← Risky Bulletin
Risky Bulletin
Risky Bulletin: African freelancers behind anti-US and anti-French disinfo campaigns
00:07:51
Loading summary
Transcript1 lines
- [00:04]
A
Russia is hiring African freelancers for disinformation campaigns the US Is preparing to let contractors run offensive cyber operations. Germany blames Russia for the hack of its air traffic control agency and Apple patches 2 WebKit 0 days this is the risky bulletin prepared by Catalyn Kimpano and read by me, Claire Airdrop. Today is the 15th of December and this podcast episode is brought to you by Push Security. In today's top story, a network of freelancers are behind a disinformation campaign targeting African audiences. Meta identified the campaign and said it had been running for the last six months. Most of the freelancers are based out of Sub Saharan Africa and advertise their services on job seeking portal upwork. Meta says the freelancers are being paid by entities based in Russia. The campaign published content critical of France and the US and promoted Russian geopolitical narratives. In other news, the Trump administration is preparing an executive order which will allow private companies to carry out offensive cyber operations on behalf of the government, according to Bloomberg. The Office of the National Cyber Director is preparing a strategy document to support the move. The document will also call for streamlining cyber regulations, adopting post quantum cryptography and securing critical infrastructure. Congress has already allocated $1 billion for offensive cyber operations in the annual spending bill. Two US lawmakers have introduced a bill to help secure the country's commercial satellites. The Satellite Cybersecurity act was initially proposed in 2023. It directs the Commerce Department to develop cybersecurity recommendations for orbital assets. The guidelines will be voluntary. U.S. lawmakers have introduced a bill to phase out the use of Chinese LIDAR technology. Officials cite risks to national security, such as data exfiltration, sabotage and the compromise of critical infrastructure. LIDAR sensors use lasers to measure distance and are important in a large number of domains, including military equipment. Germany has accused Russia of hacking its air traffic control agency last year. The hack has been blamed on APT24, a unit inside Russia's military intelligence agency. German officials have also accused Russia of interfering with last year's elections through disinformation, according to the Geneva project. Those campaigns are still ongoing. Last week, Germany summoned the Russian ambassador to make a formal complaint. French authorities are investigating a breach at the country's Interior Ministry. Hackers have allegedly breached the agency's email server. Officials have not yet attributed the attack. The South Korean government will introduce fines for businesses that suffer repeated data breaches. The legislative effort comes after major breaches at SK Telecom, KT&E commerce giant Coupang. Companies with repeated security breaches will face fines of up to 3% of their annual sales. Fines will also be increased for failing to report breaches promptly. Pope Leo has asked Italy's intelligence service to respect people's privacy. The pope made the request at a ceremony celebrating the centenary of the country's spy service. The service is under fire for using spyware to hack and surveil activists, including several priests. Apple has released a security update to patch two actively exploited WebKit zero days. Apple says the zero days were used in what it described as an extremely sophisticated attack. The Targeted users ran iOS versions older than the current release. The attacks were spotted by Google's security team. The WebKit patches were released on the same day. Google also patched a zero day in Chrome. A photo booth maker has exposed all its customers photos and videos online. Hammer Film has still not secured its systems after being notified of the leak in October. The company operates photo booths In Australia, the UAE and the US American credit check company 700 Credit has disclosed a security breach. The incident took place in October and impacted 5.6 million customers. Personal information such as names, home addresses and Social Security numbers were exposed. Home Depot's cloud infrastructure was exposed for more than a year after a GitHub secret was posted online. An employee inadvertently exposed a GitHub personal access token. It had write permissions to code repositories that supported the company's order fulfilment and inventory management systems. The company was notified by a security researcher, but only revoked the token after being contacted by a reporter from TechCrunch. A USB stick release of a manga game came pre infected with malware. Gaming studio MangaGamer has withdrawn the USB version of its visual novel Higurashi When They Cry. How? Digital versions of the game were unaffected. The company says only 67 copies of the game were sold in USB stick form. The USB drives were infected with the Floxif Windows virus. Secure messaging app Freedom Chat has fixed two vulnerabilities that exposed its users phone numbers and pins. The issues were discovered by security researcher Eric Daigle. Freedom Chat has reset all user pins to prevent abuse. The messaging app has been promoted in the MAGA community as an alternative to more mainstream applications. The free PBX open source telephony software has patched several security flaws. The project fixed an authentication bypass, several SQL injections and a file upload bug that can lead to remote code execution. All the bugs are found and reported by security firm Horizon 3. Almost 12,000 free PBX servers are connected to the Internet. AutomationDirect has released security updates for its Click programmable logic controllers seven vulnerabilities were discovered and reported by Nozomi Networks. They include the use of hard coded cryptographic keys and passwords, the use of weak cryptographic algorithms, and predictable random numbers. The affected PLCs are typically used for factory floor machinery and amusement park rides. Chinese researchers have published more than 2,700 research papers on the US power grid and its vulnerabilities, according to security firm Strider. Some of the research was conducted by entities tied to China's military and security services. At least 225 of the papers explored potential attacks on the US grid. US authorities have charged a man with destruction of evidence after he reset his phone to factory settings. Atlanta activist and musician Samuel Tunick allegedly wiped his phone when returning from an international trip in January. He was detained by Customs and Border Patrol agents at Atlanta Airport and asked to unlock his device. Tunick had been involved in protests against the construction of a police facility in the city and finally, a new security feature is on the way for Microsoft 365. The new baseline Security Mode can automatically configure minimum security settings for some cloud applications. The feature began rolling out in phases last month and and will complete by next March. It'll be available for office, SharePoint, exchange teams and Entra. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them@PushSecurity.com thanks to your company.