Cracked and Nulled taken down. - CyberWire Daily

CyberWire Daily: “Cracked and Nulled Taken Down” – Episode Summary

Release Date: January 30, 2025
Host: Dave Bittner
Guest: Ellen Chang, Vice President of Ventures at BMNT and Head of H4X Labs

Major Law Enforcement Action Against Hacking Forums

The episode opens with significant news on the crackdown of two of the largest hacking forums, Cracked and Nulled. Authorities, led by Europol and the FBI, orchestrated a coordinated takedown across multiple countries, seizing 17 servers and arresting two suspects. These forums, boasting over 10 million users, were pivotal hubs for cybercriminal activities, including the distribution of stolen credentials, hacking tools, and cybercrime-as-a-service offerings. Europol highlighted their role as "entry points into cybercrime," facilitating operations like credential stuffing using tools such as OpenBullet and hosting advanced AI-based hacking utilities.

Key Details:

Domains Seized: 12, including cracked, nulled, stark, RDP, and celix.
Assets Confiscated: Over 50 electronic devices and approximately $312,000 in cash and cryptocurrency.
Impact: The FBI replaced the forums' name servers with FBI-controlled addresses, intending to leverage seized data for future investigations.

Vulnerability Found in Deepseek's Database

Cybersecurity firm Wiz uncovered a critical security lapse in Deepseek, an emerging AI startup known for its DeepSeek R1 reasoning model—a competitor to OpenAI's offerings. The research team discovered an open Clickhouse database exposed without any authentication barriers, granting full administrative access. This breach exposed over one million logs, including sensitive chat histories, API keys, and backend operations data.

Notable Quote:
Wiz emphasized the incident’s gravity, stating, “AI companies must prioritize security, just as cloud providers do, or risk exposing their users, their data, and their reputation.” (Timestamp: [05:30])

ChatGPT Jailbreaks Exploit Safety Filters

AI researcher David Kuzmar revealed a new jailbreak method named Time Bandit, which allows users to bypass ChatGPT’s safety mechanisms. This exploit manipulates the model’s temporal understanding, misleading it into believing it is operating in a different time frame to access restricted content related to weapons, malware, and nuclear topics. Despite reporting the vulnerability to OpenAI and multiple government agencies, Kuzmar faced delays in receiving a response. OpenAI has implemented partial fixes, but the exploit remains partially functional.

Notable Quote:
Kuzmar expressed frustration, saying, “My anxiety grew as the weeks passed,” highlighting the challenges in communicating critical security issues to large organizations. (Timestamp: [07:15])

Ransomware Attack Disrupts New York Blood Center

One of the largest US blood centers, New York Blood Center (NYBC), fell victim to a ransomware attack on January 26. The breach forced NYBC to shut down essential systems, disrupting blood donation processing and hospital supply chains during a critical blood shortage. The attackers remain unidentified, and it is unclear whether patient data was compromised. NYBC is actively working to restore operations without a definitive timeline.

South African Weather Service Hit by Cyberattack

A cyberattack disabled the South African Weather Service, impacting airlines, farmers, and neighboring countries like Mozambique and Zambia. The attack disrupted the agency’s website, email, and aviation and marine services, compelling the agency to provide updates via social media. This incident marks the second attempted attack within two days, with no ransomware group claiming responsibility. South Africa has been grappling with similar attacks on public institutions, including the Defense Department’s pension system and National Lab Services.

New Browser Sync Jacking Technique Unveiled

Researchers at SquareX disclosed a sophisticated attack method dubbed Browser Sync Jacking. This three-stage attack transforms a seemingly benign browser extension into a potent cyber weapon. The process involves:

Malicious Extension Installation: Authenticates the user into an attacker-controlled Google Workspace profile, disabling security settings.
Browser Takeover: Swaps legitimate downloads with malicious files, registering the browser as attacker-managed.
Device Hijacking: Grants attackers full control to record screens, capture audio, activate cameras, and install malware undetected.

Notable Quote:
SquareX warns, “Unless organizations start monitoring what extensions their employees install, this kind of attack could become a huge problem.” (Timestamp: [09:45])

TeamViewer Patches Critical Vulnerability

TeamViewer addressed a high-severity privilege escalation flaw that could allow local attackers to gain elevated privileges on Windows systems. The vulnerability affects multiple versions and has been patched in the latest updates. Although there is no evidence of active exploitation, TeamViewer urges immediate updating due to the tool’s frequent targeting by threat actors for malware deployment.

Advocacy for a National Data Privacy Law

Over three dozen industry groups have collectively urged the US Congress to enact a comprehensive national data privacy law, aiming to supersede existing state regulations. In their letter to the House and Senate Commerce Committee leaders, these groups argue that a unified standard would streamline business operations and reduce consumer costs. Key proposals include transparency requirements, consumer opt-out rights, and limitations on data collection, while exempting small businesses. Critics, however, contend that the proposed law may mirror weaker state protections and potentially diminish consumer safeguards.

