Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. Hey everybody, Dave here. I've talked about Deleteme before and I'm still using it because it still works. It's been a few months now, and I'm just as impressed today as I was when I signed up. Deleteme keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. Delete Me also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special 20% off your delete me plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K Google issues an emergency patch for a high severity Chrome browser flaw researchers bypass BitLocker encryption in minutes. A massive Chinese language black market has shut down. The CFPB cancels plans to curb the sale of personal information by data brokers. A cyber espionage campaign called Operation Round Press targets vulnerable webmail servers. Google warns that Scattered Spider is now targeting US Retail companies. The largest steel maker in the US shut down operations following a cybersecurity incident. Our guest is Devin Ertel, chief information security officer at Menlo Security, discussing redefining enterprise security and the long and the short of layoffs. It's Thursday, May 15, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It's great as always to have you with us. Google has issued an emergency patch for a high severity Chrome browser flaw that could allow full account takeovers. Discovered by Solid Lab researcher Sevilod Kokorin, the bug stems from weak policy enforcement in Chrome's loader component, letting attackers leak sensitive cross origin data via malicious HTML. This can expose oauth tokens through manipulated referrer policies, especially dangerous in authentication flows. Google confirmed a public exploit exists, implying possible active use. The fix is rolling out in the latest Chrome version across platforms. Users should update manually or let Chrome auto update on restart. This follows a March patch for another critical Chrome zero day, used in espionage attacks targeting Russian entities with which exploited Chrome sandbox bypasses to deliver malware A newly revealed flaw in Microsoft BitLocker allows attackers to bypass encryption in under five minutes using a software only method called BitPixie. The exploit targets systems without pre boot authentication and has a public proof of concept available. Unlike hardware based hacks, bitpixie extracts bitlocker's volume master key entirely through software or by exploiting a flaw in the Windows bootloader during PXE soft reboots, two attack versions for Linux and Windows PE allow access using signed components with no need for physical tampering or a full disk image. The attack is stealthy and effective on unattended or stolen devices. Experts strongly advise enabling pre boot authentication to block access to the VMK and prevent such breaches. A massive Chinese language black market for crypto scams and money laundering, known as Huawang Guarantee, has shut down after Telegram banned thousands of related accounts. This underground marketplace operated openly on Telegram, facilitating over $27 billion in illicit transactions, mainly using tether. Vendors offered services like money laundering, victim data and even tools used in forced labor at scam compounds Southeast Asia. The takedown followed an investigation by crypto tracing firm Elliptic and media inquiries by Wired. Another market, Jinbe Guarantee, was also banned but may attempt to relaunch. Telegram's crackdown is seen as a major victory against online fraud, though experts warn these groups may shift to other platforms. The operation's ties to powerful Cambodian elites underscores the challenge of dismantling such networks elsewhere. German police have seized the crypto platform Exch, also called Exchange, and over $30 million in digital assets linked to money laundering in the $1.46 billion Bybit hack. Authorities acted swiftly after Exchange announced plans to shut down amid pressure from law enforcement. The platform had rejected Bybit's request to freeze stolen funds later traced by Elliptic to North Korea's Lazarus group. Launched in 2014, Exchange processed about $1.9 billion in crypto and operated on both the Clearnet and Darknet. The Consumer Financial Protection Bureau has withdrawn a proposed rule aimed at curbing data brokers from selling sensitive personal information without consent. Initially introduced to combat commercial surveillance and protect national security, the rule would have required brokers to obtain consent before sharing data like Social Security numbers and financial histories. Acting CFPB Director Russell Vaught said the move aligns with revised policies and interpretations of the Fair Credit Reporting Act. Critics, including privacy advocates and veterans groups, argue the rollback protects corporate interests at the expense of public safety and national security. They warn that data brokers continue to endanger Americans, particularly military personnel, by enabling scams surveillance and blackmail. The rule's cancellation follows a broader downsizing of the CFPB under President Trump's administration and pressure from fintech industry lobbyists across the pond. The Belgian Court of Appeal has ruled the transparency and consent framework used by Google, Amazon, Microsoft and others to justify online tracking is illegal under the GDPR. The court upheld a 2022 decision by the Belgian Data Protection Authority confirming multiple violations, including failures to secure data, properly obtain consent and ensure transparency. The transparency and consent framework underpins the tracking heavy real time bidding advertising system and active on 80% of the web. Critics led by Dr. Johnny Ryan of the Irish Council for Civil Liberties say tech firms use deceptive consent pop ups to mask widespread data misuse. The ruling applies across Europe and pressures the ad industry to move away from surveillance based models. The court also found IAB Europe, which created the tcf, violated gdpr, although not for actions within the RTB protocol itself. A cyber espionage campaign called Operation Roundpress, likely run by the Sednit Group, Also known as APT28 or Fancy Bear, is targeting vulnerable webmail servers like Roundcube, Horde, Mdamon and Zimbra to steal sensitive email data. Researchers from Welive Security reveal attackers use spear phishing emails to exploit cross site scripting flaws, including a zero day in mdamon. The payloads, dubbed spypress, steal credentials, emails and contact lists and can bypass two factor authentication. Some even set up malicious mail forwarding rules for persistent access. Targets are primarily defense and government entities in Ukraine, Eastern Europe and globally. Spy press variants are obfuscated and communicate with hard coded CNC servers. The campaign underscores the continued targeting of outdated or unpatched webmail systems and cyber espionage, particularly during times of geopolitical tension like the war in Ukraine. Security experts urge regular patching and phishing awareness to mitigate these risks. Google warns that hackers tied to the Scattered Spider group known for crippling UK retailers like M&S, are now targeting US retail companies. These attackers are skilled at bypassing strong cybersecurity defenses and tend to focus on one industry at a time. Scattered Spider has also been linked to past breaches of MGM Resorts and Caesars Entertainment. US Retail security groups are actively monitoring the threat, with Google helping coordinate briefings to prepare major companies like Costco, McDonald's and Lowe's. The largest U.S. steelmaker, Nucor temporarily shut down some operations following a cybersecurity incident involving unauthorized access to its IT systems. The company activated its incident response plan, took affected systems offline and is working to restore operations while Nucor didn't specify which facilities were impacted. It emphasized the shutdown was precautionary. With 300 sites and 25,000 employees, Nucor is a major global player. Coming up after the break, my conversation with Devin Ertel, chief information security Officer at Menlo Security. We're discussing redefining enterprise security and the long and the short of layoffs. Stay with us. And now a word from our sponsor, Threat Locker. Keeping your system secure shouldn't mean constantly reacting to threats. ThreatLocker helps you take a different approach by giving you full control over what software can run in your environment. If it's not approved, it doesn't run. Simple as that. It's a way to stop ransomware and other attacks before they start without adding extra complexity to your day. See how ThreatLocker can help you lock down your environment at www.threatlocker.com.