Transcript
A (0:04)
Microsoft revamps Edge IE mode after zero day attacks. The FBI seizes the extortion site targeting Salesforce. A new round of layoffs hits CISA and Apple doubles its bug bounty rewards. This is the risky bulletin prepared by Catalyn Kimpano and read by me, Claire aird. Today is the 13th of October and and this podcast episode is brought to you by Nebuloc. Threat actors are exploiting a zero day in the legacy Internet Explorer mode of Microsoft's Edge browser. Hackers trick users into reloading a malicious site in Internet Explorer mode and then use a script engine zero day to run code. Attacks have been observed as far back as August. Microsoft has removed the one easy button that relaunches sites in Explorer mode to Users now need to jump through several hoops. In other news, hackers are exploiting a zero day in two software products from Glad dotnet. The flaw is a file read vulnerability in Center Stack and Trio Fox file sharing servers. It's being used to steal a server's Net machine key, which is leveraged for deserialization and code execution. Glad dotnet is working on a patch. This is the second Glad dotnet zero day this year. The Trump administration will not nominate Army Lt. Gen. William Hartman for chief of Cyber Command and the National Security Agency. General Hartman has been acting head of both agencies since April, when he replaced Air Force General Timothy Hawg, one source told the Record the White House may still want to end the dual hat arrangement and split the role. Meantime, the White House fired more than 4,000 government workers last week, including 176 from CISA. Some Some CISA employees were also reassigned to help other agencies with immigration enforcement. This is the third round of CISA layoffs this year. Apple will double its bug bounty rewards for serious vulnerabilities and exploit chains. Rewards will Max out at $5 million for remote attacks on lockdown mode. The new scheme will go into effect in November. The company will also add new bounty categories. Apple will also donate 1000 security hardened iPhones to civil society organisations distribute amongst high risk users. A group of US investors has acquired Israeli spyware maker NSO Group. The investors are led by Hollywood producer Robert Symons, who previously attempted to acquire the company in 2023. Wired reports. The deal is worth several tens of millions of dollars. In 2019, the company was valued at roughly $1 billion. NSO will continue to operate out of Israel and remain subject to the country's export control. In 2021, the US Treasury Department added NSO Group to its list of banned entities The FBI has seized a website that was being used to extort Salesforce and its customers. The site was seized two days before hackers were expected to leak data stolen from Salesforce. It was operated by a group calling itself Scattered Lapsus Hunters and was named after the former Breach forum's hacking community. The dark web version of the site remains active. The group has released data from six companies including Qantas and Vietnam Airlines. Argentinian officials have arrested a Nigerian man wanted by Interpol for alleged romance scam operations. The man, identified as Ikechukwu? N, is Argentina's first arrest based on an Interpol Red Notice. The suspect was also listed in Interpol's Silver Notice database, a new project aimed recovering criminal assets. Cambodian police have raided a Cyberscam compound in Phnom penh. Authorities arrested 76 foreigners and five locals. The group operated out of the Morgan Tower building, which was raided for similar crypto scam activity earlier this year. Spanish authorities have arrested a Brazilian national suspected of operating a major phishing platform. The 25 year old suspect used the online handle Google Xcoder. He allegedly ran an online phishing service named GXC Team that served the Spanish speaking cybercrime underground. The Service could bypass 2fa and came with ready made Android malware for targeting banks and crypto. The suspect was living in Spain on a digital nomad visa. Hackers have breached online gambling platform Fast Track and stolen data from two of its customers. The targets were two cryptocurrency casinos Shuffle and Rubet. The stolen data is believed to include names, emails, home addresses and betting history. The breach occurred earlier this month. Apple is introducing age verification checks for users in Texas to comply with upcoming state laws, all users under 18 will be required to join a family plan in order to use Apple products. Apple is also releasing age verification tools for its developer ecosystem. Texas New age verification law enters into effect next year the Aesuru DDoS botnet has grown to more than 300,000 infected systems. The botnet launched in August last year and was discovered by Chinese security firms after IT infected local ISPs and cloud providers. According to Crebs on Security, most bots are now located on US networks. Isuru currently holds the record for the largest DDoS attack a botnet has launched coordinated scanning of RDP endpoints in the U.S. more than 100,000 unique IPs have participated in the attack since October 8th. The botnet is using timing information in an attempt to identify valid usernames. Greynoise first discovered the botnet in Brazil after noticing an unusual spike in Internet traffic. Oracle has released an out of band security update to patch another critical vulnerability in its E Business suite. The latest bug allows remote attackers to access the platform without authentication. Oracle has not confirmed if the bug was exploited in the wild. This is the second E biz patch the company has released this month. Google Chrome will revoke notification permissions for websites that users haven't visited recently. The change is designed to reduce notification spam. Chrome already does the same thing for camera access or location information. And finally, researchers say data poisoning attacks on LLMs are more practical than previously thought. A recent academic study said as few as 250 malicious documents could poison an LLM's output. Anthropic AI says this challenges previous assumptions that attackers would need to control a significant amount of training data. And that is all for this podcast edition. Today's show was brought to you by our sponsor Nebuloc. Find them@nebuloc IO. Thanks for your company.