Risky Biz News: Microsoft’s thanksgiving treat: an FTC investigation

Summary

Risky Business News Summary: Microsoft’s Thanksgiving Treat - An FTC Investigation

Podcast Information:

• Title: Risky Business News
• Host/Author: risky.biz
• Description: Regular cybersecurity news updates from the Risky Business team.
• Episode: Risky Biz News: Microsoft’s Thanksgiving Treat: an FTC Investigation
• Release Date: November 29, 2024
• Prepared by: Catalyn Kimpanu
• Read by: Claire Aird

---

1. Federal Trade Commission Launches Antitrust Probe into Microsoft

In the episode's leading story, Claire Aird reports that the U.S. Federal Trade Commission (FTC) has initiated a comprehensive antitrust investigation into Microsoft's business practices. The investigation encompasses various facets of Microsoft's operations, including its software licensing, cloud computing, cybersecurity, and AI business units. This move comes amid allegations from customers who claim that Microsoft is engaging in "locking them in and preventing them from moving to competitors" (00:04).

Aird highlights that this scrutiny mirrors previous actions within the industry, noting that "in September, Google filed an official antitrust complaint against Microsoft's cloud business in the EU" (00:04). This suggests a growing concern among regulators about the dominance of major tech companies and their impact on market competition.

2. Tor Project Seeks Support to Bypass Russian Censorship

The podcast discusses the Tor Project's urgent request for 200 new bridges by the end of December to help Russian users maintain access to the Tor network (00:04). These bridges, specifically those running the Web Tunnel protocol, are essential as they disguise Tor traffic as regular web browsing, making it more resistant to detection and censorship. Currently, the project operates 143 servers, and the additional bridges are critical to ensuring reliable and secure access for users in regions with stringent internet controls.

3. UK's Commitment to Cybersecurity Assistance for Allies

Claire Aird reports that the UK Government has announced plans to offer incident response assistance to allied nations facing cyberattacks, particularly those targeting critical infrastructure (00:04). This initiative was unveiled at a recent NATO cyber conference, where UK Minister for Intergovernmental Relations Pat McFadden emphasized the strategic importance of supporting allies amidst escalating cyber threats. McFadden stated, "The assistance is aimed specifically at countries dealing with attacks on critical infrastructure" (00:04), highlighting the UK's proactive stance in global cybersecurity collaboration.

4. India Implements New Cybersecurity Regulations for Telecoms

The Indian government has enacted stringent new cybersecurity rules for the telecommunications sector, mandating that telecom operators report cybersecurity incidents within six hours of detection, with comprehensive reports due within 24 hours (00:04). Additionally, these regulations require telcos to log traffic data and provide authorities with access during emergencies. However, the lack of specificity regarding the types of data to be logged and oversight mechanisms has raised concerns. Legal experts warn, "The new regulations may be abused for surveillance and may incur huge costs to telcos" (00:04), pointing to potential privacy issues and financial burdens on service providers.

5. FBI Probes Exxon Mobil Consultant in Hack and Leak Scheme

A significant segment covers the FBI's investigation into an Exxon Mobil consultant implicated in a hack and leak operation targeting climate change activists. According to Reuters, the consultant allegedly hired hackers to infiltrate groups such as Greenpeace, the Union of Concerned Scientists, the Rockefeller Family Fund, and Tom Steyer, a prominent environmentalist. The stolen data was reportedly shared with Exxon before being leaked online, allowing the company to portray itself as a victim of political vendettas amid rising climate change litigation.

6. T-Mobile Identifies Origin of Recent Cyberattack

T-Mobile has disclosed that a recent attempted hack of its telecommunications infrastructure originated from another provider's network (00:04). The company swiftly severed connectivity with the implicated provider upon detecting suspicious reconnaissance activity. T-Mobile's Chief Security Officer, Jeff Simon, stated, "No sensitive customer data was exposed in the attack, but we believe the provider may still be compromised" (00:04). Simon further suggested that the attack was likely orchestrated by the Chinese espionage group Salt Typhoon, known for targeting multiple U.S. telco providers, including AT&T and Verizon.

7. Zello Advises Early Users to Change Passwords

Zello, a push-to-talk app with 140 million registered users, has recently advised customers who created an account before November 2 to change their passwords (00:04). While the company has not publicly confirmed any security breaches, this precautionary measure is typically a response to potential data breaches or credential stuffing attacks. Users are encouraged to update their credentials to safeguard their accounts against unauthorized access.

