Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Chris Krebs resigns from Sentinel 1 and vows to fight the Thai army and police doxxed pro democracy dissidents CISA extends Mitre's CVE Contract and Apple patches 2 iOS 0 days this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 18th of April and this podcast episode is brought to you by application. Allow listing software maker Airlock Digital Former CISA Director Chris Krebs has resigned from Sentinel 1 to Mount A legal battle against the White House. Last week the US President ordered a DOJ investigation of Krebs work on securing the 2020 US elections as CISA director and revoked his security clearance. He also ordered an immediate suspension of security clearances held by SentinelOne staff. In an email to SentinelOne staff, Krebs says he intends to fight the order, but that the battle was his and not the company's Krebs Jo joined Sentinel 1 in 2023 and was its chief Intelligence and Public Policy officer. In other news, Thailand's army and police were behind a social media campaign that doxxed and harassed pro democracy protesters online. Personas being operated by the authorities doxxed and harassed dissidents and instructed their followers to report them to the police. This campaign started in 2020, but the Thai army and police set up a so called joint cyber team to coordinate the efforts in 2023. The campaign was unearthed when confidential military and police documents were leaked online last month. CISA has extended Mitre's contract to manage the CVE database. The extension came hours before the current contract was due to expire on Wednesday. It will now expire on March 16 next year. The contract is worth $57.8 million. On Tuesday, Mitre warned partner organisations that the contract had not been renewed and that there could be disrupt. The U.S. state Department office that counters foreign disinformation efforts is being shut down. The Office of Counter Foreign Information Manipulation and Interference was previously known as the Global Engagement Centre. Secretary of State Marco Rubio claimed the office silenced and censored the voices of Americans. The centre previously exposed Russian and Chinese disinformation operations and there's no evidence it censored Americans. Congress defunded the office in December last year. Oklahoma police have arrested the CEO of a cyber security company for allegedly installing malware on a local hospital network. Security footage shows Geoffrey bowie entering the St Anthony Hospital last August and attempting to enter offices before he eventually found an unattended computer. Officials claim Bowie installed malware designed to take a screenshot every 20 minutes and forward the image to an external IP address. Reports have not said if Bowie had been contracted by the hospital to carry out security testing. Fraudsters are using bot accounts to sign up for online community college classes in the US So they can receive financial aid. They submit AI generated work and attempt to remain unnoticed long enough for the funds to be disbursed. Officials in California estimate that roughly one quarter of community college applicants are bots. Last year, BOT students collected more than $11 million in state and federal funds. Shadowservice says more than 17,000 Fortinet devices have been backdoored and are exposing their configuration files. Fortinet warned about the technique in a security advisory last week. Attackers are creating symlinks that connect a publicly available folder from the device's web dashboard to the file system root directory. They can then use this to retrieve configuration files and reinfect the device, even if the original security flaws are patched. Most of the backdoored devices are located in the US and Japan. A threat actor is using leaked AWS credentials to access servers, encrypt data, and demand ransoms of $25,000. The attacker is encrypting the data using a native AWS feature named Server side Encryption with Customer Provided keys rather than custom ransomware. The technique was first used in December last year by a threat actor named CodeFinger. Apple has rolled out iOS security updates to fix two zero days that are being exploited in the wild. The zero days appear to have been used together and were delivered as malicious audio files. Apple says the attack is extremely sophisticated and is targeting specific individuals. The attacks were spotted by both Apple and Google's security teams. A suspected APT group is exploiting a recently patched Windows vulnerability to target government organisations in Poland and Romania. The attacks use malicious Windows library files to leak victims NTLM hashes. According to Check point. The attack triggers when users navigate to the folder where the malicious file is stored. No other interaction is required. A critical vulnerability has been discovered in the Erlang implementation of ssh. The vulnerability allows remote attackers to run malicious code on the SSH server without authentication. Any SSH server using the Erlang OTP library is likely affected. The vulnerability was discovered by a team of German academics and has been given a 10 out of 10 severity rating. And finally, a network of thousands of Russian TikTok accounts are exploiting a loophole in the platform's algorithm in an attempt to influence public opinion in Ukraine. TikTok allows new accounts to go viral, so Russian bot farms are continuously registering new accounts when their old ones are suspended. Ukrainian reporters say some accounts receive hundreds of thousands of views even when they don't have any followers. Russia used the same TikTok manipulation tactic to boost an unknown candidate to victory in the first round of Romania's cancelled presidential election last year. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Airlock Digital. Find them@airlockdigital.com thanks for your company.