center for discovering the flaws. The US CISA and the UK's NCSC urge immediate action, highlighting the risks to critical edge devices and advising organizations to review networks for signs of intrusion. A critical vulnerability in Karyo Control firewall software allows attackers to achieve one click remote code execution discovered by researcher Egidio Romano. The flaw stems from improper input sanitization in several interface pages, enabling HTTP response splitting and open redirect attacks, potentially leading to severe consequences like gaining root access to the firewall. Initially deemed low risk, it was reclassified as high severity with a CVSS of 8.8 due to exploitation potential via an older vulnerability GFI software. The vendor has been notified, but no patches are available yet. Palo Alto Networks has patched multiple vulnerabilities in its retired Expedition migration tool, including a high severity SQL injection flaw. This flaw allows authenticated attackers to access sensitive data such as usernames, passwords and device configurations and manipulate files on the system. Expedition, retired at the end of last year, will no longer receive updates or security fixes, and users are urged to find alternatives. The latest Expedition version resolves the flaw and four additional medium and low severity issues. Palo Alto also updated Prisma Access browser to address six Chromium vulnerabilities, including two critical flaws in the V8 JavaScript engine. While no exploitation has been reported for the latest vulnerabilities, CISA previously warned about critical Expedition flaws exploited in attacks. Users should restrict network access to Expedition or deactivate it if unused. Security researchers are being targeted again, this time with fake exploits for Microsoft vulnerabilities. Trend Micro identified a malicious version of a legitimate proof of concept exploit for LDAP Nightmare, a denial of service bug patched in December. The counterfeit POC replaces Python files with a malicious executable that delivers a PowerShell script which downloads malware to steal user data. LDAP nightmare highlights two critical vulnerabilities, including one with a severity of 9.8, but both significant due to LDAP's widespread use in Windows environments. While experienced researchers may spot red flags such as executables in Python projects, these lures still exploit trending issues to target a broader audience. This tactic follows a pattern of attackers targeting researchers, including incidents involving North Korean operatives. Previous cases have seen state sponsored attackers use social media deception, zero day exploits and backdoor tools to compromise experts at major tech firms. Medusynd, a U S based medical and dental billing company, suffered a data breach affecting over 360,000 individuals. Exposed data includes health insurance details, medical records, payment information, government IDs and contact information. Though impacted data varies per person, threat actors could exploit this information for medical identity theft or financial fraud. The breach, discovered in December of 2023, involves stolen files containing personal information. Medusynd has offered affected individuals 24 months of free credit monitoring and identity protection. The company, headquartered in Miami, Florida, serves thousands of healthcare providers across the US And India. Meanwhile, Excelsior Orthopedics, a New York based healthcare provider, experienced a ransomware attack in June of 2024, compromising the personal and health information of approximately 357,000 individuals. The breach affected patients and employees of Excelsior and related entities including Buffalo Surgery center and North Town's Orthopedics. Exposed data includes names, Social Security numbers, medical records, diagnosis and treatment details, and more. Initially thought to impact only employees, the breach's scope was later found to include patient data. The Monti ransomware gang claimed responsibility. Stealing 300 gigabytes of data now publicly available, Excelsior disconnected external access to its network and continues recovery efforts. Affected individuals have been offered 12 months of free credit monitoring and fraud assistance services. The company has not confirmed the specific type of attack but acknowledges significant data compromise. A post Christmas cyber attack disrupted online utility payment systems in Winston Salem, North Carolina, affecting a quarter of a million residents and nearby Forsyth county. Discovered on December 26, the attack forced the city to take systems offline, though fire and police services remain unaffected. Residents can pay bills in person without late penalties. City officials, working with state and federal agencies, have yet to restore full services. The attack coincides with severe weather communication challenges and follows similar incidents across North Carolina. The state prohibits government entities from paying ransoms under a 2022 law. Earlier this week, CrowdStrike identified a phishing campaign exploiting its recruitment branding to distribute malware. The attack uses phishing emails impersonating CrowdStrike recruitment to direct victims to a malicious site offering downloads of a fake employee CRM application. The downloaded executable, written in Rust, acts as a downloader for the cryptominer XMRig. The malware employs evasion tactics such as debugger detection, process checks and sandbox avoidance. Before downloading and running XMRig, it establishes persistence by creating batch scripts in the Startup directory and adding registry entries to re execute on system logon. Victims are urged to verify the authenticity of CrowdStrike communications and avoid downloading unsolicited files. CrowdStrike emphasizes that it does not ask candidates to download software for interviews or process payments. Organizations should educate employees on phishing risks, monitor suspicious activity, and implement endpoint protection to mitigate these kinds of threats. Coming up next, we've got my conversation with Sneaks CTO Danny Allen about how a balanced approach between AI and human oversight can strengthen cyber security. And hear about worst in show, also known as when your fridge knows too much about you. We'll be right back.