← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
Claire Aird
France runs a phishing test on two and a half million students. Google fixes a Chrome zero day abuse for espionage, China publishes new facial recognition rules and the Dragon Force ransomware group hacks2 Rivals. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is March 28th and this podcast episode is brought to you by Sublime Security, an email security platform that not a black box in today's top story, the French government has conducted a large scale fishing test on more than two and a half million students. Almost 10% took the bait. More than 200,000 middle and high school students clicked a link advertising cracked games and cheats. The link redirected students to a phishing awareness message. Operation Cactus is to our knowledge the largest phishing test known to date. Security firm KnowBefore points out that 10% is still still much better than the average corporate click through rate of 33%. In other news, the Chinese government has banned the use of facial recognition technology without consent. The rules prohibit companies from using facial recognition if other less intrusive options exist. If organisations do use facial recognition, they're required to obtain consent, encrypt biometric data and go through regular security audits. Facial recognition technology will also be banned in some places such as hotel lobbies, pub, public bathrooms and changing rooms. The rules will take effect in June and obviously don't apply to the Chinese government's use of facial recognition. US government officials, personal data, phone numbers and passwords have been found in past data breaches. German news site Der Spiegel reported that it found data on National Security Adviser Mike Waltz, Director of National Intelligence Tulsi Gabbard and Defence Secretary Pete Hegseth. Der Spiegel says some of the phone numbers and email addresses were linked to Dropbox, LinkedIn, Instagram and Signal accounts. Google has patched a Chrome zero day that was used in recent attacks against Russian media outlets and educational institutions. Kaspersky says the attacks were the work of a state sponsored APT group. The Zero day is a Chrome sandbox escape and was used with a second exploit to deploy malware on targets computers. Kaspersky described the malware as highly sophisticated. Mozilla also patched Firefox after finding similar vulnerable code in its browser. Papua New guinea has blocked access to Facebook in what it says is a test. The ban aims to counter increased hate speech, disinformation and pornography. The nation's government has been critical of the platform's role in spreading disinformation related to civil unrest in the country. The ban ordered by the police minister appeared to be a surprise to local telecommunication regulators. It's unclear how long the ban will last. British IT company Advanced has been ordered to pay more than 3 million pounds over a 2022 ransomware attack that impacted national healthcare Services. The attack by the Lockbit Group crippled multiple NHS IT platforms and its non emergency phone service. The privacy regulator fined the company for failing to use multi factor authentication, scan for vulnerabilities and apply patches. T Mobile has agreed to pay $33 million to a man who was SIM swapped and had his cryptocurrency stolen. The victim lost $38 million in cryptocurrency in 2020. That crypto would now be worth more than $165 million. T Mobile also settled with the FTC last year for $31.5 million over similar SIM swapping incidents. An Australian tool retailer exposed a database on the Internet containing details of more than 34 million orders. The Sydney Tools database contained employee salaries as well as customers, personal information and purchase details. The data was stored in an instance of Clickhouse, an open source database. If this all sounds familiar, Chinese AI firm Deepseek also left its data exposed the same way. Earlier this year, a hacker has stolen $13 million worth of crypto assets from Defi lending platform Abracadabra Finance. The attack targeted the platform's lending pools, where the company aggregates customer funds. Abracadabra refunded half the stolen assets to the lending pools within two days and expects to return the rest by mid year. A Belarusian hacktivist group has hacked and released the source code and database of the country's cert website. The cyber partisans leaked the data on Belarus Freedom day, which is March 25. Russian authorities have arrested three men suspected of developing the Mammont Android banking trojan. The suspects were detained in Russia's Saratov region near the Kazakhstan border. Officials said they received more than 300 complaints linked to infections with the Mammont malware. Russian intelligence services are likely behind a network of fake anti war websites that collect visitors personal information. The websites pretend to belong to the CIA, the Russian volunteer Corps, the Legion Liberty and a Ukrainian portal, Hoshuzhit security firm. Silent Push says the fake portals collect personal information via web forms or telegram channels. The sites are buried deep in Google's results but rank first in Russia's Yandex search engine. Hacker group Redcurl has developed and started using its own strain of ransomware. Qwcrypt can target Windows systems and Hyper V virtual machines. Redcurl has been active since 2018, but hasn't carried out ransomware attacks until now. Now, previous reports have observed the group stealing data, but with no obvious business model to monetise it. The Dragon Force ransomware group has hacked and defaced the infrastructure of rival group Blacklock. Dragon Force also dumped configuration files for Blacklock's backend and Data Lake site. Blacklock has yet to restore its website. Cyber intel firm Resecurity says Blacklock's systems were not well secured and one of its analysts had also managed to gain access to its backend. Dragonforce also hacked another rival, Mamona, earlier this month. Software company Esri has patched an authentication vulnerability in its ArcGIS platform. The vulnerability has a severity rating of 9.8 out of 10. The ArcGIS platform is widely used to manage and visualise geospatial data by government agencies. There are currently more than 1,000 systems exposed on the Internet. 46 vulnerabilities have been discovered in three popular solar inverters. The vulnerabilities discovered by Forescout can be used to take over the solar devices and their cloud management platforms. Impacted vendors include GrowWatt, SMA and Sungrown. Academics have previously suggested that mass hacks of solar equipment could impact national power grids. Google will develop the Android operating system in private and only share its source code after each major release. The company says it's changed its model to simplify the development process. Google currently maintains the internal version and a public open source project. Simultaneously. The company will share its internal branch with smartphone makers before public release. Mozilla is seeking donations from Firefox users after its US government funding was cut. Firefox has confirmed it lost $2.5 million in US aid funding. Another million may also be on the chopping block. The US aid funding was a small part of Mozilla's revenue in 2023, it reported million in revenue. Almost 500 million came from its search engine placement deals. And finally, the U.S. commerce Department has added 80 foreign companies to its export restrictions list. Fifty companies are based in China. The others are in Taiwan, Iran, Pakistan, South Africa and the uae. The companies are linked to AI, high performance computing and quantum technologies. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Sublime Security. Find them at Sublime Security. Thanks to your company.