Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K.
Dave Buettner (0:12)
Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try DeleteMe. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today, get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K is DOGE a cyber attack Against America the White House plans to nominate a new National Cyber Director. We got some patch Tuesday Updates Avanti discloses a critical stack based buffer overflow vulnerability. The GAO identifies cybersecurity gaps in the US Coast Guard's efforts to secure the maritime transportation system. Arizona woman pleads guilty to running a laptop farm for North Korea. A notorious swatter gets a prison sentence. Our guests are Gianna Witfer and Maria Velasquez, co hosts of the Breaking through in Cybersecurity Marketing podcast and plagued themed phishing tests. Take it Too far it's Wednesday, February 12, 2024. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. In an editorial for Foreign Policy, Bruce Schneier and Davi Ottenheimer make the case that Elon Musk's Doge team represents a serious cyberattack against America. The editorial highlights what may be the most alarming national security crisis in modern US History. Not due to foreign cyber attacks, but because of unchecked internal access granted under dubious authority. The newly created Department of Government Efficiency, led by individuals with unclear credentials, has infiltrated critical government systems, including the Treasury Department, opm, and even classified intelligence networks. These intrusions have exposed vast amounts of sensitive data and fundamentally weakened national cybersecurity defenses. What sets this apart from previous breaches is not just the scale, but the method. Unlike adversaries who spend years infiltrating systems in secrecy, DOGE personnel have been granted high level access in plain sight, stripping away essential security safeguards. Career officials responsible for protecting these systems have been sidelined and critical protections like auditing and incident response have been dismantled. The editorial argues that this is more than just reckless mismanagement. It's a systematic gutting of national security protocols. The Treasury's financial infrastructure, the identities of intelligence personnel and even AI trained on sensitive data are now potentially compromised. Worse, unauthorized modifications to core systems could leave lasting vulnerabilities, paving the way for future exploitation by foreign adversaries. A federal judge has intervened, but that alone won't undo the damage. The piece calls for immediate action, revoking unauthorized access, restoring security protocols and conducting rigorous audits. Without these steps, the editorial warns, the US Government risks long term structural damage to its most essential systems, damage that may already be irreversible. President Donald Trump plans to nominate Sean Keirncross as the next National Cyber Director, despite his lack of cybersecurity leadership experience. Cairncross, a longtime GOP insider, previously served as the CEO of the Millennium Challenge Corporation and held senior roles within the Republican National Committee. If confirmed, he would lead the White House's Office of the National Cyber Director, which was created in 2021 to oversee U.S. cyber strategy. The Biden administration's approach to ONCD was marked by leadership turnover and concerns about competing power centers. Observers worry the Trump administration may downsize the office even as the US faces growing cyber threats from China linked hacking campaigns. Cairn Cross would replace Harry Coker, who recently left for Maryland's Commerce Secretary role. Yesterday was Patch Tuesday. Microsoft has released security updates for four new zero day vulnerabilities, including two actively exploited flaws. The February Patch Tuesday Update covers over 50 CVEs, including 22 remote code execution bugs and 19 privilege escalation vulnerabilities. Among the most concerning is one which allows attackers to delete critical system files and escalate privileges, potentially crippling servers. Another affects Windows networking and grants system level access, enabling attackers to manipulate security settings and execute malicious code. Intel issued 34 security advisories, including a critical privilege escalation flaw in server board BMC firmware. AMD addressed multiple high severity vulnerabilities in processors, graphics drivers and its system management mode, while Nvidia patched security flaws in its GPU software and container toolkit. Siemens and Schneider Electric also released updates for industrial control system vulnerabilities, with major cyber threats ongoing. All These updates emphasize the need for organizations to promptly patch critical systems to prevent exploitation. Avanti has disclosed a critical stack based buffer overflow vulnerability in its Connect secure product. Rated 9.9 on the CVSS scale, the flaw allows remote authenticated attackers to execute arbitrary code. Ivanti urges users to update immediately or implement interim measures like network segmentation and log monitoring. While no active exploitation is reported, past Ivanti vulnerabilities have been targeted by APT groups, emphasizing the need for prompt patching. The Government Accountability Office has identified cybersecurity gaps in the US Coast Guard's efforts to secure the maritime transportation system, and they've issued five recommendations. The Coast Guard must improve incident data accuracy, enhance cyber deficiency tracking, align its strategy with national goals, and address competency gaps in cybersecurity personnel. Gao's findings, based on reports, inspections and stakeholder interviews from 2019 through mid-2024, highlight threats from state sponsored actors like China, Iran, North Korea, and Russia, as well as cybercriminals. Past attacks have disrupted port operations and future incidents could have severe consequences. The Coast Guard assists MTS operators with cybersecurity guidance, inspections and technical support, but lacks a complete cybersecurity incident tracking system. GAO also found gaps in its cyber strategy and workforce competencies. The Department of Homeland Security concurred with gao's recommendations, emphasizing the need for urgent improvements to prevent cyber attacks on critical maritime infrastructure. Christina Marie Chapman, age 48, of Arizona, pleaded guilty to running a laptop farm that helped North Korean IT workers fraudulently gain employment at over 300 US companies from 2020 to 2023. She helped North Koreans steal identities of over 70Americans, making it appear they were US based while working remotely from China, Russia and other countries. The scheme generated over $17 million, most of which was sent to North Korea's government. Chapman laundered the funds by processing paychecks and transmitting false documents to U.S. agencies. The workers she assisted had ties to North Korea's weapons programs and attempted to gain employment at U.S. government agencies. Chapman faces seven to nine years in prison, with sentencing set for June 16. Her case is part of a broader FBI crackdown on North Korean IT fraud, which has led to extortion attempts and security breaches at US companies. Alan Fillion, aged 18, of Lancaster, California, was sentenced to 48 months in prison for making interstate threats, including over 375 swatting calls from 2022 through 24. His false threats targeted religious institutions, schools, government officials and individuals often claiming to have planted bombs or planned mass shootings. His actions led to armed law enforcement responses detentions and resource diversion. Fillion admitted to running a swatting for profit operation advertising his services online. He was arrested in January 2024 for a May 2023 threat to a Florida religious institution where he falsely claimed to possess weapons and planned a mass shooting. He also pleaded guilty to threats against a high school, a historically black college and a federal law enforcement officer. The FBI and U.S. secret Service investigated the case, with multiple law enfor agencies assisting. Coming up after the break, my conversation with Gianna Witfer and Maria Velasquez, co hosts of the Breaking through in Cyber Security Marketing podcast and plagued theme Phishing Tests Take it Too far. Stay with us.