Risky Bulletin: Insight Partners discloses security breach

Summary

Risky Bulletin: Insight Partners Discloses Security Breach

Podcast Information:

• Title: Risky Bulletin
• Host/Author: risky.biz
• Description: Regular cybersecurity news updates from the Risky Business team...
• Episode: Risky Bulletin: Insight Partners Discloses Security Breach
• Release Date: February 19, 2025

---

1. Insight Partners Security Breach

Timestamp: [00:04]

In the episode's opening segment, Claire Aird announces a significant security incident involving Insight Partners, a prominent venture capital firm. The breach, which emerged in January, was the result of a sophisticated social engineering attack. Although the full extent of the breach is still under investigation, Insight Partners has proactively notified all affected investors and portfolio companies.

Key Details:

• Impact: The breach affects Insight Partners' extensive portfolio, which includes notable cybersecurity firms such as Armis, SentinelOne, and Wiz.
• Response: The firm is working diligently to understand the breach's scope and mitigate any potential damages.

Notable Quote:

"Venture capital firm Insight Partners has disclosed a security breach stemming from a social engineering attack in January." — Claire Aird [00:04]

---

2. Cyber Attacks on Ecuador's Parliament

Timestamp: [00:10]

The podcast highlights recent cyber aggressions targeting Ecuador's parliamentary systems. Unidentified hackers launched two separate attacks on Monday, aiming to disrupt governmental operations and access sensitive information. These incidents occurred just a week following Ecuador's general elections, raising concerns about potential political motivations behind the assaults.

Key Details:

• Targets: Ecuador's national assembly systems.
• Objectives: Disruption of services and unauthorized data access.
• Context: The timing suggests possible links to the political climate post-election.

Notable Quote:

"The national assembly says the hacks aim to disrupt its systems and access sensitive data." — Claire Aird [00:10]

---

3. Hirsch Enterphone System Vulnerability

Timestamp: [00:20]

A critical vulnerability has been identified in Hirsch Enterphone's building access control systems. Security researcher Eric Daigle revealed that over 700 Hirsch Enterphone systems are accessible online, allowing attackers to remotely unlock doors due to a hard-coded password flaw.

Key Details:

• Vulnerability: Hard-coded credentials (Username: Freedom | Password: Viscount).
• Severity: Rated 10 out of 10, indicating a high likelihood of exploitation.
• Usage: Predominantly in apartment buildings across the US and Canada.
• Issue: Hirsch Enterphone failed to prompt users to change default passwords during setup, exacerbating the vulnerability.

Notable Quote:

"Customers aren't prompted to change the password during the setup process." — Eric Daigle

---

4. OpenSSH Security Updates Released

Timestamp: [00:30]

The OpenSSH project has rolled out critical security patches addressing two significant vulnerabilities. The first flaw allows for man-in-the-middle attacks exploiting DNS-based host key verification, while the second pertains to a denial-of-service (DoS) vulnerability.

Key Details:

• Vulnerabilities:
  • Man-in-the-Middle Attack: Affects systems relying on DNS for host key verification.
  • Denial of Service: Potential to disrupt OpenSSH services.
• Discovery: Both issues were identified and reported by security firm Qualys.
• Significance: These vulnerabilities are atypical for OpenSSH, a platform renowned for its security and rigorous code audits.

Notable Quote:

"The flaws are unusual for OpenSSH, which is a widely used and well-audited codebase." — Claire Aird [00:30]

---

5. Monero Blockchain Zero-Day Vulnerability

Timestamp: [00:40]

An anonymous security researcher has uncovered a zero-day vulnerability within the Monero blockchain. This flaw can be exploited to execute denial-of-service attacks, potentially incapacitating Monero nodes by causing memory exhaustion, especially targeting nodes that have exposed their RPC ports.

Key Details:

• Impact: Disruption of Monero network operations through node takedowns.
• Mechanism: Memory exhaustion leading to node failures.
• Status: Awaiting patch development to address the vulnerability.

Notable Quote:

"The vulnerability can be used to take down Monero nodes via denial of service attacks." — Claire Aird [00:40]

---

6. Millitium Industries Files for Bankruptcy

Timestamp: [00:50]

Millitium Industries, a Spanish spyware developer known for creating tools like "Invisible Man" and "Nightcraw," has declared bankruptcy. Founded in 2018, the company came under scrutiny when the Colombian newspaper Samana accused the nation's military of deploying its spyware to surveil journalists, politicians, and magistrates.

Key Details:

• Products: Invisible Man and Nightcraw spyware tools.
• Allegations: Use by Colombian military for unauthorized surveillance.
• Industry Impact: Millitium becomes the second Spanish spyware vendor to cease operations in 2025, following Barcelona-based Barasten's closure.

Notable Quote:

"Molitium is the second Spanish spyware vendor to shut down this year." — Claire Aird [00:50]

---

7. Emergence of Frigid Stealer macOS Malware

Timestamp: [01:00]

Proofpoint has identified a novel macOS malware named "Frigid Stealer," employed by two distinct threat actors. The campaign, initiated last month, leverages deceptive fake browser updates to trick users into inadvertently installing the malware.

Key Details:

• Functionality: Information stealer extracting browser cookies and cryptocurrency wallet files.
• Distribution Method: Fake browser updates prompting self-infection.
• Campaign Duration: Active since September, targeting primarily Russian-speaking users.

