Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network, powered by N2K.
Steve Schmidt (0:11)
Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com the Senate confirms Kash Patel is FBI director the SEC rebrands its crypto assets and cyber unit. Microsoft's quantum chip signals an urgent need for post quantum security. Chat log leaks reveal the inner workings of Black Basta CISA advisories highlight craft CMS and ICS devices. Researchers release proof of concepts for Ivanti Endpoint Manager vulnerabilities. Warby Parker gets a $1.5 million HIPPA fine. Our guest is Steve Schmidt, Amazon's chief security officer, with a behind the scenes look at securing a major event. And researchers explore the massive, mysterious YouTube wormhol it's Friday, February 21st, 2025. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today and happy Friday. It is great to have you with us. The Senate confirmed Kash Patel as FBI director in a narrow 51 to 49 vote despite concerns over his qualifications and political loyalties. A Trump loyalist, Patel has been vocal about reforming the FBI, shifting its focus from intelligence gathering to traditional law enforcement. His confirmation follows Justice Department shakeups and demands for agent names tied to January 6 investigations, raising fears of political retribution. Patel's past remarks, labeling FBI investigators as criminal gangsters and suggesting January 6th rioters are political prisoners alarmed Democrats. Critics fear he will use the FBI to target Trump's adversaries, undermining its independence. Republicans, however, back him as a reformer who will restore accountability. From a cybersecurity perspective, Patel's leadership could impact federal investigations into cyber threats, foreign influence campaigns and domestic extremism. His shift away from intelligence driven operations might weaken nationwide cybersecurity efforts, leaving agencies and critical infrastructure more vulnerable to cyber threats. The securities and Exchange Commission has rebranded its crypto assets and cyber unit as the Cyber and Emerging Technologies Unit, expanding its focus beyond cryptocurrency fraud to include hacking, social media scams and AI related threats. Led by Laura de Allaire, the unit will still investigate crypto related fraud, but critics worry. The change signals a weakened enforcement stance under the Trump administration, which is seen as more crypto friendly. The rebrand follows SEC enforcement actions against major crypto firms like FTX and Binance and its previous focus on unregistered asset offerings and securities violations. Some former officials argue the shift diminishes crypto oversight, while others believe it allows for a broader focus on AI and quantum tech risks. The change reflects ongoing political shifts in US Crypto regulation, raising questions about how aggressively the SEC will police blockchain related fraud and market abuses moving forward. Microsoft has unveiled Majorana one, the first quantum chip accelerating the timeline for quantum computers capable of breaking encryption from decades to years. The breakthrough, powered by a new topological core architecture, could lead to million qubit systems capable of solving problems beyond the reach of classical computers. However, this also raises serious cybersecurity risks. Quantum machines will be able to crack encryption protocols like RSA and AES, exposing sensitive data. Cybercriminals are already harvesting encrypted data to decrypt later when quantum systems mature. To counter this, NIST formalized post quantum cryptography standards in 2024, urging organizations to adopt quantum secure algorithms. Still, challenges remain, including unclear ownership of transitions and poor cryptographic visibility. The financial sector is leading in developing quantum resistant solutions, but broader adoption is essential before quantum computers become a widespread threat. Internal chat logs from the Black Basta ransomware gang have been leaked online, revealing nearly 200,000 messages detailing internal conflicts, network access and key threat actors. The logs, spanning September 2023 to September 2024, were first shared on Mega by a user named Exploit Whispers before being moved to Telegram. Cybersecurity firm Prodaft confirmed the leak is likely legitimate and sheds light on Black Basta's decline. The group, once a major ransomware player, struggled with internal disputes, particularly over financial priorities and leadership issues. A figure known as Tramp, responsible for Q Bot distribution, caused significant friction, leading to members leaving. Many former Black Boston members have since joined the Cactus and Akira ransomware groups, continuing operation under new banners. The leak provides valuable intelligence, further proving that cybercriminal groups often collapse due to internal conflicts. CISA has added a high severity remote code execution vulnerability in CRAFT CMS to its known Exploited Vulnerabilities catalog. Though CRAFT CMS has a small market share, over 41,000 instances may be affected. The flaw was patched in January and affects installations where the security key is already compromised. While no public reports confirm attacks, federal agencies Must patch by March 13. Another RCE vulnerability was actively exploited in late 2024, though it has not yet been added to CISA's catalog. The growing exploitation of craft CMS flaws highlights the importance of timely patching to prevent Web server compromises. Additionally, CISA has issued seven advisories detailing critical vulnerabilities in industrial control systems from abb, Siemens, Mitsubishi Electric, and others. These flaws pose severe risks to critical infrastructure and require urgent patching. CISA urges organizations to apply patches immediately to mitigate exploitation risks and safeguard critical infrastructure from cyber threats. Notable is a vulnerability affecting ABB Flexion controllers, scoring a 10 out of 10 on the CVSS scale. This allows remote code execution and sensitive data exposure. Patch EM if you got em Security engineers have released a Proof of concept exploit for four critical vulnerabilities in Ivanti Endpoint Manager, all rated 9.8 out of 10 on the CVSS scale. The flaws were patched in January, but unpatched systems remain at risk. The vulnerabilities allow unauthenticated attackers to leak NTLM v2 hashes by tricking the software into authentication with a remote server, enabling account impersonation and system compromise. Researcher Zach Hanley discovered the flaws and published the technical details and Proof of Concept exploit earlier today. Ivanti states there is no evidence of active exploitation, but with the proof of concept now public, the risk has increased. The company urges immediate patching, including a v2 patch update that fixes issues caused by the original January patch. Eyeglass retailer Warby Parker has been hit with a $1.5 million HIPAA fine by the US Department of Health and Human Services Office of Civil Rights over credential stuffing attacks that compromised nearly 200,000 customer accounts. The attacks, which occurred between September and November 2018, allowed hackers to access electronic protected health information, including names, addresses, payment card details and eyewear prescriptions. Subsequent breaches in 2020 and 2022 prompted further investigations. OCR found three HIPAA security rule violations, citing Warby Parker's failure to conduct risk assessments, implement security measures, and review system activity logs. Though notified in September 2024, the company waived its right to a hearing, likely to avoid further scrutiny of its security practices. Coming up after the break, my conversation with Steve Schmidt, chief security officer at Amazon. We've got a behind the scenes look at securing a major event, and researchers explore the massive, mysterious YouTube wormhole. Stay with us. Cyber threats are evolving every second, and staying ahead is more than just a challenge, It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.