← Risky Bulletin
Risky Bulletin
Risky Biz News: Most of 2023's top exploited vulnerabilities were initially zero-days
00:06:44
PLUS: State Dept disinfo center faces shutdown; US to back controversial UN cybercrime treaty; Google Cloud to issue cloud CVEs.
Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Most of 2023's top exploited vulnerabilities were initially zero days a State Department disinfo centre faces shutdown the US will back a controversial UN cybercrime treaty and Google Cloud to issue Cloud CVEs. This is risky Business news prepared by Catalyn Kimpanu and read by me Claire aired today is the 13th of November and this podcast episode is brought to you by Kroll. Find them at kroll.com cyber the majority of the most frequently exploited vulnerabilities last year were zero days when they were first used in the wild, according to cisa. This includes the bug that forced Barracuda to tell customers to replace their ESG appliances, the Zero Day used in the MoveIt hacking spree, and the Citrix bleed vulnerability. 2023 is also the first year on record when the most popular vulnerabilities were disclosed in the same older CVEs dominated previous lists of popular exploits. The 2023 data also showed a trend toward the exploitation of enterprise and network perimeter devices. All the top 15 vulnerabilities were in enterprise software. In other news, the US Congress has killed off a State Department office that hunts down foreign disinformation campaigns. The Global Engagement Centre will cease operations when its current seven year mandate ends in December. One of the office's biggest critics has been Elon Musk, who accused it of trying shape social media content after it exposed Russian and Chinese information operations on Twitter. The centre has a yearly budget of $61 million and around 130 employees. In other news, the US government will support a controversial UN cybercrime treaty. According to a report from Politico. The treaty has been put forward by the Russian government and has been heavily criticised for promoting surveillance under the guise of policing cybercrime. Digital rights groups have warned the treaty gives authoritarian regimes the power to har critics located abroad. U.S. officials believe the treaty has positives such as new legal frameworks to pursue cybercriminals and CSAM offenders. A vote is scheduled for this week and the treaty needs approval from two thirds of UN members to be ratified. Chinese APT vault Typhoon has rebuilt its KV botnet 10 months after US authorities took it down. Security Scorecard says the group has rebuilt the botnet by targeting old Cisco RV and Netgear Prosafe routers. Both device types were a core part of the botnet's earlier iteration. Fault Typhoon first attempted to rebuild its botnet days after the US takedown, but that initial attempt failed. The Chinese group has used the botnet to disguise the origin of its attacks, many of which target US Critical infrastructure. A Hamas affiliated APT group has expanded operations beyond cyber espionage and is now conducting data wiping attacks against Israeli organizations. Checkpoint says it's connected the Wirt group's older malware to Same Coin, a data wiper deployed across Israel in February and October this year. The company says it's one of the few Hamas cyber groups that has remained active through the current Israeli Palestine conflict. Retail store giant Ahol Delaires says a cybersecurity incident has disrupted its US Network operations. Online stores for the company's US Brands were offline over the weekend. The company says it's still investigating the incident. EU operations are not affected. Ahold Del is one of the world's largest retailers, with around $87 billion in annual revenue. Its US brands include food Lion, Stop and Shop and Henneford. A threat actor has stolen $4.8 million worth of assets from the Delta prime crypto brokerage platform, according to blockchain security firm Certik. The attack combined two vulnerabilities to execute Flash loan attacks and steal arbitrum and avalanche tokens from the platform's wallets. Delta has confirmed the hack and says it has contained the incident. Certik researchers say Flash loan attacks have declined, accounting for only $104 million in losses this year compared to $313 million last year. Microsoft has expanded the account guard service to African countries. The service provides extra protection for sensitive user accounts belonging to political campaigns, think tanks, NGOs and journalists. The program will initially be available in Nigeria, Kenya and South Microsoft plans to expand it to Ghana and other countries in the future. Google says it will begin assigning CVE identifiers to vulnerabilities reported in its Google Cloud service. The company says it will issue CVEs for critical bugs even if no customer action is required and patching is managed automatically. Google Cloud is the third major cloud Vendor to issue CVEs for cloud vulnerabilities. Alongside AWS and Microsoft. Signal is rolling out call links, a new feature that allows users to easily join a secure group video call by just clicking a link, similar to Google Meet's Meeting Link generator. This is an improvement over the old system, where users had to join the same signal group before initiating a group call. UK Police say that scammers are sending SMS messages offering heating subsidies. The scams exploded after the UK Government cut winter heating subsidies for pensioners in September. Officials have warned residents not to enter any personal or banking information into links they receive via sms. Watchtower Labs has identified a remote code execution attack against the Citrix virtual apps and Desktop client. The vulnerability exploits a deserialization bug in a feature that allows Citrix admins to record virtual desktop sessions. Citrix appears to have released patches without notifying the researchers. The company claims attackers must be authenticated to execute an attack, while Watchtower says unauthenticated attacks are possible. Proof of concept Code has been released on GitHub this week, and finally yesterday was the November patch. Tuesday don't forget to install your Windows security updates, which this month include fixes for two actively exploited zero days. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Kroll. Find them@kroll.com cyber thanks to your company.