← Risky Bulletin
Risky Bulletin
Risky Biz News: Unpatched zero-day in Palo Alto Networks is in the wild
00:11:23
PLUS: T-Mobile joins the Salt Typhoon victim list; NSO developed new WhatsApp exploits after lawsuit; O2 AI keeps phone scammers busy.
Loading summary
Transcript1 lines
- [00:04]
Claire Aired
Flaws used in the wild in Fortinet and Palo Alto Network software T Mobile joins the list of Salt Typhoon victims, NSO developed a new WhatsApp exploit after a lawsuit and a British telco develops an AI that keeps phone scammers talking in circles. This is Risky Business news prepared by Catalyn Kimpanu and read by me Claire aired. It's the 18th of November and in today's top story, details of a zero day vulnerability in Palo Alto Network software and a design flaw in a Fortinet product were published on Friday, every IT engineer's favourite day for emergency security procedures. The zero day impacts Palo Alto Network's firewall appliances, while the design weakness affects Fortinet's Windows VPN client. The Palo Alto zero day is believed to be related to an alleged exploit sold on the Exploit Hacking forum earlier this month. The company issued a security alert about the rumoured exploit 10 days ago and has now updated the advisory to confirm live exploitation. The zero day is a pre auth remote code execution in the Firewalls web management interface. Palo Alto Networks has asked customers to restrict access to the management panel to trusted IPs only and to it releases a patch. The Fortinet weakness is described by Velexity as a zero day vulnerability, but looks more like a design weakness to us. It allows attackers to extract VPN credentials in clear text from the VPN client's memory. Security firm Velexity says the weakness was exploited on systems that were previously infected with the Deep Data infostealer malware. Fortinet is yet to release a fix for the bug. Velexity linked the malware to a threat actor it tracks as Brazen Bamboo. Neither of the Two issues have CVEs. US wireless carrier T Mobile has been named as the fourth victim of Chinese cyber espionage group Salt Typhoon. The breach was part of a large scale campaign that targeted US telcos and which also compromised AT&T lumen and Verizon. The breaches allowed Chinese hackers to spy on American political figures and compromise law enforcement wiretapping systems. CISA director Jen Easterly will depart her role on January 20 next year, the day Donald Trump is inaugurated as the next US President. Easterly has already notified staff via email and at an all hands staff meeting. According to a Next Gov report. Several of her staff will also depart the agency on the same day. Easterly has served as Sisa's head since July 2021. Israeli spyware company NSO Group continue to develop and use WhatsApp exploits even after Meta sued the company in a US court. Unsealed court documents reveal that NSO developed three exploits named Eden, Heaven and Hummingbird, with the last being used in the wild months after Meta's 2020 lawsuit. In addition, court documents also reveal that NSO employees were the ones deploying the exploits against customers targets. This contradicts previous NSO statements that the company didn' know how customers were using its hacking tools. France's counter espionage agency says an Iranian cyber group named Yemenay Pasagad targeted Israeli athletes during the Paris Olympic Games. According to French news site Mediapart, the operation included phishing, mobile malware, data leaks and even death threats. The group is primarily known for interfering in the US 2020 presidential election when it hacked voter websites and posed right wing group Proud Boys to send threatening emails to Democrat voters. Spain's data protection agency has fined electronics retail chain store phone house 6.5 million euros over a 2021 security breach. The company was the victim of the Babuk ransomware, which leaked the personal details of 13 million customers after Phonehouse refused to pay a ransom. Spain's data protection agency fined Phone House for failing to anonymise customer data and for storing the information plain text. Phone House is the largest telco electronics retail chain in Europe, with over 400 stores. A threat actor has stolen over $25 million in crypto assets from the Thaler Defi platform. The company says it immediately identified the attacker and negotiated a return of all funds for a $300,000 bounty payment. Thaler says it will return all stolen funds to user accounts once it re audits its code base. Germany's statistics agency Destatus is investigating a possible breach of its IT network after some of its data was put up for sale by pro Russian hackers. The agency has taken its IDEV data sharing system offline while it investigates the incident further. The system is used by private companies and state and federal governments to share statistical data and reports. Google is working on a new email masking feature for its Gmail service called Shielded Email. The feature will allow users to generate generate random looking usernames to use in online forms and hide their real email addresses. Users will be able to delete the email aliases if they start receiving spam through one of them. The