CyberWire Daily: "Hackers in Handcuffs" – December 13, 2024

Host: N2K Networks

Episode Overview

In the December 13, 2024 episode of CyberWire Daily titled "Hackers in Handcuffs," host Dave Buettner delivers a comprehensive roundup of the latest cybersecurity developments. The episode delves into significant law enforcement actions against cybercriminals, critical vulnerabilities affecting major corporations, data breaches, and emerging threats from nation-state actors. A standout feature of this episode is an insightful interview with Tim Starks, Senior Reporter at Cyberscoop, who discusses the Federal Communications Commission's (FCC) groundbreaking proposal linking cybersecurity regulations to wiretapping laws. Additionally, the episode highlights the growing menace of malicious bots disrupting holiday shopping. Below is a detailed summary of the key topics covered.

1. US Authorities Dismantle RIDOCS Criminal Marketplace

Key Points:

• The U.S. successfully dismantled RIDOCS, a notorious marketplace facilitating the sale of stolen personal data and cybercrime tools.
• Fourteen-year operation: Active since 2016, RIDOCS hosted over 18,000 users and sold more than 321,000 cybercrime-related products, generating approximately $230,000.
• Arrests and Charges:
  • Ardit Kudlicha, Jetmir Kudlicha, and Spend Sokoli were arrested in coordinated operations in Kosovo and Albania.
  • Charges include identity theft, device fraud, and money laundering, with potential sentences spanning decades.
• Seizures: Authorities seized the RIDOCS domain, servers in collaboration with Malaysian police, and $225,000 in cryptocurrency.

Notable Quote:

"Active since 2016, Ridox facilitated the sale of stolen personal data, credit card details and credentials from thousands of US victims."
— Dave Buettner [00:02]

2. Clio Urges Immediate Patching of Critical Vulnerability

Key Points:

• Clio, a prominent file-sharing provider, identified a critical vulnerability across its products: Clio, Harmony, vltrader, and Lexicom.
• Vulnerability Details:
  • Initially addressed in October, systems remained exposed, prompting Clio to release a new patch in December.
  • The flaw was exploited by sophisticated threat actors, including the Termite Ransomware gang, potentially linked to the Klopp gang.
• Impact:
  • Affected sectors include consumer products, shipping, and retail supply chains, with 24 organizations confirmed compromised.
  • Malware named Malicious was deployed for initial access and persistence.

Notable Quote:

"Attackers have deployed malware named Malicious using Clio software for initial access and persistence."
— Dave Buettner [00:02]

3. Japanese Media Giant Kadokawa Pays $3 Million Ransom

Key Points:

• Kadokawa, a leading Japanese media conglomerate, reportedly paid nearly $3 million to the Russia-linked ransomware group Black Suit following a significant cyberattack in June.
• Breach Impact:
  • Data Accessed: 1.5 terabytes, including contracts, internal documents, and employee personal information.
  • Operational Disruption: Kadokawa's subsidiary Niconico temporarily shut down its live streaming platform.
• Ransom Details:
  • Initial demand was $8.25 million, reduced to $3 million with threats to delete stolen data.
  • Despite payment, some data was leaked, resulting in an estimated $15 million fiscal loss for Kadokawa.

Notable Quote:

"Kotokawa expects a $15 million fiscal loss due to the attack amid criticism of its handling of the breach."
— Dave Buettner [00:02]

4. Byte Federal Confirms Data Breach Affecting 58,000 Customers

Key Points:

• Byte Federal, the largest Bitcoin ATM operator in the U.S., experienced a data breach compromising sensitive customer information.
• Breach Details:
  • Date of Incident: September 2024, discovered on November 18, 2024.
  • Compromised Data: Names, addresses, Social Security numbers, transaction histories, and more.
• Cause: Vulnerability in third-party software GitLab.
• Response:
  • Secured the affected server and implemented additional security measures.
  • Notified impacted customers, though no misuse of data or funds has been reported.
• Expert Warning: Potential risks of phishing attacks remain high.

