CyberWire Daily: "Hacking Allegations and Antitrust Heat" Summary

Release Date: December 18, 2024
Host: Dave Bittner, CyberWire Network
Produced by: N2K Networks

1. U.S. Considers Ban on TP-Link Routers Amid Security and Antitrust Concerns

The episode opens with a critical discussion on the U.S. government's potential ban on TP-Link routers due to escalating security fears and antitrust investigations. Authorities from the Commerce, Defense, and Justice departments are scrutinizing TP-Link, a China-based company, for possible national security risks. A recent Microsoft report has linked TP-Link devices to a Chinese hacking network targeting Western organizations.

Key Points:

• Market Dominance: TP-Link holds a 65% share in the U.S. home and small business router market, largely due to affordable pricing and partnerships with over 300 U.S. internet providers.
• Security Flaws: The routers are frequently shipped with unresolved security vulnerabilities, and the company is alleged to lack cooperation with security researchers.
• Antitrust Probe: The Justice Department is investigating whether TP-Link's pricing strategy infringes antitrust laws.

Notable Quote:

"TP-Link routers are often shipped with unresolved security flaws, and the company reportedly doesn't cooperate with security researchers." – Dave Bittner [02:15]

Implications:

• A potential ban would be the largest removal of Chinese telecom equipment from the U.S. since the Huawei restrictions in 2019.
• Other countries like Taiwan and India have already implemented similar bans, highlighting the ongoing global concerns over telecom supply chain security.

2. Clio Managed File Transfer Servers Remain Vulnerable

Despite warnings about active mass attacks exploiting critical flaws, over 200 Clio managed file transfer servers are still exposed. The vulnerabilities permit attackers to execute arbitrary commands and exfiltrate data.

Key Points:

• Exploitation by CLOP Ransomware: The CLOP group is suspected of leveraging these vulnerabilities, marking their fifth major attack on file transfer software.
• Affected Sectors: Retail and energy industries have been notably targeted, with significant data transfers to suspicious IP addresses detected.
• Security Recommendations: Experts urge immediate patching, log reviews, and, if necessary, taking vulnerable systems offline. Clio has released updates to address these threats, but unpatched systems remain at risk.

Notable Quote:

"Researchers found attackers using Java-based remote access trojans for system reconnaissance, file exfiltration, and command execution." – Dave Bittner [05:50]

3. Expansion of the Androx Ghost Botnet

The Androx Ghost botnet has significantly expanded, now exploiting 27 vulnerabilities, up from 11 in November. The botnet has merged with the IoT-focused Mozzie botnet, targeting web servers, IoT devices, and platforms like Cisco, ASA, Atlassian, Jira, and PHP frameworks.

Key Points:

• Attack Methods: Includes remote code execution, brute force attacks, and credential stuffing.
• Targets: Vulnerabilities in Sophos firewalls and TP-Link routers are exploited.
• Attribution: The botnet's sophisticated operations suggest a possible link to Chinese Capture-The-Flag (CTF) communities, posing global risks of data breaches, ransomware, and surveillance.

Notable Quote:

"The botnet's sophistication suggests coordinated control potentially linked to Chinese CTF communities." – Dave Bittner [09:20]

4. Critical Vulnerability in Schneider Electric’s Modicon Controllers

A severe flaw in Schneider Electric’s Modicon controllers allows unauthenticated attackers to exploit port 502, compromising systems without user interaction. Rated 9.8 on the CVSS scale, this vulnerability affects controllers used in critical infrastructure sectors like energy and manufacturing worldwide.

Key Points:

• Current Status: No patch is available yet. Schneider Electric advises isolating devices from the public Internet and restricting access to specific network segments.
• Preventive Measures: Users should secure controllers physically and follow recommended network configurations to mitigate risks.

Notable Quote:

"With no patch yet available, users are advised to isolate devices from the public Internet, restrict access to Port 502 TCP segment networks and secure controllers physically." – Dave Bittner [11:00]

5. Active Exploitation of Apache Struts 2 Vulnerability

An active exploitation of a critical Apache Struts 2 vulnerability allows attackers to upload malicious files via path traversal, enabling remote code execution across various Struts versions.

Key Points:

• Attack Vector: Attackers deploy scripts to verify and compromise systems.
• Response: Apache urges users not only to upgrade but also to implement new file upload mechanisms, as patching alone is insufficient.

Notable Quote:

"Exploitation has been detected with attackers deploying scripts to verify compromised systems." – Dave Bittner [12:30]

6. Malicious Campaigns Targeting Chinese-Branded IoT Devices

Scammers are increasingly targeting IoT devices like Hikvision and Zhomai web cameras and DVRs by exploiting weak passwords and unpatched vulnerabilities. The FBI has identified malware such as Hiatus RAT being used to bypass authentication and inject commands into these devices.

