Transcript
Maria Varmazes (0:02)
You're listening to the Cyberwire Network, powered by N2K.
Ann Johnson (0:11)
Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect. Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com.
Maria Varmazes (1:01)
Cyber Command ordered to halt offensive operations against Russia during Ukraine negotiations Ransomware actors Exploit Paragon Partition Manager vulnerability Amnesty International publishes analysis of Celebrate Exploit Chain California orders data broker to shut down for violating the delete act on our afternoon Cyber Tea segment with host Ann Johnson of Microsoft Security, Anne speaks with Igor Cygansky, Microsoft's global chief information security officer, about the power of partnership in cyber defense. Today is Monday, March 3, 2025. I'm Maria Varmazes, host of the T Minus Space Daily, in for Dave Buettner, and this is your Cyber Wire Intel Brief. Foreign thanks for joining us on this first Monday in March. Onto today's stories, the record reports that U.S. defense Secretary Pete Hegath has ordered Cyber Command to halt offensive cyber operations against Russia. The full scope of the directive is unclear, but it doesn't include the NSA or its signals intelligence operations targeting Russia. The Washington Post cites a current US Official familiar with the order as saying that the pause is meant to last only as long as negotiations over the war in Ukraine continue. The Post says that the operations being halted could include exposing or disabling malware found in Russian networks before it can be used against the United States, blocking Russian hackers from servers that they may be preparing to use for their own offensive operations, or disrupting a site promoting anti US Propaganda. The New York Times observes that former officials said it was common for civilian leaders to order pauses in military operations during sensitive diplomatic negotiations to avoid derailing them. Still, for President Trump and Mr. Hegseth, the retreat from offensive cyber operations against Russian targets represents a huge gamble. It essentially counts on Mr. Putin to reciprocate by letting up on what many call the shadow war underway against the United States and its traditional allies in Europe. The Pentagon, on its part, declined to comment on the report. A senior defense official told the Record, due to operational security concerns, we do not comment nor discuss cyber intelligence plans or operations. There is no greater priority to Secretary Hegseth than the safety of the warfighter in all operations to include the cyber domain. Researchers at Microsoft discovered five vulnerabilities affecting a driver used by Paragon Partition Manager, one of which is being exploited by ransomware actors, reports Bleeping Computer. Microsoft has observed ransomware attackers using the flaw to achieve system level privilege escalation before executing additional malware. An advisory from the CERT Coordination center explains an attacker with local access to a device can exploit these vulnerabilities to escalate privileges or cause a denial of service scenario on the victim's machines. Additionally, as the attack involves a Microsoft signed driver, an attacker can leverage a bring your own vulnerable driver technique to exploit systems even if Paragon Partition Manager is not installed. Paragon Software has issued patches for the flaws and users of Partition Manager should upgrade to the latest version and now a follow up story to something that we covered last week. Amnesty International has published a follow up to its December 2024 report on the Serbian government's alleged misuse of Cellebrite's cell phone data extraction tool. Amnesty's latest report, published on Friday, outlines a new case of misuse of a Celebrate product to break into the phone of a youth activist in Serbia. The report shares technical details on a sophisticated zero day exploit chain targeting Android USB drivers developed by Celebrate. Amnesty explains that the exploit, which targeted Linux kernel USB drivers, enabled Celebrate customers with physical access to a locked Android device to bypass an Android phone's lock screen and gain privileged access on the device. As the exploit targets core Linux kernel USB drivers, the impact is not limited to a particular device or vendor and could affect a very wide range of devices. The same vulnerabilities could also expose Linux computers and Linux powered embedded devices to physical attacks, although there is no evidence that this exploit chain has been designed to target non Android Linux devices. Last week, Celebrate announced that it would suspend its services in Serbia, citing Amnesty's December report. The State of California's Privacy Protection Agency, or cppa, last Thursday ordered a data broker to cease operations for three years for failing to register with the state, according to a report from the Record. The California Delete act, which took effect in January 2024, requires data brokers to register with the CPPA in order to provide a mechanism through which consumers can request to have their data deleted. The broker, in this case called Background Alert, has agreed to the settlement terms. The record notes that such a ruling against a data broker is unprecedented. Researchers at Truffle Security found just under 12,000 valid API keys and passwords in the Common Crawl database, which is an enormous open source repository of web data used for training AI models. The secrets included an AWS root key, live Slack webhooks, and nearly 1,500 unique Mailchimp API keys. The researchers stressed that Common Crawl isn't to blame. The keys were publicly exposed because web developers hard coded them into front end HTML and JavaScript, and the web pages were then archived by Common Crawl. Poland's Minister for Digitalization said yesterday that the Polish space Agency's IT infrastructure sustained an unauthorized intrusion and the agency has disconnected its network from the Internet while it investigates the incident. We should note that the nature of the attack is unclear. The Register cites a source inside the agency as saying that the incident was related to an internal email compromise, and staff have been told to rely on phones instead. Stay tuned for further developments here and on our T Minus Space Daily podcast. Coming up after our break, Ann Johnson from Microsoft Security joins us for her monthly afternoon Cyber Tea segment. And we click and call with an old friend.