Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Mobile browsers patch a passkey phishing vector Researchers find undocumented commands in a common IOT chip the US government cuts election security funding and a hacker steals and then returns Funds from DeFi Platform 1 inch this is the Risky Bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 10th of March and this podcast episode is brought to you by Gray Noise. All the major browsers have released security updates to patch a novel passkey phishing attack. The trick lets a hacker within Bluetooth range trick a victim's smartphone into connecting back to the attacker and authenticating for them. Patches have been released for Safari, Chrome and Firefox. For more details on this one, check out the weekly Risky Business podcast with Patrick and Adam this Wednesday. In other news, the US has cut funding for the Elections Infrastructure Information Sharing and Analysis Centre. The group was established in the Department of homeland security in 2018. It was set up to help state and local governments safeguard election infrastructure against cyber threats. The DHS terminated funding for EI ISAC in February. The US government has also cut funding for the TALON Mechanism, a project that provided cybersecurity support to Ukraine. The project was launched by the US government, NATO and the EU in late 2023 to help Ukraine protect IT systems from Russian hackers. The received more than 200 million euros in funding, half of which came from the US. Swiss Critical Infrastructure operators will be required to report serious cyber attacks within 24 hours from April 1. Following the initial report, organisations will have two weeks to provide more detail. The country's Cyber Security Agency will provide support and alert other operators that may be affected. Security flaws have been discovered in the widely used ESP32 WiFi and Bluetooth chips. The chips, from manufacturer Espressif, contain undocumented commands that can be abused by malware running on the devices. Security firm Tarlogic discovered the flaws, which may impact more than a billion systems, including phones, laptops and IoT devices. The hidden commands cannot be exploited over the air, despite being in WI Fi and Bluetooth chips, they appear to be part of a testing or development interface left active in the firmware rather than backdoors. A cyber attack on American home appliance company Presto is causing manufacturing and shipping delays. The Incident occurred on the 1st of March and the company says it's restoring systems. As yet, no major ransomware group has taken credit. A hacker stole more than $5 million worth of crypto assets from DeFi platform 1inch, but returned the funds the next day minus a $450,000 negotiated bounty. The hack was the result of a vulnerability in the company's smart contracts. One inch says user funds were never in danger because of the nature of the bug. The FBI has recovered $23 million worth of crypto stolen from Chris Larson, the co founder and executive chairman of the Ripple Cryptocurrency. The recovered funds are a small percentage of the tokens stolen from Larson in January 2024. Hackers allegedly stole Larson's funds using encrypted passwords looted from password manager LastPass in 2022. Since the attack, the theory is that hackers have been slowly cracking LastPass data and emptying crypto wallets. Research in May 2024 suggested over $250 million worth of crypto assets had been stolen using the LastPass data. North Korean hackers compromised multi signature wallet provider SafeWallet by targeting one of its developers. According to a new post mortem report, the point of entry appears to have been a malicious Dockerfile that was executed on a developer's computer. The Dockerfile deployed mal stole local credentials. The attackers then used the developer's AWS account to add malicious code to SafeWallet. The malicious code targeted a specific multisig wallet used by the Bybit cryptocurrency exchange, and the attackers later stole $1.5 billion from Bybit. In the largest crypto heist yet, the FBI has arrested a Memphis man for stealing DVDs and Blu Rays of blockbuster movies and selling them before official release. Stephen R. Hale allegedly stole the films while employed at a company manufactures and distributes DVDs. Officials have linked hail to leaks from Dune, Fast and Furious and Marvel franchises. Australian police detained a Melbourne man over more than 190 malicious mobile number porting attempts. Officials believe the man attempted to hijack 86 mobile numbers in order to bypass MFA and access banking accounts. The Australian Federal police says 44 of the numbers were successfully ported. The manufacturer of Cobalt Strike says that its use by attackers is down 80% over the past two years. Software company Fortra says it worked with Microsoft and Health ISAC to take down cracked Cobalt Strike servers that were abused for malicious activity. Fortra's number does not align with a recent industry report which found that Cobalt Strike use had actually increased by more than 65% in the past year. According to security firm Recorded Future two thirds of command and control servers used in malware attacks last year ran Cobalt Strike. The Akira ransomware group infected a Linux based webcam and used it to encrypt a victim's network. The group targeted the webcam after its attempt to deploy ransomware on Windows systems was detected and blocked by edr. Security firm SRM says. Akira made its initial entry with Anydesk, deployed its ransomware on the webcam, and then mounted the network's drives for encryption via SMB. North Korean APT group Moonstone Sleet joined the Killin ransomware platform in late February. The group has been observed deploying Killin payloads during multiple intrusions. It also has a history of deploying ransomware for financial gain. Microsoft says Moonstone Sleet previously used its own ransomware before switching to Killin Threat Researchers believe the Killin ransomware is Russian in origin. The sheer volume of Russian propaganda online is poisoning large language models and AI chatbots. A disinformation research group says that a third of responses from leading generative AI tools are now returning pro Kremlin falsehoods. The bad training data can be traced back to a Russian disinformation network named Pravda. NewsGuard says that the network published more than 3.6 million fake news articles across 200 domains last year. And finally, Google paid almost $12 million in bug bounties in 2024. The money was shared among six hundred and sixty researchers. The highest single bounty last year was $110,000. More than half was for Android and Chrome vulnerabilities. Google's bug bounty program has paid more than $65 million for vulnerability reports since it began in 2010. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Grey Noise. Find them at Greyn. Thanks to your company.