Loading summary
Transcript1 lines
- [00:04]
Claire Aird
An HTTP 2 vulnerability enables DDoS attacks, Russia blocks Telegram and WhatsApp voice calls, attackers abuse a zero day in enable service and the US government is adding trackers to chip shipments this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 15th of August and this podcast episode is brought to you by Yubico, the inventor of the Yubikey. A new vulnerability in the HTTP 2 protocol can allow threat actors to DDoS web servers. The madeyoureset attack was discovered by researchers at Deepness Lab. It exploits a feature of the HTTP 2 protocol that cancels and resets connections. Attackers can cancel connections, but before the cancellation is complete they can initiate many more, leading to resource exhaustion. In other news, U.S. authorities are hiding tracking devices in chip shipments. According to Reuters, the devices are meant to detect when shipments are diverted to China or other U.S. adversaries. Trackers have been found in shipments of Supermicro AMD, Nvidia and Dell Equipment. Nvidia and Dell both denied involvement in a scheme to install trackers. It's unclear where and how shipments are being interdicted. To deploy the tracking devices, 10 additional facial recognition vans will be deployed across the UK. The vans are equipped with cameras that can scan the faces of people walking by. They'll be deployed to scan crowds and help catch wanted people. The new van's approximately double the size of the UK's available fleet. Canadian authorities are investigating a security breach of the Parliament's House of Commons. Hackers exploited a recent Microsoft vulnerability to gain access to a central database. They allegedly stole non public data about employees and government issued devices, according to an email obtained by the CBC. The hack occurred last Friday. Russia's Internet watchdog has begun restricting WhatsApp and Telegram calls. Roscomnadzor said the messengers have been used to commit fraud and organise terrorist activities. Earlier this week, the country's four largest telcos petitioned the government to ban voice and video calls using foreign apps. The Kremlin has ordered government officials to migrate their telegram channels to the country's domestic messaging app, max. Officials will be allowed to maintain a presence on other messengers, but MAX is mandatory. The official MAX accounts are expected to go live in the coming weeks. Polish officials say a cyber attack attempted to cut the water supply to a large city. Deputy Prime Minister Krzysztof Gabgowski said authorities blocked the attack. He declined to name the city to avoid panic. He also didn't name the attackers. An Iranian independent news outlet has tracked down the spies who hacked its journalists. Iran International identified a member of the Handala hack group as 27 year old Ali Bermud from Tabriz. The outlet said he ran the group's Telegram channel and took orders from Iran's intelligence agency, the mois. A threat actor is selling scanned guest identity documents from Italian hotels. The MyDocs group claimed it obtained the data by hacking three unnamed hotels in June and July. The group said it stole more than 70,000 scanned passports and IDs. It leaked more than 7,000 scans on Thursday, according to the Italian cert. Turkish cryptocurrency exchange has been hacked for $49 million. The company suspended operations on Thursday morning after the funds were taken from its hot wallets. BTC Turk also lost $55 million to a hack last June. A cybersecurity incident is disrupting cloud service provider Colt. The company's customer support portal and its Voice API platform have been offline for at least three days. Colt says it's working with experts to investigate the incident. A company named Qubic claims it now controls more than half of the Monero cryptocurrency mining capacity. Users are worried Qubic may be able to execute a 51% attack to rewrite the Monero blockchain or censor transactions. The company called the takeover a proof of concept and an experiment. The U.S. treasury Department has sanctioned Russian cryptocurrency exchange Grinex. The platform launched days after the FBI seized the Garrentex platform in March. The U.S. treasury said funds from Guarantex were moved into Grinex wallets shortly after the takedown. Garantex was sanctioned in 2022 for laundering funds linked to hacks and ransomware. The state of New York is suing the payment platform Zelle over enabling fraud. According to New York Attorney General Letitia James, scammers stole more than $1 billion from Zelle users between 2017 and 2023. She claims Zelle prioritized growth ahead of basic anti fraud safeguards. The suit accuses the company of ignoring reports of fraud and failing to help or reimburse users. Zelle is owned and operated by a group of four American banks, JPMorgan Chase, bank of America, Capital One and Wells Fargo. Thai authorities have arrested two local men for sending fraudulent SMS messengers. The pair drove around Bangkok with an SMS blaster in the back of a Mazda. They were allegedly recruited on telegram by a Chinese man who paid them $75 a day. They were arrested last week after a local telco tracked down their device and alerted police. An Android Trojan capable of relaying NFC payment transactions has been spotted in Brazil, according to security firm Threat Fabric. The Phantom card Trojan is similar to one active in the Chinese underground. The Trojan's author is known for taking foreign malware and adapting it for Brazil. NFC relay malware has now been seen in Russia, China, Indonesia and Chechiya. Threat actors are exploiting 20 days in the enable n central remote monitoring and management platform. CISA said the zero days allow attackers to carry out deserialization and command injection attacks against N central servers. A patch was released on Wednesday. Enable says the zero days impact only on PREM servers and require threat actors to be authenticated. Fortinet has patched a major security flaw in its Forta web firewalls. The vulnerability allowed attackers to forge session cookies and bypass authentication. The FORT majeure bug was discovered by a security researcher, Aviv Y. Fortnet is also urging customers to patch their fortisim devices. A security update that patches a command injection attack was released on Tuesday. Practical exploit code exists online and exploitation is expected to follow. Xerox has released security updates for the Free Flow core print orchestration platform. They patch two vulnerabilities that allow unauthenticated attackers to run malicious code on the platform. Security firm Horizon 3 has released a technical write up and proof of concept for both vulnerabilities. And finally, the US National Institute of Standards and Technology has finished work on the ASCON cryptographic standard. The standard contains four cryptographic algorithms designed to be used on low memory IoT devices. The agency has been working on the standard since 2023. It can work with devices as small as RFID tags and implanted medical devices. And that is all for this podcast edition. Today's show is brought to you by our sponsor ubico. Find them at ubico. Com. Thanks for your company.