Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Biden signs his last cyber Executive Order, A threat actor leaks 15,000 Fortinet firewall configs, the US treasury sanctions a company behind Salt Typhoon and the NFTC settles with GoDaddy over its many cybersecurity failures. This is the Risky Bulletin prepared by Katalin Kimpanu and read by me, Claire aird. Today is the 20th of January and this podcast episode is brought to you by Resource, the company that can help you manage Terraform securely. In today's top story, outgoing U.S. president Joe Biden has signed an executive order that places new cybersecurity requirements on federal agencies and their contractors. New obligations include deploying Phishing Resistant authentication systems, encrypting email traffic, and using encrypted communications systems. Federal agencies will also have to secure their address space and routing, share detection data with CISA, and only buy IoT devices that feature the US Cyber Trust Mark. The executive order also expands the legal powers of federal agencies to sanction foreign threat actors that target US Critical infrastructure. In other news, the US treasury has imposed sanctions on Sichuan Xuxinque Network Technology, a Chinese cyber security company linked to the Salt Typhoon APT group. The US Says the company was directly involved in hacking multiple US Telcos. CISA Director Jen Easterly says the Salt Typhoon Group was also active on several federal networks before the group's telco hacks. Easterly says the early detection allowed CISA to seize one of the group's servers and spot the larger campaign. The US treasury has also sanctioned Shanghai based Yin Keqiang, who was involved in hacking the treasury itself late last year. Officials say. Yin is a Ministry of State security affiliate and his work supported the Chinese APT group Silk Typhoon. According to a private intelligence report, the group had direct access to over 400 laptops and desktop computers inside the U.S. treasury. The agency says Silk Typhoon stole over 3,000 unclassified documents in December, operating outside of normal working hours to avoid detection. The intrusion targeted the agency's sanctions and foreign investment bureaus, and US Treasury Secretary Janet Yellen's computer was one of the compromised systems. Web hosting company GoDaddy has settled an FTC investigation into its many security failures. The company has agreed to set up a robust security program and is prohibited from misleading customers about its security features. GoDaddy will have to roll out multi factor authentication for customers and employees, remove outdated gear from its network, and protect its APIs. The agency did not impose a fine. The FTC has also banned American carmaker General Motors from collecting and selling its customers information for five years. The agency's actions come after reports that GM sold geolocation data and driver behaviour to insurance companies. The data was used to raise insurance rates for drivers based on their driving styles. The European Commission has unveiled a plan to strengthen cybersecurity in the healthcare sector. Officials plan to build an EU wide early warning service service that will deliver alerts on potential cyber threats. The EU will also establish a rapid response service using trusted private service providers to help hospitals deal with cyber attacks. The scheme also includes financial assistance for smaller hospitals and healthcare providers. Almost 100 foreign governments have purchased spyware designed to compromise cell phones. The head of the US government's counterintelligence agency, Michael Casey, says the mobile spyware market has seen huge growth, with dozens of companies selling surveillance products. The agency says nearly 20 new countries have acquired mobile spyware since 2023. A threat actor breached the Amazon S3 cloud storage environment of hotel management platform Otelia in July last year. Otelia's platform is used by big chains like Marriott, Hilton and Hyatt to manage reservations. Over 10,000 hotels use the platform and the attacker is believed to have stolen the data of millions of customers. The company has confirmed the breach, which allegedly took place Vi and employees stolen Atlassian credentials A threat actor has leaked config files and login credentials for over 15,000 Fortinet firewalls, according to security researcher Kevin Beaumont. The data was collected in October 2022 using what was a zero day vulnerability at the time. Security researchers have extracted the IPs of all affected devices and are notifying affected organisations. The threat actor behind the leak calls itself the Belson Group. A Russian apt group Microsoft calls Star Blizzard is targeting the WhatsApp accounts of government officials and organisations that provide support to Ukraine. The group has been linked to Russia's FSB intelligence service. Microsoft claims the group mixed up its TTPS to target WhatsApp accounts after the FBI seized some of the group's server infrastructure in October. And finally, the Kubernetes project has patched a vulnerability that could have allowed threat actors to take over compute nodes. Vulnerability allowed attackers who could query a node's logging endpoint to execute commands. Only nodes running on Windows are impacted and that is all for this podcast edition. Today's show is brought to you by our sponsor Resourcely. Find them@resourcely IO. Thanks for your company.