Loading summary
Transcript1 lines
- [00:04]
Claire Aird
The EU launches its own DNS service Trump revises previous administration's cyber executive orders, a supply chain attack hits popular NPM packages and mysterious iOS attacks spotted in the wild. This is the risky bulletin prepared by Catalyn Kimparnu and read by me, Claire aird. Today is the 9th of June and this podcast episode is brought to you by Push Security. The EU has launched its own DNS service with versions for government agencies, telcos and home users. The DNS4EU service has filters for malicious and malware linked domains that prevent users from resolving known bad sites. It's available via both IPv4 and V6 as well as DNS over HTTPs and DNS over TLS. The public use version allows users to block any combination of malicious sites, adult content and ads. The EU announced the service in late 2022 as part of a project to enhance digital sovereignty. The use of DNS for EU is not mandatory. In other news, the Trump administration has scrapped or revised cybersecurity executive orders from previous administrations. Donald Trump's executive order pulls back on efforts to secure BGP and the use of post quantum cryptography for federal networks. Agencies are no longer required to prioritise phishing resistant authentication and email encryption. The order also removes SOFTW security requirements for federal contractors and limits the use of cybersecurity related sanctions. Hackers are selling a large collection of sensitive documents they claim to have collected from Russian intelligence agencies. Samples shared with the New York Times have exposed an FSB project designed to analyse content from China's WeChat. The group AresLeaks has been active since 2021. It's selling the cache of Russian intelligence documents for $120,000. The group also claims to have similar data from North Kore and India. Russia will introduce prison sentences for DDoS attacks. Offenders can face up to eight years in prison and fines of up to 2 million rubles, or around $25,000. The law exempts users who launch attacks against sites the Russian government considers prohibited. Traces of mysterious exploit have been found on iPhones in the US and eu. Possible victims include government officials and people linked to political campaigns, media organisations and AI companies. Security firm Iver Iverify says some of the victims were previously targeted by Chinese state linked groups. The underlying vulnerability was patched in January and the latest exploit attempts were detected in March. Iverify says the exploit abused a feature that allows iPhone users to receive nicknames and avatars from their contacts. Apple has denied that the vulnerability was exploited in the wild. Nigerian authorities have sentenced 72 people to prison over their roles in cybercrime and Internet fraud operations. 55 of them were Nigerian, 9 Chinese and 8 Filipino. Some of the individuals were detained during Operation Eagle Flush in December. At that time, Nigerian police arrested 792 suspects running scams from a seven storey building in Lagos. The Chinese nationals were allegedly the scam compound's leaders. Six suspects have been arrested in India after authorities raided 19 locations across Delhi and the states of Haryana and Uttar Pradesh. The suspects are accused of running tech support scams targeting Japanese. The group was arrested following a joint investigation between India, Japan and Microsoft. A Chinese couple has been accused of stealing $9.5 million worth of crypto assets from at least 120 victims. The couple allegedly operated for four years from Frisco, Texas and targeted Americans with Chinese heritage. The FBI is trying to seize crypto wallets holding $6 million of stolen funds. The couple fled to China before they were charged in June last year. Almost 400 management interfaces for US water facilities have been exposed on the Internet, according to new research. Security firm census says 40 of the interfaces didn't require authentication and allowed full control over water management systems. Census worked with the US EPA to get the system secured. Russian security firm Positive Technologies has linked ransomware attacks inside Russia to a financially motivated group named Dark Gaboon. The group uses a leaked version of Lockbin. Dark Gaboon has been active since May 2023 and previous attacks involved the deployment of remote access Trojans. A threat actor has compromised node libraries from the Gluestack UI framework. The attacker breached a Gluestack admins account, added a remote access trojan to 16 libraries and pushed updates on Friday. The affected packages are downloaded almost 1 million times a week. Aikido Security says the attacker was also behind a supply chain attack on the Rand user agent package. Last Bulletproof hosting provider Stark Industries appears to have rebranded to the hosting Stark Industries and its two founders were sanctioned by the EU last month for hosting cybercrime and Russian disinformation networks. In a blog post, the new company claimed it has no connection to Stark Industries. And finally, South Korean phone maker Samsung has paid more than $6 million to security researchers through its bug bounty program since 2017. The company paid over $1 million in re awards last year. More than half of that was paid out for critically rated and remote attack vectors. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them@pushsecurity.com thanks for your company.