8. Ransomware Attack Forces Hoboken, NJ to Shut Down Government Operations

The city of Hoboken, New Jersey, has experienced a severe ransomware attack, leading to the shutdown of government offices, including City Hall, local courthouses, and public sanitation services (00:04). Currently, no ransomware gang has claimed responsibility for the attack. The incident underscores the increasing threat of ransomware to municipal operations and the critical need for robust cybersecurity defenses within local governments.

9. US Fifth Circuit Overturns Sanctions on TornadoCash

In a landmark decision, the US Fifth Circuit Court of Appeals has overturned the US Treasury Department's sanctions on the cryptocurrency mixing service TornadoCash (00:04). The court ruled that the Treasury had overstepped its authority by sanctioning software rather than property. This decision sided with six cryptocurrency users who contended that only tangible assets could be sanctioned. Aird notes, "The court ruled that the US treasury can only sanction property and not software" (00:04). TornadoCash has been associated with large-scale cryptocurrency money laundering operations, including activities by drug cartels and state-sponsored hacking groups.

10. European Authorities Crack Down on Pirated Sports Streaming Platform

European law enforcement has successfully dismantled a significant sports streaming platform accused of copyright infringement (00:04). Authorities detained 11 suspects and seized over 100 domains linked to the platform, which reportedly broadcasted pirated streams from over 2,500 channels. The operation had amassed 22 million registered users and generated revenues of 250 million euros per month, highlighting the lucrative nature of online piracy and the ongoing efforts to combat it.

11. ESET Discovers First UEFI Bootkit Targeting Linux Systems

ESET researchers have identified what appears to be the first UEFI bootkit specifically designed to target Linux operating systems, named Bootkitty (00:04). Tailored for Ubuntu distributions, Bootkitty represents a sophisticated threat vector, although ESET reports no evidence of its deployment in real-world attacks: "Based on current evidence, the bootkit appears to be just a proof of concept" (00:04). This discovery underscores the evolving landscape of malware targeting diverse operating systems.

12. Emergence of Godloader Malware Strain Using Godot Engine

A new malware strain known as Godloader has been detected, infecting at least 170,000 systems (00:04). Unique in its approach, Godloader leverages the Godot game engine to generate cross-platform payloads, enabling it to infect various devices before deploying additional malware on compromised hosts. While most infections currently affect Windows devices, the malware's versatile nature poses a potential threat across multiple operating systems, necessitating heightened cybersecurity vigilance.

13. Research Highlights Risks of Emergency Vehicle Lights on Autonomous Driving Systems

Academic research presented in the podcast reveals that the flashing lights of emergency vehicles can disorient automated driving systems, potentially leading to car crashes (00:04). The study found that this effect is particularly pronounced at night, where distance to emergency vehicles and the self-driving car's camera settings exacerbate the disorientation. This behavior impacts both commercial and open-source advanced driver assistance systems, emphasizing the need for improved sensor technology and algorithms to ensure the safety of autonomous vehicles in emergency scenarios.

---

Conclusion: The episode of Risky Business News delves into a spectrum of critical cybersecurity issues, from high-profile antitrust investigations and international cyber assistance to emerging malware threats and vulnerabilities in autonomous systems. Host Claire Aird provides insightful commentary, supported by expert quotes and timely updates, making the episode a comprehensive resource for understanding the current cybersecurity landscape.

---

This summary is based on the transcript provided and aims to encapsulate the key discussions and insights shared in the podcast episode. For detailed information, listening to the full episode is recommended.

Transcript

[Claire Aird]

