Transcript
Patrick Gray (0:04)
A GitHub supply chain attack leaks secrets the White House tells federal agencies to stop firing cyber staff. Germany exempts cybersecurity from debt limits and the RCS standard adds support for end to end encryption. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Patrick Gray, filling in for Clair Aird. Today is March 17th and this podcast is brought to you by the not no Code automation platform tines. An unknown attacker used malicious code they snuck into a popular GitHub action to steal secret keys. The incident took place on Friday and impacted changed files, an automated action used by more than 23,000 GitHub projects. The malicious code was added to the current and older versions of changed files. That code downloaded and ran a Python script that searched the GitHub server's memory and wrote any secret tokens it found to the build log. Anyone can read build logs for public GitHub repositories, so projects that use the compromised action should change all their secret tokens. The White House has urged federal agencies to refrain from firing their cybersecurity staff. In an email seen by Reuters, US Federal Chief Information Officer Greg Barbaccia told the agency that cybersecurity is national security related and should be exempt from layoffs. The call comes following a wave of layoffs this year, including more than 130 CISA roles. Former NSA Director of cybersecurity Rob Joyce warned Congress earlier this month that the mass firings would leave government networks exposed to attacks from foreign adversaries. Germany's incoming government will exclude cybersecurity spending from debt caps. Overall public sector borrowing was restricted to 0.35% of GDP during the 2009 Global Financial Financial crisis. Cybersecurity is one of several sectors that will be excluded from the debt restrictions as Germany seeks to raise defence spending and rearm as US Europe relations deteriorate. The Turkish parliament has passed a new law giving the country's Cyber Security Directorate broad powers to collect and search digital records. The new cyber security law also targets people who report on security incidents that have not been confirmed by the government. Offenders could face up to five years imprisonment. Officials fast tracked the bill, which passed in less than six weeks. The country's opposition argues the bill lays a legal foundation to restrict free speech and establish a sprawling surveillance apparatus. A ransomware attack has taken down the health system of an entire state In Micronesia, officials took the health systems network offline to respond to the incident. The state is home to more than 12,000 residents. Micronesia is the latest Pacific nation to suffer a crippling ransomware attack. Tonga, Palau and Vanuatu have also been targeted in recent years. Russian authorities have arrested the alleged new administrator of the Banshee Stealer malware. Police detained the suspect after the malware allegedly targeted Russian users. The Banshee Stealer is one of the few infostealers that loots credentials from macOS systems. The malware's original author sold the source code to a new owner in December 2024. US authorities have extradited a Russian Israeli national for his role in developing the Lockbit ransomware. Rostislav Panev was initially arrested in Israel in August last year. Israeli investigators allegedly found evidence at his home linking him to lock bit ransom notes and payments. Cryptocurrency exchange Coinbase has warned of a scam that tricks users into moving funds into a wallet set up in advance by attackers. Users have reported emails claiming to be from Coinbase that prompt users to migrate funds to a self custodial wallet. Users are given recovery phrases generated by the attackers once the funds have been moved. The attackers use the recovery phrase to steal the assets. A malicious Java library was spotted secretly stealing OAuth credentials on the 15th of every month. Socket Security says the package mimicked the name of a popular OAuth library. It was available via the Maven package repository from January 2024. Since being discovered, the malicious library has been removed from Maven Central and GitHub, staying with GitHub and its security team, has discovered two vulnerabilities in the Ruby SAML authentication libra. The vulnerabilities can be used to bypass SAML authentication and log in as anyone. GitHub says attackers only need a single valid signature to create SAML assertions for any other user. Patches were released last week. Meta is seeking financial damages of close to $450,000 from Israeli spyware maker NSO Group. The amount covers the costs incurred while investigating a wave of attacks using an NSO exploit in 2019. Metta sued NSO the same year, and after years of stonewalling the US Courts, a judge found the Israeli company liable for the hacks in December 2024. Reuters Cyber Security reporter Rafael Satter is suing the Indian government for cancelling his dual citizenship. Satter is American and based in Washington, D.C. and received Indian citizenship through marriage. The cancellation means he can no longer travel to India. Indian officials cancelled SATA's citizenship in December 2023 after the Reuters team published a story exposing Indian company Appen as a provider of hacker for hire services. Officials claimed Satter's work besmirched India's international reputation. The GSM association has released a new version of the Rich Communication Services standard that supports end to end encryption. Both Apple and Google have said they will support encrypted RCS in future releases. The implementations will be compatible and allow Android and iOS users to exchange secure messages on supported mobile networks. Google began pushing for RCS to replace SMS in the mid 2010s. Amazon will remove the option to locally process Alexa voice requests on some Echo smart speakers. The feature will be removed on March 28. After this, all Alexa requests will be processed in the cloud. Amazon says the Do Not Send voice Recordings option will be renamed to Don't Save Recordings. This will delete the voice recordings from the cloud after they're processed. Multiple botnets have been seen exploiting a zero day command injection vulnerability in EdMax security cameras. Widespread exploitation was first seen in October 24, but even then a public proof of concept had already been available for the bug for over a year. Developers leaked almost 24 million hard coded secrets via GitHub repositories last year, which is up 25% on the previous year. The top most common secrets leaked in 2024 were ODBC connection strings and AWS IAM credentials. Security firm GitGuardian says secret leaks are steadily worsening over time, despite GitHub's efforts to detect them during the push stage. The company also says that 70% of the secrets detected in public repos in 2022 remain active even today. That's all for this podcast edition. Today's show was brought to you by our sponsor Tynes. Find them@tynes.com.