Loading summary
Transcript1 lines
- [00:00]
A
Foreign this is the Risky Bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 27th of July and this podcast episode is brought to you by Airlock Digital. In today's top story, threat actors are exploiting a vulnerability in the Fast JSON Java library. Details of the bug were published on GitHub last week and and active exploitation began the following day. Exploitation doesn't require authentication and works against the library's default configuration. The bug only impacts older 1x versions. The current 2.x releases are unaffected. The library's developer, Alibaba, hasn't released a patch yet, but it has urged developers to turn on the library's Safe mode or upgrade to a newer, unaffected version. In other news, OpenAI took almost a week to notice that two of its models hacked AI platform Hugging Face. The Rogue model spent two full days inside Hugging Face's environment before being evicted on July 13. OpenAI engineers discovered their models had escaped containment on July 16 after Hugging Face published a blog post about the hack. Meantime, U.S. lawmakers have proposed a bill that would force AI companies to build kill switches for their most powerful models models. The AI Kill Switch act would also require companies to report security incidents to authorities. The bill was proposed after OpenAI models hacked AI platform hugging face the South Korean government will change the email addresses of its diplomatic officials following a recent hack of its Diplomat Training Academy. The Ministry of Foreign affairs is concerned that leaked addresses could be used for spear phishing attacks targeting specific diplomats. Unidentified hackers breached the Korean national diplomatic academy in April 2025. They remained in the system until February this year. The US has indicted a Chinese national over his role in international gift card fraud. Jin Bin Ren received stolen cards from victims through romance fraud, elder fraud, hacking and theft. He allegedly used the cards to purchase high value electronics before shipping them to China where they were resold for a profit. Ren ran a warehouse in Salem, N.H. and and coordinated with other group members over WeChat. The U.S. justice Department is prosecuting a man for allegedly giving U.S. customs and Border Protection agents a duress password. When the agents used the password on Samuel Tunick's phone, the contents of the device were wiped. The Phone was running GrapheneOS, which includes the security feature. Tunick is an activist who opposed the construction of the so called COP City campus in Atlanta. His device was seized by border agents last year when he returned to the US from travelling abroad. Cyberscam compounds are still active in Myanmar despite a public government crackdown. Criminal groups have built smaller compounds rather than using large multi building complexes. They're also running compounds in the jungle away from large population centres. The ruling military junta made a show last year of blowing up buildings from the country's largest scam compound, KK Park Hackers are breaching hotel WI fi gateways to intercept DNS traffic and redirect Victims to Microsoft 365 Phishing sites Security firm Reliaquest first discovered compromised hotel WI fi systems in June. They've been seen in India, Saudi Arabia and across multiple US cities. Researchers believe the campaign could be the work of Russian state hackers. Earlier this year, the US disrupted a Russian botnet of hacked routers that also hijacked Traffic for Microsoft 365 login pages. Malicious residential proxy botnets are growing despite recent law enforcement takedowns. According To Lumen, almost 20 million IP addresses are now part of 30 residential proxy botnets. Almost half of the botnets are of Chinese origin. Many are also renting each other's infected bots as an attempt to look bigger than they actually are. A spear phishing campaign on Telegram is targeting exiled activists and dissidents in Belarus, Russia and Kazakhstan. The campaign attempts to trick targets into handing over single use Telegram passcodes to attackers. The campaign has been traced back to at least 2024. Researchers at resident NGO have not attributed the campaign to any threat actor. Google is rolling out a new naming scheme for threat actors. It will merge the naming schemes of Google's Threat Threat Analysis group with Mandiant, which Google acquired in 2022. Chinese groups will be tracked under the codename Castle, Iranians as Ion, North Korea as Neptune and Russia as Relic. Ecrime groups will be tracked as Comet, while uncategorised groups will continue to be tracked as UNC. A vulnerability in XCharge EV charging stations can allow hackers to take over the devices. According to security firm Salflow. The charging stations expose a misconfigured SSH service on the connector when cars are plugged in. The SSH server uses the default username of root and password of root. Attackers can exploit the bug for free recharges to cause physical damage or to move upstream in the charging operator's network. The RubyGems package repository has patched a CDN caching bug that exposed API keys to the wrong users when they were signing in. RubyGems believes 18% of logins were affected by the leak. The team reviewed logs and found no sign of API keys being used maliciously. GitHub has added a cooldown period for its Dependabot service Dependabot will now wait three days before opening a pull request and prompting developers to install dependency updates. The delay is meant to allow security tools time to detect malicious packages. The cooldown will not apply to security security updates. Dependabot will continue to open pull requests as soon as the security fix is released in a dependency. And finally, the Signal Disappearing Messages feature will now delete call data. The feature previously only applied to text messages or media exchanged between users. And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them@airlockdigital.com thanks for your company.