Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire network powered by N2K.
Brandon Karp (0:11)
And now a message from our sponsor. Zscaler, the leader in cloud security enterprises have spent billions of dollars on firewalls and VPNs, yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security Zscaler Zero Trust plus AI stops attackers by hiding your attack surface making apps and IPs invisible eliminating lateral movement Connecting users only to specific apps, not the entire network Continuously verifying every request based on identity and context Simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more@zscaler.com Security the FBI warns agents of hacked call and text logs. The US treasury sanctions entities tied to North Korea's fake IT worker operations. Russian hacking group Star Blizzard attempted to infiltrate WhatsApp accounts of nonprofits supporting supporting Ukraine. Yubico discloses a critical vulnerability in its pluggable authentication module software. Google releases an open source library for software composition analysis. CISA hopes to close the software understanding gap. Humakit targets critical infrastructure simple help patches multiple flaws in their remote access software. The FTC bans GM from selling driver data. HHS outlines their efforts to protect hospitals and health care. Our guest is Maria Tranquili, Executive Director Director at Common Mission projects, speaking with N2K's Brandon Karp about the origins and impacts of hacking for defense and even the best of Red Teamers are humbled by AI. It's Friday, January 17th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It is great as always to have you with us. According to an FBI document reviewed by Bloomberg, hackers breached AT&T's systems in 2022, stealing months of FBI agents call and text logs, triggering concerns about exposing confidential informants. The stolen data, including agents, phone numbers and call details, could link investigators to their secret sources, but excluded content of communications and encrypted messaging records. AT&T disclosed the breach in July, which involved six months of customer data following an extortion attempt by hackers. The FBI has raced to mitigate risks to its sources and investigations, underscoring concerns about the Bureau's operational security. The breach was part of a broader campaign targeting AT&T and Snowflake customers, with hackers exploiting accounts lacking multi factor authentication. Federal prosecutors charged individuals connected to the breach and related extortion schemes. Despite efforts to secure the data, it's unclear if the information remains at risk, raising alarms about safeguarding sensitive data in third party systems. The U.S. treasury's Office of Foreign Assets Control has sanctioned two individuals and four entities tied to North Korea's scheme to generate illicit funds through fake IT worker operations. North Korean operatives used stolen identities and AI to secure IT jobs in Western countries, funneling earnings to the regime. Hundreds of companies in the US UK and Australia unknowingly hired these workers, while others were stationed in Russia, China and beyond. North Korea's government withholds up to 90% of these workers wages funding weapons programs including WMDs and ballistic missiles. Sanctions target North Korean front companies, Korea Oseong Shipping Co. And Chonsurim Trading Corporation as well as their leaders. A Chinese company was also sanctioned for supplying electronics to facilitate these activities. These operations generate hundreds of millions annually for Pyongyang's regime. The Russian hacking group Star Blizzard attempted to infiltrate WhatsApp accounts of non profits supporting Ukraine using phishing messages impersonating US officials. Victims were invited to join a fake WhatsApp group US Ukraine NGOs group and prompted to scan a malicious QR code, giving attackers access to their messages. This marks the first use of WhatsApp by the group, which is linked to Russia's FSB. Despite recent US actions dismantling their infrastructure, Star Blizzard quickly adapted, demonstrating their resilience. Their targets include government entities, nonprofits and Ukraine aid organizations. Ubico has disclosed a critical vulnerability in its pluggable authentication module software package. This flaw could allow attackers to bypass authentication under certain configurations. The vulnerability, rated high with a CVSS score of 7.3, impacts macOS and Linux systems but does not affect Yubico hardware devices. Users should upgrade to the latest version or modify configurations to mitigate risks. Google has released OSV Scalibur, an open source GO library for software composition analysis. The tool scans software inventory, identifies vulnerabilities and generates software bills of materials in SPDX and CycloneDx formats. It supports Linux, Windows and macOS and works with OS packages, binaries and source code. OSV Scalibur is used within Google for scanning live hosts, repositories and containers and will integrate further with Google's OSV Scanner. Users can leverage its plugins for software extraction and vulnerability detection with custom plugins supported cisa, alongside federal partners, released a report titled Closing the Software Understanding Gap, calling for a national effort to better understand and secure software critical to infrastructure and national security. The report urges collaboration between public and private sectors to prioritize software analysis under all conditions. Recommendations include stronger security in software development such as network segmentation, multi factor authentication, encrypted data storage, and robust supply chain risk management. CISAW also launched the vulnrichment program to enhance the national vulnerability database by adding detailed metadata for better vulnerability tracking. These measures align with CISA's Secure by Design principles, aiming to shift the security burden from users to manufacturers, ultimately improving resilience against cyber threats to critical infrastructure systems. The advanced Linux rootkit PUMA Kit has been identified targeting critical infrastructure sectors including telecommunications, finance and national security. Discovered by Elastic Security Labs, PUMA Kit operates at the kernel level, employing sophisticated evasion techniques to remain undetected. It conceals malicious activities, ensures persistence through reboots, and disables security tools, enabling long term access to compromised systems. Indicators of compromise include unusual kernel modules, suspicious traffic to specific IPs and concealed processes. Organizations are urged to apply security patches, enforce multi factor authentication, monitor for anomalies, and use Elastic's YARA rule for detection. Critical vulnerabilities in Simple Help Remote access software could allow attackers to compromise servers and client machines. Horizon 3 AI reports. These include a path traversal flaw enabling unauthorized file access, an arbitrary file upload vulnerability allowing remote code execution, and a privilege escalation bug enabling technicians to gain admin access. Simple Help patched the issues in January and urges users to update and reset admin and technician passwords promptly. To mitigate risks, the Federal Trade Commission has imposed a five year ban on General Motors and its OnStar subsidiary from selling sensitive driver data, including geolocation and driving behavior, to data brokers. The ban stems from allegations that GM misled customers about data collection and shared precise driver information, such as location and habits, without consent. This data, often sold to insurers, led to premium spikes or policy cancellations for some drivers. The FTC settlement requires GM to obtain explicit consent for data collection, improve transparency and and provide mechanisms for consumers to delete or limit data collection. The automaker must also allow users to disable Precise geolocation tracking. GM, which ended its smart driver program and related third party contracts in 2023, stated the FTC order enforces stricter privacy standards beyond current laws in an editorial for CyberScoop, Deputy Secretary of the Department of Health and Human Services. Andrea Palm describes the significant steps the agency has taken to combat rising cyber attacks targeting hospitals and health systems. These attacks disrupt care, jeopardize patient safety and erode trust, Palm says. HHS has focused on three policy, resources and coordination. Policies include updated HIPAA rules and new cybersecurity requirements for medical devices. Funding efforts like $240 million for hospital preparedness and a proposed $1.3 billion through Medicare AIM to bolster cybersecurity for under resourced organizations. The agency also provides free training, a cybersecurity risk map and plans to use AI to guide security improvements. HHS emphasizes a sector wide approach to protect interconnected health systems and has enhanced incident response and collaboration with industry. Despite progress, HHS stresses continued investment and bipartisan support are crucial to strengthening cybersecurity and protecting national security. Coming up, our guest Maria Tranquilli from the Common Mission Project speaks with our own Brandon Karp about the origins and impact of hacking for defense. And even the best of Red Teamers are humbled by AI. Stay with us.