← Risky Bulletin
Risky Bulletin
Risky Bulletin: Cyberattack disrupts Bridgestone tyre factories across North America
00:09:00
Loading summary
Transcript1 lines
- [00:04]
A
A cyber attack disrupts Bridgestone tire factories in North America A new info stealer takes your photo while you watch porn. Bad certificates for Cloudflare infrastructure went undetected for more than a year and Brazil deals with another payment system hack this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire Airdrop. Today is the 5th of September and this podcast episode is brought to you by Push Security. A cyber attack is disrupting some Bridgestone tire factories in North America. Factories in South Carolina and Quebec have been affected. No group has taken credit for the intrusion yet, and it's unclear if the attack was ransomware. In other news, A ransomware group has hacked the art commissioning website Artists and Clients and is leveraging the artist to extort the owners. The Lunar Lock group has demanded the owners of the site pay a $50,000 ransom. It's threatened to submit the stolen artwork to AI data training sets. Artists and clients is LunarLoc's first known victim hackers have attempted to steal more than $77 million after breaching an IT provider for Brazilian banks. The hack targeted Cinqia, a provider of software that integrates with the country's Pix payment system. The attempted thefts targeted funds owned by the banks HSBC and Arta. Synkya says it blocked most of the attackers transfers. Both banks have said no customer accounts were compromised. Hackers are threatening to release stolen Google data unless the company fires two members of its security team. The group, calling itself Scattered Lapsus Hunters or also demanded that Google stop any investigations into its activity. The group is believed to be behind a hack of Google's Salesforce account last month. The Venus Protocol cryptocurrency project has recovered $13.5 million that was stolen from a user. The funds were taken on Tuesday after a phishing attack. The project used its governance powers to reverse the theft and restore the funds to the owner. A Croatian certificate Authority has issued 12 unauthorised certificates for Cloudflare's DNS service 1.1.11 fina. RDC issued the certificates in February last year. They were not detected until this August. Cloudflare confirmed the incident and apologised for not spotting the certificates earlier. Microsoft was the only major browser provider that trusted the ca. Texas has established a unit to counter Chinese influence operations in the state. The Hostile Foreign Adversaries unit will be part of the Texas Department of Public Safety. The unit's been established under a new state law. The legislation will also seek criminal penalties for state employees who fail to report foreign influence activity the House Homeland Security Committee has approved a measure to renew the Cybersecurity and Information Sharing Act. Both the House and Senate need to approve the measure for the act to be reauthorised. The law the law provides liability protections for the private sector to share threat intel with the government. It was adopted in 2015 and will expire at the end of September unless it's reauthorised. A lawsuit seeking to annul the EU and US Data privacy framework has been dismissed. The EU General Court ruled that the treaty adequately safeguards the personal data of EU citizens. Plaintiffs argued that the U.S. data Protection Review Court was not sufficiently independent of the US Department of Justice. Egyptian authorities have taken down StreamEast, the world's largest illicit sports streaming service. More than 80 domains were seized and two administrators were arrested last week. The takedown followed a complaint from a coalition of 50 media companies known as the alliance for Creativity and Entertainment. A Chinese group is using hacked IIS servers to manipulate Google search results. The Ghost Redirector gang provides search engine optimisation fraud, according to eset. The group has hacked dozens of servers to modify responses to googlebot search crawlers. Greynoise has observed waves of scanning for Cisco ASA devices. The attackers used as many as 25,000 unique IPs to find Internet exposed devices in late August. The attacks appeared to be the same campaign spotted by nadsec last week. Greynoise believes this may be a reconnaissance campaign ahead of a future exploit. An infosteeler is taking screenshots and webcam photos when it detects users watching adult content, according according to proofpoint. The collected data will likely be used in future sextortion campaigns. The Stellarium infostealer is currently distributed in the wild by at least two threat actors. It's based on an open source project available on GitHub. North Korean hackers are registering accounts on Cyber intel platforms to monitor when their servers get detected. SentinelOne has spotted accounts on platforms including Valadin, VirusTotal and Maltrail. The hackers are associated with a group known as Contagious Interview. The group uses job interviews to lure victims into infecting themselves with malware. Sentinel 1 says the group compromised 230 individuals earlier this year. The U.S. state Department is offering a $10 million reward for information on three FSB agents who are part of the berserk Bear Apt. The three were charged by the DOJ in March 2022 for a hacking campaign that targeted critical infrastructure. In a security advisory last, the FBI said the group continued to target old and unpatched Cisco routers. The Russian cyber espionage group APT28 has compromised multiple businesses in NATO countries. Victims were infected with a novel backdoor named Notdoor. The malware is a VBA macro for Microsoft Outlook that monitors incoming emails for trigger words. Based on the triggers, Notdoor can steal emails and files and execute commands. Google has patched 2 actively exploited 0 days in Android patches were released in the September security update on Monday. Both flaws are elevation of privilege bugs. One is in the Linux kernel and the second in the Android runtime. The sitecore CMS has patched an actively exploited flaw. The exploitation was spotted by Google's Mandiant team. The issue impacts sitecore customers who copied and pasted example machine keys from the official documentation instead of generating new ones. Attackers are using the default machine keys to perform deserialisation and RCE attacks on vulnerable sites. Singapore police have ordered Meta to implement anti scam measures on Facebook. Meta will have to detect ads, accounts and business pages impersonating government officials. A third of all reported scams in Singapore last year were on Facebook. Authorities can fine meta 1 million Singaporean dollars if it fails to comply. Meantime, the French privacy watchdog has fined Google 325 million euros for tracking Gmail users with advertising cookies. Kinneil says Google failed to obtain user consent before inserting ads and tracking cookies in Gmail inboxes. Chinese e commerce giant Shein was also fined 150 million euros for a similar infraction. Disney has settled with the FTC over collecting the personal data of children watching its YouTube videos. The company will pay $10 million for failing to obtain parental consent. Disney failed to tag its videos as Made for Kids, which is a YouTube setting that tells the platform not to collect certain data. A US Court has ruled that Google will not be required to break up its search business or divest itself of Android or Chrome. Google will be barred from using exclusive contracts that lock out rivals. The company will also have to share some of its separate search index data with its competition and establish a five person antitrust committee to monitor its business practices. The ruling ends the DOJ's antitrust case against Google's search monopoly, barring any appeals. And finally, Google has released a new security feature designed to protect cookies in Chrome. Chrome now supports new cookie prefixes to distinguish between cookies set by the server and those modified in the browser. The new system can help server operators detect attacks using cookies set on the client by cross site scripting or malicious extensions. And that is all for this podcast edition. Today's show is brought to you by our sponsor, Push Security. Find them@PushSecurity.com thanks for your company.