Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K.
Linda Gray Martin (0:12)
Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant. A critical vulnerability in Erlang OTP SSH allows unauthenticated remote code execution There's a bipartisan effort to renew a key cybersecurity info sharing law. A newly discovered Linux kernel vulnerability allows local attackers to escalate privileges. A researcher uncovers 57 risky Chrome extensions with a combined 6 million users. Attack IQ shares Strella stealer simulations a major live event service provider notifies employees and customers of a data breach. CISA warns of an actively exploited SonicWall vulnerability. An airport retailer agrees to a multi million dollar settlement stemming from a ransomware attack. A preview of RSAC 2025 with Linda Gray Martin and Britta Glade and Zoom A zoom Zoom. It's always.
Britta Glade (1:55)
Foreign.
Linda Gray Martin (2:00)
April 19, 2025 I'm Dave Bittner and this is your CyberWire Intel Briefing. Happy Friday and thanks for joining us here today. Great to have you with us. Olang OTP SSH is widely used in systems that demand high availability and concurrency, particularly in telecommunications, IoT and embedded devices. Its integration into Erlang's ecosystem makes it a preferred choice for developers building distributed systems requiring secure remote access. A critical vulnerability in Erlang OTP SSH allows unauthenticated remote code execution on affected devices. Discovered by researchers at Ruhr University Bauchem, it carries a maximum CVSS score of 10. The flaw stems from improper handling of pre authentication SSH messages, enabling attackers to run commands often as root, via the SSH daemon. Horizon 3's security team confirmed the exploit is easy to reproduce and could soon see public proof of concepts. All systems using Erlang OTP's SSH are impacted. Erlang relies on the OTP stack for components like ssh. Users are urged to upgrade immediately. For systems that can't be patched, access should be limited to trusted IPs or SSH disabled altogether. Senators Gary Peters, a Democrat from Michigan, and Mike Rounds, a Republican from South Dakota, who have introduced the Cybersecurity Information Sharing Extension act to renew a key 2015 law encouraging businesses to share cyber threat data with the government set to expire in September. The original Cybersecurity Information Sharing act helped companies report threats like malware and vulnerabilities to DHS while receiving legal protections. The law supports real time collaboration between private firms and agencies like CISA through efforts like the Joint Cyber Defense Collaborative. It's credited with aiding responses to major incidents like Solar Winds and Volt Typhoon. Senator Rounds warned that letting it lapse would harm national cyber defenses. Experts agree the law has boosted operational partnerships, but say the renewal is a chance to update it for modern privacy, supply chain and threat realities. A newly discovered Linux kernel vulnerability poses a serious risk by allowing local attackers to escalate privileges and potentially gain root access. With a CVSS score of 7.8, the flaw affects the bitmap IP set type in the netfilter subsystem due to improper handling of IP range parameters. The exploit code enables attackers to perform out of bounds writes, bypass castler, and execute kernel level code. Patches are available and system administrators are urged to update immediately. Security researcher John Tuckner has uncovered 57 risky Chrome extensions with a combined 6 million users, many of which have excessive permissions and could be used for surveillance or malicious activity. These extensions, often unlisted from the Chrome Web Store and only installable via direct link, claim to offer privacy or ad blocking services but can monitor browsing behavior, access cookies, modify search results, and execute remote scripts. The most notable Fire shield extension protection is heavily obfuscated and communicates with a suspicious domain. Tuckner found multiple extensions linked to the same domain, raising concerns about their potential use as spyware. Google is currently investigating the report, and users are advised to remove any of the flagged extensions and reset their passwords as a precaution. Some extensions have been taken down, but others remain active. Strela Stealer is a credential stealing malware targeting email clients like Microsoft Outlook and Mozilla Thunderbird. Active since 2022 and attributed to the threat actor Hive0145, it spreads via phishing emails containing zip files with malicious JavaScript that downloads a DLL payload. Recent campaigns have hit over 100 organizations across Europe and the US with enhanced obfuscation and new delivery methods involving PowerShell and WebDAV. AttackIQ has released attack graphs that simulate Strellus Dealer's behavior, covering its initial infection, system discovery, and data exfiltration to help organizations test and improve their defenses. These scenarios highlight the importance of monitoring native Windows utilities like Rundll32 and REG Server32, which are used to launch the malware security teams are urged to use these tools to validate detection and mitigation strategies against this growing threat. Legends International, a major live events service provider, is notifying employees and customers of a data breach discovered on November nint of last year. The company took systems offline and found that attackers exfiltrated files containing sensitive data, including Social Security numbers, driver's license details, payment card info and medical records. Over 8,000 Texans were affected, though the full scope remains unknown. While there's no evidence of misuse, impacted individuals are being offered two years of free identity protection. No group has claimed responsibility. CISA has warned US Federal agencies to patch a high severity remote code execution vulnerability affecting SonicWall SMA100 series appliances. The flaw allows low privileged remote attackers to execute arbitrary code via the SMA 100 management interface. Initially considered a denial of service issue, Sonicwall recently upgraded its severity and confirmed it is being actively exploited. Agencies must patch by May 7th and all organizations are urged to act swiftly to prevent potential breaches. Airport retailer Paradis Shops has agreed to a $6.9 million settlement to resolve a class action lawsuit stemming from a 2020 ransomware attack that exposed personal data of 76,000 current and former employees. The breach, linked to the Arevil Ransomware Group, compromised names and Social Security numbers after hackers accessed systems for five days. Plaintiffs accused the company of negligence and delayed notification while denying wrongdoing. Paradis opted to settle to avoid prolonged litigation. The deal follows a growing trend of post breach class actions. Coming up after the break, a preview of RSAC 2025 with Linda Gray Martin and Britta Glade and Zoom A zoom Zoom. It's always DNS. Stay with us. Bad actors don't break in, they log in. Attackers use stolen credentials in nearly nine out of 10 data breaches. Once inside, they're after one thing your data. Varonis AI powered data security platform secures your data at scale across las SaaS and hybrid cloud environments. Join thousands of organizations who trust Varonis to keep their data safe. Get a free data risk assessment@varonis.com foreign what's the common denominator in security incidents? Escalations and lateral movement? When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit, but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks with attack path management. You can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by Spectrops. Head to Spectrops IO today to learn more Spectre Ops. See your attack paths the way adversaries do. The RSAC 2025 conference in San Francisco is right around the corner. And today I speak with Linda Gray Martin and Britta Glade from RSAC Conference with a preview of this year's activities. Well, Linda and Britta, welcome back. It is always a highlight when we get to get together year after year to preview the upcoming RSAC conference, and this year is no exception. Welcome back, ladies.