Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Deleteme. I have to say, Deleteme is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data Privacy is protected. DeleteMe's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K a major employee screening provider discloses a data breach affecting over 3.3 million people signal considers exiting Sweden over a proposed law that would give police access to encrypted messages House Democrats call out Doge's negligent cybersecurity practices Critical vulnerabilities in Rsync allows attackers to execute remote code. The class action lawsuit claims Amazon violates Washington state's privacy laws. CISA warns that attackers are exploiting Microsoft's Partner center platform. A researcher discovers a critical remote code execution vulnerability in Mitre's Caldera security training platform. An analysis of CISA's JCDC AI Cybersecurity Collaboration Playbook. Beniellen explains Apple pulling iCloud end to end encryption in response to the UK government and a Disney employee's cautionary tale. It's Wednesday, February 26th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here. It is great to have you with us. Texas based DISA Global Solutions, a major employee screening provider, has disclosed a data breach affecting over 3.3 million people. Disa, which serves 55,000 customers with background checks and drug testing, reported that hackers accessed ITS systems from February 9 through April 22, 2024. The breach exposed names, Social Security numbers, driver's licenses, financial data and more. DISA conducted an extensive review to identify affected individuals and is offering one free year of credit monitoring. The company has not found evidence of data misuse and has not confirmed if ransomware was involved. No cybercriminal group has claimed responsibility. House Democrats have urged President Trump to halt Elon Musk's Department of Government Efficiency due to negligent cybersecurity practices that could expose sensitive federal systems to cyber threats. Lawmakers warned that Doge's reckless actions, including accessing networks at the Treasury Office of Personnel Management and Energy Department's nuclear programs, have created security risks. Many Doge members lack government experience and have disrupted agencies, prompting legal challenges and congressional outcry. A group of 21 DOGE employees formerly from the US Digital Service resigned in protest, refusing to compromise government security. Lawmakers led by Representative Gerry Connolly have requested a briefing by March 11 to assess cybersecurity violations. Meanwhile, a U.S. district Court judge blocked the Doge team from accessing treasury payment systems, citing a rushed and flawed approval process under the Trump administration. Judge Jeanette Vargas ruled that Democratic attorneys general were likely to succeed improving treasury act illegally. She criticized the agency's chaotic handling of security risks and noted serious lapses in training and oversight. Signal is considering exiting Sweden over a proposed law that would allow police to access encrypted messages retrospectively. Signal CEO Meredith Whitaker stated that complying would require breaking encryption, undermining the app's core purpose. If passed, the law would take effect in 2026. Sweden's Police and Security services support the bill, but the Swedish armed forces oppose it, warning it would introduce security vulnerabilities. Brigadier General Matthias Hansen even endorsed Signal for non classified military communications. This follows a similar standoff in the uk, where Signal and Meta opposed encryption backdoors in the Online Safety act, leading the government to back down. Recently, the UK also pressured Apple to remove iCloud end to end encryption. Security experts warn that such government demands undermine global security and user privacy. Critical vulnerabilities in rsync versions 3.2.7 and earlier allow attackers to execute remote code, exfiltrate sensitive data, and bypass security controls. The most severe flaw is a heap buffer overflow in checksum handling, enabling memory corruption. Attackers can also bypass address space layout randomization and exfiltrate client files using checksum brute forcing. Additionally, symbolic link exploits allow attackers to evade RSync's safe links protection. Combining these flaws enables full remote code execution, with researchers demonstrating exploitation on Debian 12's rsync3.2.7 daemon. Users must upgrade to rsync3.4 immediately, which patches these issues by implementing stricter bounds checking, stack buffer initialization, and improved path sanitization. Administrators should disable anonymous access and enforce safe links for untrusted connections to prevent breaches. A proposed federal class action lawsuit alleges Amazon's software development kit illegally collects and sells sensitive user data, violating Washington's My Health My Data Act. Plaintiff Cassandra Maxwell claims Amazon's SDK, embedded in thousands of mobile apps, tracks location and biometric data without user consent. Filed on February 20, this is the first lawsuit invoking the My Health My Data act since it took full effect in 2024. Maxwell alleges Amazon's data collection could reveal health related searches or visits. The lawsuit seeks damages, penalties and injunctive relief. Amazon denies the claims, stating it prohibits partners from sharing health or precise location data and discards any mistakenly received information. Legal experts predict more lawsuits under the My Health My Data act with implications for healthcare and app developers. CISA issued an urgent advisory warning that attackers are exploiting a critical privilege escalation flaw in Microsoft's Partner center platform. The vulnerability allows unauthenticated attackers to gain elevated privileges, potentially accessing sensitive data and spreading malware. Initially rated 8.7 on the CVSS scale, it was later upgraded to 9.8 due to its severity. Microsoft has patched the issue automatically, but CISA mandates federal agencies to apply updates by March 18th. Organizations are urged to enforce network segmentation, audit access controls and adopt zero trust principles. The flaw's impact on Microsoft's partner ecosystem raises supply chain security concerns. CISA advises businesses to follow cloud security best practices and monitor Microsoft advisories. A critical remote code execution vulnerability in mitre's Caldera security training platform has been discovered affecting all versions since 2017 except the latest patched release. Security researcher Dawoud Kulakowski urges users to update immediately as the flaw allows attackers to hijack the platform remotely, particularly in default configurations. Caldera, widely used for adversary emulation, relies on Go, Python and GCC conditions often met in real world setups. The vulnerability exploits an unauthenticated API endpoint, allowing attackers to manipulate Manx and sandcat agents via crafted HTTPs requests. Developers were aware the endpoint lacked authentication, heightening the risk. Kulakowski published a partial proof of concept while omitting key details to prevent easy exploitation. Users should apply patches or restrict access to prevent unauthorized attacks. In an editorial for CyberScoop, cybersecurity expert Sam Kinch discusses the growing threat of AI driven cyberattacks and the importance of the JCDC AI Cybersecurity Collaboration Playbook, recently released by cisa. Kinch is currently an executive client advisor at Tanium and previously served as director of the Department of Homeland Security's Technical Security Team and as a senior executive to the commander at U.S. cyber Command. He argues that as adversaries weaponize AI, defenders must respond in kind, leveraging AI for security while improving coordination between public and private sectors. Kinch praises the Playbook's focus on operational collaboration, highlighting its structured information sharing checklist and improved coordination between federal, private and international partners. However, he warns that delays in intelligence sharing, particularly between DHS and other federal agencies, could hinder rapid response efforts. He emphasizes that trust is key to successful cybersecurity collaboration, urging clearer protocols and stronger protections for private sector partners hesitant to share threat Data. While commending CISA's proactive approach, Kinch stresses that industry leaders must take responsibility for implementing and refining the Playbook to strengthen national AI driven cybersecurity defenses. Coming up after the break, Ben Yellen explains Apple's pulling iCloud end to end encryption in response to the UK government and a Disney employee's cautionary tale. Stay with us.