Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network. Powered by n2k.
Amazon Sponsor (0:10)
This episode is brought to you by Amazon. Sometimes the most painful part of getting sick is the getting better part. Waiting on hold for an appointment, sitting in crowded waiting rooms, standing in line at the pharmacy that's painful. Amazon One Medical and Amazon Pharmacy remove those painful parts of getting better with things like 24. 7 virtual visits and prescriptions delivered to your door. Thanks to Amazon Pharmacy and Amazon One Medical Healthcare just got less painful.
Dave Bittner (0:40)
Ransomware, supply chain attacks and zero day exploits can strike without warning, leaving your business's sensitive data and digital assets vulnerable. But imagine a world where your cybersecurity strategy could prevent these threats. That's the power of the Threat Locker Zero Trust Endpoint Protection Platform Robust cybersecurity is a non negotiable to safeguard organizations from cyberattacks, ThreatLocker implements a proactive deny by default approach to cybersecurity, blocking every action process end user unless specifically authorized by your team. This least privilege methodology mitigates the exploitation of trusted applications and ensures protection for your organization. 247365 IT professionals are empowered by ThreatLocker application allowance listing, Ring Fencing, Network Control and EDR solutions, enhancing their cybersecurity posture and streamlining internal IT and security operations. To learn more about how ThreatLocker can help mitigate unknown threats in your digital environment and align your organization with respected compliance frameworks, visit threatlocker.com New details emerge about Chinese hackers breaching the US Treasury Department the Supreme Court considers the TikTok ban Chinese hackers exploit a zero day flaw in Avanti Connect Secure VPN A new credit card skimmer malware targets WordPress checkout pages the Banshee macOS Info Stealer has been updated A California health services organization reports a data breach A Florida Firm pays a 337,000 HIPAA settlement following a 2018 breach Samsung patches Android devices A Proton mail outage hits users worldwide A popular E Card site recovers from malware Certbyte segment host Chris Hare interviews our guest Casey Marks, ISC2's chief qualifications officer, about the future of certifications and that's a feature not a HAC.
Chris Hare (3:01)
Foreign.
Dave Bittner (3:04)
It'S Friday, January 10, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Happy Friday and thanks for joining us here today. It is great to have you with us. New details have emerged about Chinese hackers breaching the U.S. treasury Department's unclassified systems, revealing they targeted its sanctions office. In addition to the previously reported hack of other treasury systems. CNN reports the sanctions office had recently penalized a Chinese company for cyberattacks, raising questions about whether the hack was retaliatory. The breach also affected the Committee on Foreign investment in the U.S. which oversees foreign investments for national security risks. This comes as the committee gained new authority over real estate deals near military bases, an area of growing concern for potential Chinese espionage. While no classified information was accessed, officials worry that the stolen, unclassified data could still provide useful intelligence for Beijing. Treasury Secretary Janet Yellen called the breach a blow to U. S China relations, emphasizing the need for stronger cybersecurity measures. The Supreme Court is considering whether to block a law that could ban TikTok in the US if its China based owner ByteDance, doesn't divest by January 19th. The law, enacted with bipartisan support, aims to address national security concerns over potential Chinese government influence on the platform. TikTok and users argue the ban violates First Amendment rights. During oral arguments, TikTok's attorney denied direct Chinese control and compared the divestment to shutting down a US Newspaper under foreign pressure. Mandiant reports that Chinese hackers have exploited a zero day flaw in Ivanti Connect secure VPN appliances since December, deploying malware such as Spawn, Phase Jam and Dryhook to steal credentials, API keys, and VPN session data. CISA has mandated remediation by January 15th. Researchers warn of widespread exploitation, targeting credentials and deploying Web shells for future access. The attacks linked to Chinese Silk Typhoon hackers follow recent breaches of the Treasury Department's systems. A new credit card skimmer malware targets WordPress checkout pages, injecting malicious JavaScript into the database's WP options table to steal sensitive payment details. This approach evades detection by bypassing theme files and plugins, enabling covert operation. The malware dynamically creates fake payment forms or intercepts real ones, capturing credit card information in real time. Data is encrypted and sent to attacker controlled domains to mitigate