feature is not new, as both Apple and Mozilla already offer a similar service in Icloud, Hide My Email and Firefox Relay. Google has rolled out security improvements to its C code to protect against spatial memory vulnerabilities. These are vulnerabilities such as buffer overflow and out of bounds access. The company says it's now using a hardened version of the LIBC library in its production environments. The code is now live in search, Gmail Drive, YouTube and Maps after it was initially tested in Chrome in 2022. Google says the more robust library only introduces a 0.3% performance impact. British Internet service provider O2 says it developed an AI system that mimics an elderly lady to fight off phone fraud. The system detects suspected phone scammers and keeps them on the phone for as long as possible, posing as a gullible victim. O2 says the new Daisy Granny AI has successfully kept multiple scammers on the phone for more than 40 minutes at a time. A US senator has asked gaming platform Steam to crack down on extremist and hateful content on its platform. Senator Mark Warner cited a recent report from the Anti Defamation League that found over 1.5 million users and over 73,000 group sharing at least one potentially extremist or hateful symbol, text or keyword. According to the Verge, this is the third time in three years that Congress has asked Steem about its moderation practices. The platform has been one of the slowest to address hateful conduct, having only added moderation tools to ITS forums in 2018. The US Federal Trade Commission says the number of telemarketing calls has halved since 2021. The agency says 2024 is the third year in a row when it has registered a dec robocalls across the U.S. the FTC credits the decline to new rules banning unwanted calls and its crackdown on illegal telemarketing services. US Authorities have sentenced Ilya Lichtenstein to five years in prison for hacking cryptocurrency exchange Bitfinex. Officials say lichtenstein stole almost 120,000 bitcoin from the company's wallets in August 2016. He laundered the stolen funds with the help of his wife, Heather Morgan, until they were both detained in February twenty both pleaded guilty to their crimes. Besides his prison sentence, Lichtenstein will also serve three years of supervised release. Morgan is scheduled to be sentenced this week. The funds were worth $70 million at the time of the hack, but are now valued at more than 10.5 billion. We're still hoping for an enhanced sentence for Heather's crimes against music. A US judge has sentenced an Ohio man to three years in prison for operating a Dark web based cryptocurrency mixer, officials say. Larry D. Dean Harman was the administrator of Helix, a service that laundered over $310 million in crypto assets linked to dark web drug markets. Harman ran Helix between 2014 and 2017 and was arrested in 2020. Harmon's brother is already serving a prison sentence of four years and three months for hiding some of Helix Mix's funds in his personal accounts. US authorities have sentenced an Australian man to over five years in prison for participating in a scheme to distribute a non encrypted devices to criminal syndicates. Osema El Hasan of Sydney, Australia, was one of 17 suspects detained in 2021 in connection to the ANOM encrypted phone service, according to officials. El Hasan worked as the company's distributor in Colombia, where he was arrested and later extradited to the U.S. u.S. Authorities have charged three Indiana residents over a SIM swapping scheme. Officials say the group performed sim swaps for themselves, but also in exchange for money for other individuals. The TR allegedly hijacked accounts, stole funds from their victims and also demanded ransoms to restore access to stolen accounts. The three suspects were arrested last week. A botnet operator is using a zero day vulnerability to take over geoserver cameras and video servers. The attacks were spotted last week by Taiwan Cert and are exploiting an unauthenticated command injection in the device's firmware. The devices have reached end of life and no patch is available. According to the Shadow Server foundation, There are around 17,000 vulnerable systems currently connected to the Internet. A security researcher has published details and proof of concept code for a vulnerability in the gogs version control system after the project failed to release a patch. The vulnerability allows threat actors to run malicious code on GOG's version control servers. While the vulnerability does not have a patch, the only upside is that attackers need to access an account to run the exploit. Security researcher Fisac has urged gogs admins to disable user self registration and enforce MFA to prevent attacks. And finally, security researchers have discovered a major vulnerability in a WordPress security plugin installed on more than 4 million websites. The bug is an authentication bypass in really simple security and allows attackers to access any account on a WordPress site. Wordfence researchers describe the bug as one of the most serious vulnerabilities they've reported in the company's 12 year history. And that is all for this podcast edition. Thanks for your company.