Loading summary
Transcript1 lines
- [00:04]
A
Microsoft ends support for SMS FMA on personal accounts GitHub was hacked via a malicious VS code extension, CISA will let researchers submit new KEV entries and an SMS blaster was detained at Eurovision. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 22nd of May and this podcast episode is brought to you by Push Security. In today's top story, Microsoft is phasing out SMS based two factor authentication and account recovery for personal accounts. Users will be prompted to add a passkey the next time they log in. The company says SMS is a leading source of fraud and the most targeted vector for account takeovers. Microsoft is the first major platform to abandon SMS MFA in other news hackers stole GitHub's internal repositories after an employee installed a malicious VS code extension. More than 3,800 internal code repositories were exfiltrated from GitHub and are for sale on a hacking forum. GitHub says it's rotating critical secret tokens to prevent future access to its assets. The malicious VS code extension was identified as NX Console, which itself was compromised in the Tanstaq supply chain attack last week. Team PCP has claimed credit for the breach. Russia has been hacking Bluesky accounts and posting pro Kremlin and anti Ukraine propaganda on them since April. Blue sky has been suspending the accounts until owners can re secure them. The Russian disinformation group known as Matryoshka is behind the propaganda posted on the hacked accounts. CISA will allow third parties to report the active exploitation of vulnerabilities so they can be added to the KEV database. The agency has launched a web form where researchers can file reports. CISA will confirm the reports before adding them to the KEV list. CISA's KEV database has been criticised for falling behind in recent months. Austrian tactical police have arrested a 32 year old Chinese national on cybercrime charges. The suspect was arrested with an SMS blaster in his car outside the Eurovision Song Contest in Vienna last weekend. The man was also charged with endangering his six year old son who was also in the car with him. A Canadian national has been arrested and charged with running the Kimwolf DDoS botnet. Jacob Butler was detained in Ottawa by Canadian police this week. He is charged with building and renting out the botnet, which was used in more than 25,000 attacks last year. US and European authorities took down the botnet in a joint operation in March. He's been charged in Alaska and US authorities are seeking his extradition. French and Dutch authorities have seized a VPN service used by cybercrime gangs. First VPN has operated for years and was mainly advertised on Russian speaking hacking forums. It was used in large scale fraud, data theft and ransomware attacks. Authorities arrested the services admin in Ukraine, took down 33 servers and seized four domains. Ukraine's cyber police have arrested an 18 year old who used an info stealer to hijack online accounts and make unauthorised transactions. The teen allegedly hacked more than 28,000 accounts and stole $721,000. He was also selling access to the hacked accounts. A cyber attack has disrupted the government email service of the Northern Mariana Islands. Officials from the US territory did not specify if this was a ransomware attack. The incident is expected to slow down administrative tasks. Chinese arcade game maker Walap left the personal details of almost 19 million customers exposed online. The data leaked via an Elasticsearch database that was left unprotected on the Internet. The data was tied to customers WeChat accounts and included phone numbers and full names. It remained online for at least two months before the server was secured. Trump Mobile has fixed a bug on its website that exposed the data of users who signed up for the company's gold coloured smartphone. The website allegedly exposed emails, physical addresses and full names. The company was reportedly notified of the bug in advance but didn't fix it. It patched the bug only after several YouTubers covered the leak. Trump Mobile is yet to ship the pre ordered Trump themed phones. About one third of Russian companies are using Western software acquired before Russia's invasion of Ukraine in 2022. Most of the software doesn't receive technical support or security updates. The highest concentration of Western software is in the corporate email vertical. Microsoft still holds 50% of the Russian market through its Exchange and Microsoft 365 products. A version of the Karuna iOS exploit kit is being delivered to iPhones via a compromised NPM package. The exploit kit was the final payload hidden in Art template, a popular JavaScript template engine. The infected template engine deployed Karuna to search for iOS users, hack their devices and steal crypto wallet data. The Karuna exploit kit was initially used for espionage campaigns but was later linked to Chinese e crime operations after its code was stolen and sold. A hacking campaign is planting fake capture pages and malware on websites built with the Ghost cms. The attacks began this month and are exploiting a vulnerability disclosed in February. At least two threat actors are conducting parallel campaigns. More than 700 websites have been hacked. So far an automated campaign has targeted thousands of GitHub repositories. The attackers used malicious commits that deployed a GitHub action on the targeted repositories. The action ran a bash script that stole CI secrets, cloud credentials, SSH keys and other tokens. There's no word on how many repositories were successfully compromised in the campaign. Google has accidentally revealed details about an unpatched vulnerability in Chromium based browsers. The bug allows threat actors to execute remote code and maintain persistent connections to affected browsers. The issue was first reported in 2022 remains unfixed. The bug report was set to private again after a few hours. Microsoft has released an out of band security Update to fix 2 Windows Defender 0 days. The bugs have been exploited in the wild to crash the Defender service and elevate attackers privileges. The two bugs were added to Syskev database on Wednesday along with five further Adobe and Microsoft vulnerabilities. Drupal has patched a highly critical SQL injection bug affecting all current versions of the CMS. The vulnerability only impacts Drupal sites running on PostgreSQL databases. It can be exploited by remote unauthenticated users. The Drupal team estimates that only 5% of all installs are impacted, but exploiting the bug is trivial. Cisco has patched a critical vulnerability in its secure workload platform, previously known as Tetration. The Cisco secure workload is used to micro segment networks spread across multiple cloud platforms. The vulnerability has a CVSS rating of 10 out of 10. The Linux project has published patches for yet another local privilege escalation vulnerability. It exploits an authorization bypass and race condition in the Linux PTrace process to allow malicious local apps to run commands as root. Security firm Qualys discovered the bug. And finally, the Dutch consumer protection agency is urging EU regulators to take action against Google, Meta and TikTok. The agency says the companies are not removing malicious ads from their platforms and are not replying to reports. Meta and TikTok are accused of leaving up to 80% of malicious ads in place. Polish authorities accused Meta of the same behaviour last year and that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them@PushSecurity.com thanks for your company.