risks. Experts recommend checking HTML widgets for malicious scripts, applying security updates, and using firewalls and two factor authentication. The Banshee macOS Infostealer has been updated to target systems using the Russian language, according to Check Point. Initially launched in 2024 and sold for $3,000 a month, the malware collects data such as passwords, browser information, and cryptocurrency wallets. After its source code leaked In November of 2024, antivirus detection improved, but concerns grew over new variants. Recent updates removed restrictions on targeting Russian systems and Banshee is still spread via phishing websites and fake GitHub repositories, likely by former customers or new actors. California's Baymark Health Services reported a data breach affecting patients personal information, including names, Social Security numbers, insurance details and treatment information. The breach, linked to a cyberattack between September 24 and October 14, 2024, was discovered on October 11. Baymark Secured Systems launched an investigation with forensic experts and notified law enforcement. Impacted individuals received formal notifications and one year of free credit monitoring. Baymark says they've since enhanced their security measures to prevent future incidents. Florida based USR holdings has paid a $337,000 HIPAA settlement following a 2018 breach exposing the personal information of nearly 3,000 patients. The breach occurred after a firewall misconfiguration allowed unauthorized access, resulting in data deletion. HHS found multiple HIPAA violations, including insufficient risk analysis and backup procedures. USR agreed to implement a corrective action plan and will be monitored for compliance. Experts emphasize robust data backup, disaster recovery plans and proactive monitoring to prevent similar incidents. This marks HHS's largest HIPAA find in 2025 so far. Samsung Mobile has released its January 2025 security maintenance release addressing critical vulnerabilities in Android and Samsung devices. The update resolves five high priority common vulnerabilities and exposures that could allow execute arbitrary code, risking sensitive data and device control. It also includes 22 Samsung specific patches. Samsung urges users to update promptly for improved safety, device performance and longevity. Proton experienced a major worldwide outage yesterday, disrupting services like ProtonMail, Calendar, VPN Drive Pass and Wallet due to network issues. The outage began at 10am Eastern time, leaving many users unable to access their accounts. Just after 12:30pm ProtonMail was restored with all services back online right around 1:30pm ProtoN apologized for the disruption and continues to investigate the issue. Users initially reported error messages when attempting to access affected services during the outage. Malwarebytes uncovered a cyber attack dubbed the ZQXQ campaign, targeting GroupGreeting.com, a popular e card site used by major enterprises like Airbnb and Coca Cola. Exploiting seasonal traffic spikes, attackers injected obfuscated JavaScript to redirect users to phishing sites or malware. The campaign shares traits with the ndsw, NDSX and TDS Parrot malware known for large scale infections and traffic distribution system tactics. Over 2,800 websites have been affected. Group greeting quickly resolved the breach. Adam Gaudiak, CEO of Ag Security Research, has exposed vulnerabilities in Microsoft's PlayReady DRM technology enabling unauthorized access to streaming content keys. His research highlights flaws in Microsoft's Protected Media Path and Warbird compiler, raising concerns about unauthorized downloads from services like Netflix and HBO Max. While Microsoft initially dismissed the findings as implementation issues, Gaudiak advocated for compensation outside the bug bounty program, citing extensive effort and intellectual property concerns. When no agreement was reached, Gaudiak provided technical details to Microsoft in November of last year without seeking payment later, disclosing limited public details to raise awareness. Critics argue this case underscores flaws in bug bounty programs and responsible disclosure practices. Casey Ellis of bugcrowd stressed the need for standardized terms and coordinated disclosure, warning against tactics resembling extortion. The incident highlights ongoing challenges in balancing researcher incentives, corporate responses, and public accountability. Elsewhere, Facebook awarded a $100,000 bug bounty to researcher Ben Sadaginpour for discovering a critical vulnerability in its ad platform. The flaw, linked to an unpatched Chrome bug, allowed Sadegunpour to execute commands on Facebook's internal server, granting extensive access to its infrastructure. Working with Alex Chapman, he reported the issue in October of last year, prompting Meta to address it within an hour. Coming up after the break, Chris Hare interviews our Guest Casey Marks, ISC2's chief qualifications officer, about the future of certifications and that's a feature, not a hack. Stay with us.