Key Points:

• Global Impact: The malware has been active since July 2022, affecting devices worldwide, including U.S. government servers.
• Mitigation Strategies: The FBI recommends isolating vulnerable devices, enforcing strong passwords, enabling multi-factor authentication, and promptly applying updates.

Notable Quote:

"Interpol says words matter, drawing parallels to shifts in language around domestic abuse and sexual violence." – Dave Bittner [21:10]

7. Data Breach at Nebraska-Based Healthcare Insurer

Regional Care, a Nebraska-based healthcare insurer, disclosed a data breach compromising over 225,000 individuals. The breach, detected in mid-September, involved unauthorized access to an account, resulting in the exposure of sensitive data, including Social Security numbers and medical information.

Key Points:

• Breach Details: The breach involved the theft of names, birth dates, Social Security numbers, and medical insurance information.
• Response: Regional Care is offering free credit monitoring to affected individuals and has not linked the breach to any ransomware group.

Notable Quote:

"Affected individuals are being offered free credit monitoring." – Dave Bittner [13:30]

8. Intel Broker Leaks Cisco’s DevHub Environment Data

A significant data leak from Intel broker has exposed 2.9 gigabytes of data from Cisco’s DevHub environment, part of a broader 4.5-terabyte breach. The incident highlights vulnerabilities in the tech giant's security protocols.

Key Points:

• Nature of the Breach: Exploited an exposed API token, leaking sensitive data such as source code, hard-coded credentials, and encryption keys.
• Affected Entities: Major corporations like Verizon and Microsoft have also been compromised.
• Cisco’s Response: Cisco has disabled DevHub access, initiated an investigation, and engaged law enforcement, asserting that core systems remain unaffected.

Notable Quote:

"Cisco, while confirming the breach, stated its core systems remain unaffected and attributed the incident to a misconfigured developer environment." – Dave Bittner [14:45]

9. CISA's Binding Operational Directive 25-01 on Cloud Security

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive 25-01, mandating federal agencies to enhance cloud security by adopting secure configuration baselines. This directive aims to mitigate risks from misconfigurations and weak controls.

Key Points:

• Requirements:
  • Inventory Creation: Agencies must identify cloud tenants and create inventories by February 21, 2025.
  • Tool Deployment: Deploy SCUBA assessment tools by April 25, 2025.
  • Policy Implementation: Implement SCUBA policies, including Microsoft Office 365 baselines, by June 20, 2025.
  • Ongoing Compliance: Annual updates to cloud tenant inventories and continuous reporting are required.
• Broader Impact: Although directed at federal agencies, CISA encourages broader adoption to enhance collective cybersecurity resilience.

Notable Quote:

"While directed at federal agencies, CISA encourages broader adoption to bolster collective cybersecurity resilience." – Dave Bittner [16:00]

10. Interpol Advocates for Terminology Shift in Scam Descriptions

In a significant linguistic shift, Interpol is moving away from the term "pig butchering" to "romance baiting" to describe scams involving fake relationships and fraudulent investments. This change aims to eliminate victim-shaming language and encourage more victims to seek help.

Key Points:

• Reason for Change: The term "pig butchering" shames victims and deters them from reporting scams.
• New Terminology: "Romance baiting" highlights the emotional manipulation used by scammers, placing focus on the perpetrators rather than the victims.
• Campaign Impact: Part of Interpol’s "Think Twice" campaign, which also addresses online threats like ransomware and phishing.

Notable Quote:

"Interpol says words matter, drawing parallels to shifts in language around domestic abuse and sexual violence." – Dave Bittner [22:10]

Conclusion:

The episode "Hacking Allegations and Antitrust Heat" delves deep into pressing cybersecurity issues, from potential government bans on widely-used networking hardware to intricate malware operations targeting critical infrastructure. The discussions highlight the evolving landscape of cyber threats and the proactive measures being taken by organizations and authorities to mitigate these risks. Notably, the shift in terminology advocated by Interpol underscores the importance of language in shaping public perception and support for cybersecurity initiatives.

For comprehensive insights and detailed analyses on these topics, listeners are encouraged to access the full episode through CyberWire Daily.

Notable Contributors:

• Dave Bittner: Host and Presenter
• Chris Hare: Content Developer and Project Management Specialist, N2K Networks
• Dan Neville: Captain of Comptia

Additional Resources:

• For practice tests and certification resources, visit n2k.com
• For feedback and inquiries, email cyberwire@thecyberwire.com