The Federal Trade Commission opens an antitrust probe into Microsoft Tor needs 200 new bridges to avoid Russian censorship, a US Court of Appeals overturns the Tornado Cash sanctions and ESET finds an Ubuntu boot kit. This is Risky Business News, prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 29th of November and this podcast episode is brought to you by Stairwell St. Stairwell lets you know if, when and where malware has ever been on your systems by collecting, storing, and continuously reassessing every executable file and indicator of compromise in your environment. Find [e-mail] in today's top story, the US Federal Trade Commission has opened a broad antitrust investigation into Microsoft's business practices. The investigation will cover the company's software licensing practices, cloud computing, cybersecurity and AI Business business units. The FTC allegedly received complaints from customers that Microsoft was locking them in and preventing them from moving to competitors. In September, Google filed an official antitrust complaint against Microsoft's cloud business in the eu. In other news, the Tor project says it urgently needs at least 200 new bridges by the end of December to ensure Russian users can continue accessing the Tor network. The project says it specifically needs bridges that run the Web Tunnel protocol. Webtunnel disguises connections to the Tor network as mundane web browsing activity and is harder to detect and censor compared to normal Tor bridges. The Tor project launched Web Tunnel Bridges in March and is currently running 143 servers. Tor admins believe 200 more servers would ensure Russian users will have enough service available to connect to Tor safely. The UK Government will provide incident response assistance to allied countries dealing with cyberattacks. Officials announced the new capability at a NATO cyber conference this week. UK Minister for Intergovernmental Relations Pat McFadden says the assistance is aimed specifically at countries dealing with attacks on critical infrastructure. UK officials warn that Russia is preparing cyber attacks on critical infrastructure in Western countries as the Ukrainian war escalates. The Indian government has passed new cybersecurity rules for the country's telecommunications sector. The rules require telecom operators to report cybersecurity incidents to the country's regulator within six hours of detecting a breach, with a more comprehensive report due within 24 hours. The new rules also require telcos to log traffic data and grant authorities access in case of emergencies. The rules don't specify what type of data telcos should log, for how long, or oversight for accessing the data. Legal experts warn the new regulations may be abused for surveillance and may incur huge costs to telcos. The FBI is investigating an Exxon Mobil consultant's role in a hack and leak operation. According to Reuters, the consultant allegedly hired hackers to target hundreds of Exxon critics. The consultant allegedly shared stolen data with Exxon before it was leaked online. Exxon used the leaked data to counter climate change litigation by portraying itself as a target of political vendettas. The hacking targeted Greenpeace, the Union of Concerned Scientists, the Rockefeller Family Fund and former Democratic presidential candidate and billionaire environmentalist Tom Steyer. T Mobile says that a recent attempted hack of its telco infrastructure originated from another provider's network. The company says it severed connectivity with the provider as soon as it detected suspicious reconnaissance activity. T Mobile CSO Jeff Simon says no sensitive customer data was exposed in the attack, but he believes the provider may still be compromised. Simon told Bloomberg he believes the attack was carried out by a Chinese espionage group known as Salt Typhoon. The same group also breached at least three other US telco providers such as AT&T Lumen and Verizon Push to Talk App Zello has asked customers who created an account before November 2 this year to change their passwords. Companies usually ask users to reset passwords in the wake of data breaches or credential stuffing attacks. So far, Zello has not publicly confirmed any security breach. The company says it has 140 million registered users. The city of Hoboken, N.J. has shut down its government offices after a ransomware attack this week. The incident impacted the Hoboken City hall, local courthouses and public sanitation. No ransomware gang has taken credit for the attack. The US Fifth Circuit Court of Appeals has overturned the US Treasury Department's sanctions on cryptocurrency mixing service TornadoCash. The court ruled that the US treasury overstepped its authority when it sanctioned the service in September 2022. The court sided with six cryptocurrency users who claim the treasury can only sanction property and not software. The Tornado Cash service has been linked to large scale crypto money laundering operations ranging from drug cartels to state sponsored hacking groups. European law enforcement agencies have taken down a sports streaming platform over copyright complaints. Officials have detained 11 suspects and seized over 100 domains. The unnamed service allegedly broadcasted pirated streams from over 2,500 channels, had over 22 million registered users and was making 250 million euro a month. ESET researchers have spotted what appears to be the first UEFI bootkit targeting Linux operating systems. The bootkit is named bootkitty and was specifically designed to work on Ubuntu distributions. Eset says it has no telemetry to suggest the tool was used in the wild, and based on current evidence, the bootkit appears to be just a proof of concept. A new malware strain named Godloader has infected at least 170,000 systems, according to security firm Checkpoint. The malware is unique because it uses the Godot game engine to generate payloads with cross platform capabilities. The the Godloader gang uses these payloads to infect devices and then deploy additional malware on the compromised hosts. For now, most of the infected systems appear to be Windows devices. And finally, new academic research has found that the flashing lights of emergency vehicles can disorient automated driving systems and lead to car crashes. The behaviour impacts both commercial and open source advanced driver assistance systems. The effect is amplified at night by the distance to emergency vehicles and by the self driving car's camera settings and capabilities. And that is all for this podcast edition. Today's show was brought to you by our sponsor Stairwell. Find [e-mail] thanks for your company.