Loading summary
Transcript1 lines
- [00:04]
A
A cyber attack has crippled cars in Russia Microsoft patches an office zero day, WhatsApp rolls out an account lockdown feature and a handful of chrome extensions steal ChatGPT auth tokens. This is the Risky bulletin prepared by Catalyn Campanu and read by me, Amberly Jack. Today is January 28th and this podcast episode is brought to you by Push Security. In today's top story, a cyber attack against an Internet connected automotive alarm system has crippled cars in Russia. The attack targeted the smart alarm system Delta. Car owners reported not being able to open doors, silence alarms or start cars. The company has confirmed the incident but has not provided further details. The US treasury has cancelled its contracts with Booz Allen Hamilton following an internal leak of IRS documents. Between 2018 and 2020, a Booz Allen employee leaked tax records of more than 400,000Americans to ProPublica and the new York Times. The data included tax details for President Donald Trump, Elon Musk, Jeff Bezos and other billionaires. The Israeli government is expected to pass its first cybersecurity law next week. The law would require all organisations to report cyber attacks to the country's National Cyber Directorate. If attacks target critical infrastructure, organisations would be required to report the incident as soon as it's discovered. The European Commission has launched a formal probe into X over the Grok AI feature that generated explicit photos of women and children. The platform and its XAI division face fines of up to 6% of global revenue. More than a dozen European and Asian countries are conducting similar investigations. Chinese hackers reportedly hacked the phones of UK government officials. The hacks between 2021 and 2024 targeted the aides of Boris Johnson, Liz Truss and Rishi Sunak. It is unclear what level of access the hackers obtained or whether former prime ministers were themselves compromised. British Prime Minister Sir Keir Starmer is set to meet with Chinese officials this week. The French government is replacing US video conferencing platforms with a local alternative. All agencies and departments must switch from Zoom and Microsoft Teams to the French conferencing product Visio by 2027. Visio launched this year and is part of a national plan to create a sovereign digital ecosystem. The US has indicted 31 Venezuelan and Colombian nationals for their roles in an ATM jackpotting scheme. The group scouted ATMs at night and replaced the hard drives with ones preloaded with the Plautus malware. In the last two months, the Justice Department has charged a total of 87 individuals in relation to the scheme. All suspects are believed to be members of the trendy Aragua criminal cartel. A critic of the Saudi government has won a spyware lawsuit in the UK. Ghanem Al Masaray sued the Saudi government in 2019 after his phone was infected with the Pegasus spyware. The lawsuit cited severe depression that forced him to abandon his YouTube satire channel. The court awarded damages of three million pounds to cover the loss of revenue. The Saudi government refused to participate in the lawsuit, citing state immunity. Hungarian and Romanian authorities have arrested four people accused of doxxing and swatting attacks. Three suspects were detained in Hungary and one in Romania. They doxxed victims, threatened to kill people and issued fake bomb threats against educational, religious and law enforcement organisations. Rogue tow truck operators are abusing Spanish emergency vehicle beacons and defrauding car owners needing assistance. Spanish authorities say the groups are intercepting GPS coordinates emitted by V16. The rogue operators are arriving before legitimate tow trucks and scamming people in high stress situations. The beacons recently became mandatory for all cars in the country. The Scattered Lapsus Hunters hacking group has targeted Okta and SSO accounts at more than 100 companies. The group is using a combination of classic phishing and voice calls to lure employees into sharing SSO sessions and tokens, according to security firm Silent Push. The group uses specialised phishing panels that direct the process in real time. Atlassian, Zillow, HubSpot, Epic Games and Telstra are among the companies targeted. Microsoft has released an out of band security update to patch an actively exploited Office Zero day. The Zero day is a bypass of a security feature relating to object embedding exploitation, requires user interaction and affects all Office versions after 2016. Users of Office 2021 and later are protected by a change. At Microsoft's end, the OpenSSL project has patched a memory corruption bug that can lead to remote code execution. The bug resides in the processing of cryptographic message syntax data. Threat actors can use CMS packets with crafted parameters to crash, open SSL and run malicious code. It is one of 12 issues patched by OpenSSL this week. All were found and reported by IELTS. Security threat actors can bypass authorization and execute code on any Kubernetes container. The vulnerability exploits a bug in how Kubernetes API servers handle WebSockets. The Kubernetes project has declined to patch the issue, but will release a new API authorization system in April to address the attack. WhatsApp is rolling out a new security feature meant to block advanced exploits in spyware. The strict account settings feature is inspired by Apple's lockdown mode and Android's Advanced protection mode. It enables two factor authentication, turns on security notifications, and prompts the user to set up encrypted backups. It also disables link previews and blocks attachments and media from unknown senders. Google has agreed to pay $68 million to settle a class action lawsuit. The company was accused of illegally recording users via its voice assistant. Google later used the recordings to deliver targeted ads. Last year, Apple agreed to pay $95 million in a similar settlement over Siri recordings. And finally, a cluster of malicious Chrome extensions is stealing ChatGPT authentication tokens. Fifteen extensions were hosted on the official web store, while one was distributed via the Edge Add Ons Marketplace. According to security firm LayerX, the extensions were collectively downloaded only 900 times. That's all for this podcast edition. Today's show was brought to you by our sponsor podcast, Push Security. Find them@PushSecurity.com thanks for your company.