Notable Quote:

"Byte Federal secured the server, implemented additional protections and notified affected customers."
— Dave Buettner [00:02]

5. Microsoft Addresses Two Critical Vulnerabilities

Key Points:

• Microsoft patched two significant vulnerabilities in Update Catalog and Windows Defender.
• Vulnerability Details:
  • Update Catalog: Involved deserialization of untrusted data, leading to privilege escalation on web servers. CVSS Score: Not specified.
  • Windows Defender: Allowed unauthorized disclosure of sensitive file content over a network due to improper index authorization. CVSS Score: Medium.
• Mitigation: Both vulnerabilities have been fully addressed, requiring no user action.
• Transparency Efforts: Microsoft is now assigning CVE identifiers to cloud service vulnerabilities, aligning with industry practices akin to Google Cloud.

Notable Quote:

"Microsoft is assigning CVE identifiers to Cloud service vulnerabilities for transparency following industry trends."
— Dave Buettner [00:02]

6. Clarity's Research Unveils IO Control Malware Targeting Critical Systems

Key Points:

• Clarity's Team 82 identified IO Control, a malware tool utilized by nation-state actors targeting IoT and OT systems.
• Target Systems: SCADA devices linked to Iran's IRGC CEC Cyber Avengers Group, including fuel management systems, IP cameras, and PLCs from vendors like D-Link and Hikvision.
• Impact: A U.S. and Israeli fuel systems campaign was notably compromised.
• Government Response: The U.S. Treasury has sanctioned IRGC CEC officials and is offering a $10 million bounty for information on the perpetrators.

Notable Quote:

"IO Control has compromised devices such as fuel management systems, IP cameras and PLCs from vendors like D Link, Hikvision and Orpac."
— Dave Buettner [00:02]

7. Dell Releases Patches for Critical Vulnerabilities

Key Points:

• Dell disclosed two critical vulnerabilities affecting Powerflex appliances, Racks, insightIQ, and Data Lakehouse products.
• Vulnerability Details:
  • First Vulnerability: CVSS Score 10.0, allowing unauthenticated remote code execution via improper link resolution.
  • Second Vulnerability: CVSS Score 8.2, involving insecure storage of sensitive information, enabling high-privileged local attackers to access cluster pods.
• Response: Dell has released patches and urges immediate updates to impacted systems.

Notable Quote:

"Dell has released patches for impacted systems and urges users to update immediately."
— Dave Buettner [00:02]

8. Federal Court Indicts 14 North Korean Nationals for Cybercrime

Key Points:

• A Federal Court in St. Louis indicted 14 North Korean nationals for a cyber scheme generating $88 million to fund North Korea's weapons programs over six years.
• Modus Operandi:
  • Companies Involved: Yonbin, Silver Star, and Velocis, North Korean-linked firms.
  • Tactics: Employees used false identities to secure remote jobs with U.S. companies, stealing sensitive data and extorting victims.
• Law Enforcement Actions: Seized $1.5 million and 17 domains as part of the operation.
• Implications: Highlights the risks of remote work exploitation and the importance of rigorous vetting of IT personnel.
• Incentives: Authorities are offering rewards up to $5 million for information on suspects.

Notable Quote:

"The scheme highlights cybersecurity risks and the misuse of remote work."
— Dave Buettner [00:02]

9. Texas Accuses Data Broker Arity of Privacy Violations

Key Points:

• Arity, owned by Allstate, is accused by the Texas Attorney General of unlawfully sharing sensitive driving data without clear consent.
• Data Collection: Utilizes SDKs embedded in partner apps like MyRadar, GasBuddy, and Life360 to gather driving behavior data, including geolocation and driving patterns.
• Allegations:
  • Privacy Law Violations: Failed to obtain affirmative consent and did not provide opt-out options.
  • Lack of Transparency: Partner apps often do not disclose their data-sharing relationships or update privacy policies accordingly.
• Impact: Enhanced scrutiny on data brokers, especially within the automotive and insurance sectors, emphasizing consumer privacy protection.

