Loading summary
Transcript1 lines
- [00:04]
A
Most smart devices run outdated web browsers. Ukrainian hacktivists breach a major Russian defence contractor, ransomware hits Venezuela's state owned oil company and hackers are trying to extort pornhub with stolen user data. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire Aird today. Today is the 17th of December and this podcast episode is brought to you by Push Security. In today's top story, the web browsers in many smart devices are out of date, some by as much as three years. An academic study analysed the browsers that shipped with smart TVs, E readers, gaming consoles and other modern hardware. Some of the devices had old vulnerable browsers even when they were brand new. Other manufacturers offer firmware updates but fail to update the embedded browsers. In other news, the White House is preparing to nominate Army Lieutenant General Joshua Rudd as the next head of Cyber Command and the U.S. national Security Agency. General Rudd is currently serving as Deputy Chief of the U.S. indo Pacific Command. Both CyberCom and the NSA have been without a leader since Trump dismissed Air Force General Timothy Hawg in April. The nomination of Army Lieutenant General William Hartman for the same position fell through in October. Ukrainian hacktivists have sabotaged a major Russian defence contractor. The Khyber Group claims it wiped systems at ascon, a software developer for the Russian defence industry. The hackers claim to have stolen more than 10 terabytes of internal data and wiped backups and CCTV systems. ASCON developed software for Russian missiles, tanks, nuclear weapons and radars. A cyberattack has crippled the activity of Venezuelan's state owned oil and gas company Petroleos de Venezuela. The attack shut down systems for production, refining and shipping oil products in the country's north. The intrusion has been reported as a ransomware attack, although the company has blamed the United States. Hackers are threatening to release the viewing and search history of pornhub premium users. The Shiny Hunters claim to have stolen more than 94 gigabytes of data from one of Pornhub's analytics providers. The group is now demanding a ransom to stop it releasing the data. Porn pornhub says the information was taken from analytics company Mixpanel. The same breach at Mixpanel also exposed data from OpenAI peer to peer lending platform Prosper has disclosed a security breach. The incident took place between June and August and involved data about more than 17 million customers. The hackers stole personal information such as names, home addresses, driver's licenses and Social Security numbers. An Iranian hacktivist Group is offering $30,000 bounties for information about Israeli engineers working in the defence sector. The Handala hacker group is seeking information about workers on Israel's Patriot Arrow and David's Sling Air defence systems. The group doxxed multiple Israeli engineers last week in an attempt to intimidate them. Handala has previously offered bounties for information about personnel at Israel's intelligence agencies and and military. The Texas attorney general has sued five smart TV makers over their data collection practices. Lawsuits have been filed against Sony, Samsung, LG, Hisense and TCL. The lawsuits claim smart TVs from the five companies use automated content recognition to spy on users watching habits. The ACR technology uploads images of the screen to the manufacturer's servers for analysis. Microsoft is finally disabling the RC4 cipher used in Windows Kerberos authentication. The cipher's weakness is a part of Kerberosting, an attack that allows threat actors to retrieve account credentials from active directory. Microsoft's decision comes after US Senator Ron Wyden called on the FTC to investigate the company over its use of the antiquated cipher. Google will shut down its Dark Web Report feature next year. The feature notified users when their Google account data appeared on the Dark Web and prompted users to reset the their passwords. The feature will stop scanning the dark web on January 15th and shut down for good a month later. A 20 year old from Minnesota has pleaded guilty to hacking sports betting website DraftKings. Nathan Ostad admitted to launching a credential stuffing attack against the platform in November 2022. Ostad used the hacker pseudonym Snoopy and worked with two other co conspirators. The trio hacked and then sold access to more than 60,000 DraftKings accounts. All all three were arrested last year and have now pleaded guilty. One of his co conspirators has been sentenced to 18 months in prison. Serbian police have detained two Chinese nationals for driving an SMS blaster around. The duo allegedly sent SMS messages that lured locals to phishing sites. The sites posed as mobile operators and government portals and attempted to collect payment card details. Ukrainian authorities have dismantled fraud call centres in three cities. The call centres collected more than 10 million euros from from victims across Europe. The operators posed as local governments and law enforcement to trick victims into wiring them money. Authorities identified 45 suspects and arrested 12 threat actors are using a new social engineering technique to hijack WhatsApp accounts. The new Ghost pairing attack lures victims to pages with malicious QR codes. Scanning the codes will link an attacker's device to the victim's WhatsApp account. The attack is a variation of a technique used by Russian state sponsored hackers to intercept signal messages earlier this year. Threat actors are exploiting a new vulnerability in Gladinet CentreStack and TrioFox file sharing service. Attackers use the vulnerability to retrieve a cryptographic key which they then leverage to run malicious code. The vulnerability has been abused in the wild as a zero day since last month. According to security firm Huntress, at least nine companies have been hacked so far. Threat actors are exploiting two Fortinet vulnerabilities that were patched last week. The flaws allow attackers to bypass single sign on authentication on Fortinet devices. The attacks aren't widespread because forticloud SSO login is disabled by default. MGT Commerce has released a security update to remove a backdoor mechanism from one of its Magento extensions. The system could have allowed remote attackers to run code on servers that use the MGT varnish caching component. Security firm Sans believes the backdoor was benign and intended for debugging and remote upgrades. And finally, Amazon has patched a vulnerability in the Kindle ebook reader. The security flaw could have allowed threat actors to gain root access to the device and take over a user's Amazon account. The vulnerability was delivered via a malicious Audible ebook and exploited the media parsing process. The issue was discovered by Thales security researcher Valentino Ricotta, who received a $20,000 bounty for his work. And that is all for this PODC Cast edition. Today's show was brought to you by our sponsor Push Security. Find them at pushsecurity. Com thanks to your company.