Notable Quote:

"The malware is an info stealer that extracts browser cookies and crypto wallet related files." — Claire Aird [01:00]

---

8. Crypto Mining Campaign Targeting Russian Speakers

Timestamp: [01:10]

A newly identified crypto mining operation is specifically targeting Russian-speaking individuals who engage in downloading pirated and cracked video games. Distributed through torrent files, this campaign has been active since September and predominantly affects users within Russia.

Key Details:

• Target Audience: Russian speakers downloading pirated/cracked video games.
• Distribution Channel: Torrent files.
• Suspected Origin: Belief that the malware author is a native Russian speaker, according to security firm Kaspersky.

Notable Quote:

"The malware is distributed via torrent files and the campaign has been active since September." — Claire Aird [01:10]

---

9. Spain Blocks Cloudflare IP Addresses

Timestamp: [01:20]

Spanish Internet Service Providers (ISPs) have begun blocking access to specific Cloudflare IP addresses during weekends. This action follows a lawsuit filed by Spain's soccer league against Cloudflare for hosting pirate streaming websites. However, the blocking measures have unintentionally affected legitimate platforms, including GitHub, Reddit, and various local businesses.

Key Details:

• Reason for Blocking: Legal pressure from Spain's soccer league targeting pirate streaming sites.
• Consequences: Legitimate websites inadvertently blocked, disrupting access for users.
• Affected Services: GitHub, Reddit, and local businesses relying on Cloudflare infrastructure.

Notable Quote:

"Many legitimate websites are also inadvertently blocked, including GitHub, Reddit, and local businesses." — Claire Aird [01:20]

---

Conclusion

The February 19, 2025, episode of Risky Bulletin presents a comprehensive overview of recent cybersecurity incidents, vulnerabilities, and trends affecting various sectors worldwide. From high-profile breaches in venture capital firms to vulnerabilities in widely used access control systems, the episode underscores the ever-evolving landscape of cyber threats. Additionally, the closure of spyware firms and the emergence of new malware highlight the persistent challenges in safeguarding digital infrastructures.

For those seeking to stay informed on the latest cybersecurity developments, this episode offers valuable insights and detailed analyses of current threats and industry responses.

---

Note: This summary excludes advertisements, intros, outros, and non-content segments to focus solely on the podcast's informative material.

Transcript

[Claire Aird]

VC giant inside partners gets social engineered OpenSSH patches an attacker in the middle Bug Ecuador's parliament hit by cyber attacks and a Monero zero day awaits a patch this is the risky bulletin prepared by Catalyn Kimparnu and read by me, Claire aird. Today is the 19th of February and this podcast episode is brought to you by Rad Security. In today's top story, venture capital firm Insight Partners has disclosed a security breach stemming from a social engineering attack in January. The company is still investigating the incident, but says it's notified affected investors and portfolio companies. The firm's portfolio includes cybersecurity firms Armis island, sentinelone and Wiz. In other news, unidentified hackers attacked Ecuador's parliament twice on Monday. The national assembly says the hacks aim to disrupt its systems and and access sensitive data. The attacks came a week after the country's general election. A hard coded password in Hirsch Enterphone building access control systems lets attackers remotely unlock doors. Security researcher Eric Daigle reported that more than 700 Hirsch enterphone systems are reachable online. The systems are used by apartment buildings in the US And Canada. Hirsch said customers didn't change the default password as instructed. Daigle argued that customers aren't prompted to change the the password during the setup process. The vulnerability has a 10 out of 10 severity score and is very likely to be exploited. The username is Freedom and the password is Viscount. In case you were wondering, the OpenSSH project has released a security update to fix two vulnerabilities. One is an in the middle attack, impacting systems that rely on DNS to verify host keys. The other is a denial of service. The flaws are unusual for OpenSSH, which is a widely used and well audited code codebase. Security firm Qualys discovered and reported both bugs. An anonymous security researcher has disclosed a zero day in the Monero blockchain. The vulnerability can be used to take down Monero nodes via denial of service attacks. The flaw leads to memory exhaustion in Monero nodes that expose their RPC port. Spanish spyware maker Millitium Industries has filed for bankruptcy. The company was founded in 2018 and developed the hacking tools Invisible man and Nightcraw in 2020. The Colombian newspaper Samana accused the country's military of using the software to spy on journalists, politicians and magistrates. Molitium is the second Spanish spyware vendor to shut down this year. Barcelona based Barasten closed last week. Barristan was exposed by Google's threat researchers in 2022. Proofpoint has identified two threat actors using a new macOS malware called Frigid Stealer. The campaign started last month and are using fake browser UPD trick users into infecting themselves. The malware is an info stealer that extracts browser cookies and crypto wallet related files. A new crypto mining operation is targeting Russian speakers who download pirated and cracked video games. The malware is distributed via torrent files and the campaign has been active since September. Most of the victims are located in Russia and security firm Kaspersky believes the malware's author is also a native speaker. And finally, Spanish Internet service providers are blocking access to some Cloudflare IP addresses on weekends. The blocks were put in place after Spain's soccer league sued Cloudflare for hosting pirate streaming sites, according to reports in Spanish media. Many legitimate websites are also inadvertently blocked, including GitHub, Reddit and local businesses. And that is all for this podcast edition. Today's show was brought to you by our sponsor, RAD Security. Find them at RAD Security Banks E.