Notable Quote:

"Arity gathers driving behavior data via SDKs embedded in partner apps... then sells it to insurers to inform pricing decisions."
— Dave Buettner [00:02]

10. FCC Proposes Cybersecurity Rules Linked to Wiretapping Laws

In-Depth Interview with Tim Starks, Senior Reporter at Cyberscoop

Discussion Highlights:

• Context: The FCC is introducing new cybersecurity regulations connected to the Communications Assistance for Law Enforcement Act (CALEA) in response to significant hacking incidents, including breaches by the Chinese group Salt Typhoon.
• Proposed Rules:
  • Establishing a baseline of security standards tied to wiretapping capabilities.
  • Immediate implementation upon approval, potentially involving fines and criminal penalties for non-compliance.
• Rationale: Hackers exploited backdoor systems intended for law enforcement wiretapping, gaining unauthorized access to sensitive information within telecommunications companies.
• Challenges:
  • Balancing encryption standards with the need for law enforcement access.
  • Navigating the rapid policy shift from non-committal to aggressive regulatory action by the FCC.
• Future Implications:
  • First-time integration of cybersecurity measures within wiretapping legislation.
  • Potential for enduring regulatory frameworks beyond the current presidential administration.

Notable Quotes:

"There's always this tug of war between the people on the pro security side saying encryption is the way to go... and on the other hand, they're saying we need a way in to catch criminals."
— Tim Starks [21:26]

"This is the first time that there's been this kind of thing happening... it's the first time that they've ever put in place anything cybersecurity related under this wiretapping law."
— Tim Starks [19:40]

11. Malicious Bots Disrupt Holiday Shopping

Key Points:

• Imperva reports that 71% of UK shoppers blame malicious bots for ruining their holiday shopping experience by scalping in-demand gifts.
• Bot Behavior:
  • Speed: Bots acquire high-demand items faster than legitimate customers.
  • Consequences:
    • Inflated Prices: 19% of shoppers paid more on resale sites.
    • Limited Availability: 10% settled for alternative gifts due to stock shortages.
• AI-Powered Bots: Advanced bots, enhanced by AI, are automating and accelerating the scalping process.
• Retailer Impact:
  • Customer Dissatisfaction: Leads to disappointed consumers and frustrated parents.
  • Reputational Damage: Retailers face potential downturns in reputation due to unsatisfied customers.
• Mitigation Strategies:
  • Rate Limiting: Control the number of requests from a single source.
  • Blocking Outdated Browsers: Prevent access from less secure or identifiable browsers.
  • Detecting Headless Browsers: Identify and block bots that operate without a user interface.

Notable Quote:

"AI powered bots are turbocharging the chaos, scalping gifts at record speed."
— Dave Buettner [00:02]

Conclusion

The "Hackers in Handcuffs" episode of CyberWire Daily provides a thorough examination of current cybersecurity challenges, law enforcement actions against cybercriminals, and emerging threats impacting both corporations and consumers. The insightful discussions, particularly regarding the FCC's regulatory proposals, offer valuable perspectives for industry leaders and cybersecurity professionals. As the landscape evolves, staying informed through such detailed briefings remains crucial for maintaining robust security postures.

Stay Informed:

For more detailed insights and updates on these stories, visit CyberWire. Don’t forget to check out the upcoming Research Saturday featuring Andrew Morris, Founder and CTO of GrayNoise, discussing their latest research on zero-day vulnerabilities in live-streaming cameras.

Credits:

Produced by Liz Stokes
Mixed by Trey Hester
Original Music and Sound Design by Elliot Peltzman
Executive Producer: Jennifer Iban
Executive Editor: Brandon Park
President: Simone Petrella
Publisher: Peter Kilpie
Host: Dave Buettner