Uncertain Future for CISA

The Cybersecurity and Infrastructure Security Agency (CISA), instrumental in safeguarding US election systems, now faces an uncertain future amidst political turmoil. Accusations from former President Donald Trump and his allies allege that CISA has been involved in censoring conservatives and meddling in the 2020 election, claims which CISA has denied. With Trump’s return to office, discussions are underway about restructuring or diminishing CISA’s role, including proposals to move it under the Transportation Department and limit its involvement in elections.

In-Depth Interview with Ellen Chang of BMNT

Brandon Karp engages in a comprehensive discussion with Ellen Chang, Vice President of Ventures at BMNT and Head of H4X Labs, focusing on the role of deep tech in national security and cybersecurity.

Key Insights:

Definition of Deep Tech: Chang differentiates deep tech from general AI, emphasizing hardware-oriented technologies and material sciences as critical components contributing to national security.
Supporting Startups: BMNT assists government-funded startups in transitioning their research into commercial products. Chang highlights the challenges inventors face in adopting entrepreneurial skills to scale their technologies effectively.
Supply Chain Innovations: Chang expressed enthusiasm about the ongoing efforts to reinvigorate US manufacturing and supply chains, positioning it as a cornerstone of national security. She noted, “We’re re-industrializing, we’re regrowing our capability to manufacture...” (Timestamp: [26:39])
Venture Capital Dynamics: The conversation touched on the evolving landscape of venture capital, with some funds extending their investment horizons beyond the typical 10-year cycle to better support long-term deep tech projects.

Notable Quote from Chang:
“Venture capitalists don't want their companies to become a project-based company.” (Timestamp: [21:37])

OpenAI’s Controversial Stance on Deepseek

The episode concludes with a critical analysis of OpenAI's recent complaints against Deepseek, alleging that Deepseek improperly utilized OpenAI’s models to train its AI systems. Jason Kobler of 404 Media highlights the irony in OpenAI’s stance, considering the company’s reliance on scraping vast amounts of data without explicit permissions—practices Deepseek similarly employs.

Notable Quote:
Kobler remarks, “If that's not the pot calling the kettle black, I don't know what is.” (Timestamp: [30:45])

Conclusion

This episode of CyberWire Daily provides a comprehensive overview of significant cybersecurity developments, from major law enforcement actions against cybercriminal forums to vulnerabilities in prominent AI startups. The in-depth interview with Ellen Chang sheds light on the symbiotic relationship between deep tech innovation and national security, while the closing segment critiques the contentious dynamics within the AI industry. Listeners are left with a robust understanding of the current cybersecurity landscape and the intricate challenges it faces.

For more detailed analyses and updates, visit The Cyberwire Daily Briefing or subscribe to the CyberWire Daily podcast.

Transcript

Dave Bittner (0:02)

You're listening to the Cyberwire Network, powered by N2K.

Brandon Karp (0:11)

Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect. Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com International law enforcement takes down a pair of notorious hacking forums Wiz discovers an open Deepseek database Time bandit jailbreaks chatgpt ransomware hits one of the largest US Blood centers. A cyber attack takes the South African weather service offline. Researchers describe a new browser sync jacking attack. TeamViewer patches a high severity privilege escalation flaw. Over three dozen industry groups urge Congress to pass a national data privacy law. CISA faces an uncertain future. N2K's Brandon Karf speaks with Ellen Chang, vice president of ventures at BMNT and head of H4X Labs and OpenAI cries foul after getting a taste of its own medicine. It's Thursday, January 30th, 2020. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Happy Thursday and thank you for joining us here today. It is great as always to have you with us. Authorities have dismantled two of the largest hacking forums, Cracked and Nulled in operation talent, seizing 17 servers and arresting two suspects. With over 10 million users, these forums served as hubs for cybercriminal activity, offering stolen credentials, hacking tools, and cybercrime as a service. Europol described them as entry points into cybercrime, providing configs for credential stuffing tools like OpenBullet and hosting AI based hacking tools. In a coordinated effort across multiple countries, authorities seized 12 domains, including cracked, Nulled, Stark, RDP and celix, the latter two being integral to the forum's operations. Law enforcement searched seven properties, confiscating over 50 electronic devices and $312,000 in cash and cryptocurrency. The FBI took over the domains, replacing their name servers with FBI controlled addresses. The seized data, including email and IP addresses, will aid future investigations. While forum staff acknowledged the takedown, law enforcement emphasized its impact on disrupting cybercriminal infrastructure. It started with a routine scan. The Wiz research team was mapping deepseaq's external attack surface. Nothing unusual for cybersecurity researchers. Deepseek, after all, was making waves with its DeepSeek R1 reasoning model, a rival to OpenAI's best. But quickly the team stumbled upon something alarming an open Clickhouse database, completely exposed, no passwords, no authentication, just sitting there waiting to be accessed with a simple query. The researchers found themselves staring at over 1 million logs filled with chat history, API keys, backend operations, and other sensitive data. Worse, the database allowed full administrative control, meaning an attacker could not just read but potentially alter or escalate privileges within deepsea's systems. Realizing the gravity of the situation, the Wiz team immediately reported the issue. Deepseek responded swiftly, locking down the exposure. But the incident highlighted a growing AI startups are scaling fast, often without proper security measures. While the world worries about AI's long term risks, the real dangers are often much accidental data leaks like this one. AI companies must prioritize security, just as cloud providers do, or risk exposing their users, their data, and their reputation. AI researcher David Kuzmar made a chilling Time Bandit, a jailbreak that lets users bypass ChatGPT's safety filters to access dangerous instructions on weapons, malware, and even nuclear topics. The flaw exploits ChatGPT's temporal confusion, tricking it into thinking it's in the past while using modern knowledge. Realizing the severity, Kuzmar frantically tried to alert OpenAI, but struggled to find a direct contact. Even after reaching out to cisa, the FBI and government agencies, he was met with silence. He says his anxiety grew as the weeks passed. Eventually through CERT Coordination Center, OpenAI was contacted, confirming the exploit. While OpenAI has implemented partial fixes, the jailbreak still works in some cases. The New York Blood center nybc, one of the largest US Blood centers, has suffered a ransomware attack, causing service disruptions detected on January 26, the breach forced NYBC to take systems offline, affecting blood donation processing and hospital supply chains. The attack comes amid a blood emergency with supplies at dangerously low levels. NYBC is working to restore systems but has no clear timeline. It's unknown who's behind the attack or if patient data was compromised. A cyberattack has taken the South African Weather Service offline, disrupting critical weather services for airlines, farmers and regional allies like Mozambique and Zambia. The attack, which began Sunday evening, took down the weather service's website, email systems and aviation and marine services, forcing the agency to share updates via social media. This marks the second attempted attack in two days with no ransomware group claiming responsibility. South Africa has faced numerous cyber attacks on public institutions, including its Defense Department pension system and National Lab Services. The Weather Service is working with ICT service providers to restore systems, but has no timeline for full recovery. Imagine installing what seems like an innocent browser extension only to unknowingly hand over full control of your browser data and even your device to an attacker. That's exactly what researchers at squarex have uncovered in a new technique they're calling browser sync jacking. It's a three stage attack that turns a simple extension into a full scale cyber weapon. First, a user, maybe an employee, installs a malicious extension. That extension silently authenticates them into an attacker controlled Google workspace profile, allowing hackers to disable security settings and make changes to the browser. Next, they take over the entire browser. The extension waits for a normal download, then swaps it out for a malicious file. That file registers the victim's Chrome browser as managed by the attacker, giving them full control and finally, device hijacking. The attacker can now use the compromised browser to record screens, capture audio, turn on cameras, and even install malware without the user even knowing. The researchers say there's no easy way to track or stop it. Traditional security tools like EDR and secure Web Gateways simply don't catch these kinds of browser based attacks. SquareX is calling this a massive blind spot in enterprise security, and unless organizations start monitoring what extensions their employees install, this kind of attack could become a huge problem. TeamViewer has patched a high severity privilege escalation flaw that could allow local attackers to gain elevated privileges on Windows systems. The vulnerability affects multiple versions and has been fixed in the latest updates, although there's no evidence of exploitation in the wild. TeamViewer urges users to update immediately as threat actors have previously abused TeamViewer for malware deployment. The flaw was reported via Trend Micro's Zero Day Initiative. Security experts warn that remote Access tools like TeamViewer can increase the attack surface, especially in industrial and operational technology environments, making regular updates crucial. Over three dozen industry groups are urging Congress to pass a national data privacy law that would override state regulations. In a letter to House and Senate Commerce Committee leaders, they argue that a unified standard would help businesses operate more efficiently and lower consumer costs. Despite bipartisan interest. Past privacy bills have failed due to disagreements over preempting state laws and allowing individuals to sue over violations. If enacted, federal law could replace strong state protections such as California's privacy law and Illinois's biometric data rules. The letter, backed by big tech and automotive groups, does not mention data brokers. It proposes transparency requirements, consumer opt out rights and limits on data collection, but exempts small businesses. Critics warn the proposal mirrors weaker state laws and could reduce consumer protections rather than strengthen them. The cybersecurity and infrastructure security agency has played a major role in protecting election systems across the US but now its future is uncertain. Since its creation in 2018, CISA has worked with state officials to strengthen voting security. But President Donald Trump and his allies have criticized the agency, accusing it of censoring conservatives and interfering in the 2020 election. CISA denies these claims. Now, with Trump back in office, there's no clear leader for the agency. His Homeland Security secretary, Kristi Noem, has suggested reining in CISA's authority, and a Republican policy plan, Project 2025, proposes moving CISA to the Transportation Department and limiting its role in elections. Many state officials say CISA has been critical in improving election security. But as political battles continue, the question will CISA's mission change before the next? Coming up after the break, N2K's Brandon Karp speaks with Ellen Chang, vice president of ventures at VMNT and head of H4X Labs. And OpenAI cries foul after getting a taste of its own medicine. Stay with us.