← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
Fema's IT staff fired over an alleged breach WhatsApp patches a zero day the sales loft breach impacted more than just Salesforce and A scammer steals $1.5 million from the city of Baltimore this is the Risky Bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 1st of September and this podcast episode is brought to you by Push Security. The Trump administration has gutted FEMA's IT department. Homeland Security head Kristi Noem fired FEMA's CIO, CISO and 22 other IT staffers after claiming the agency suffered from a data breach. The firings and alleged incident followed an audit of the agency's systems. The audit found that FEMA did not deploy Multi Factor Authentication, used prohibited legacy protocols, and failed to patch known and critical vulnerabilities. DHS announced the firings in a press release that accused FEMA employees of being part of the Deep State. In other news, the Israeli military targeted Iranian officials using location information obtained by hacking their bodyguards phones. A missile strike hit a bunker where Iranian officials met during the military conflict between the two countries in June. According to the New York Times, Israel has been tracking phones used by Iranian bodyguards for many years. Meta has patched a zero day vulnerability in WhatsApp. The zero day was part of an exploit chain used in the wild to hack Apple devices. Apple patched its part of the chain in a security Update released on August 20th. According to Amnesty International, the two zero days have been used in a spyware campaign over the last three months. The city of Baltimore lost $1.5 million to a scammer earlier this year. The attacker impersonated one of the city's vendors and tricked it into making two payments into the wrong bank account. The city managed to recover the second payment of around $700,000. A white hat hacker has played a key role in a lawsuit against Tesla after extracting data from a crashed car. According to the Washington Post. The researcher's work helped secure a $243 million verdict after Tesla claimed it had misplaced the data. The company was sued after a Tesla car on Autopilot plowed into a couple in Florida in 2019, killing a young woman. A security breach at sales automation platform. Salesloft is larger than initially thought. Hackers breached Salesloft last month and used OAuth tokens to pivot into its customers Salesforce accounts. The company's investigation now shows. The attack has also pivoted into its customer's Google Workspace, Slack and Pardot Systems Salesloft has retained Mandiant to assist with the incident. North Korea is behind the recent hack of cryptocurrency exchange Woo X. The company has blamed the North Korean group trader traitor for the recent theft of $14 million in crypto assets. The hackers allegedly social engineered an employee to help debug an open source project and infected their computer with a backdoor. Hackers have breached an email server at the Austrian Ministry of the Interior. The hackers allegedly stole emails from around 100 employees. Officials described the intrusion as targeted and professional. A U.S. court of Appeals has ruled that the Computer Fraud Abuse act cannot be used to prosecute employees for work related incidents. US Debt collection firm the National Recovery Agency Group claimed that two of its employees ran afoul of the CFAA when a sick employee shared her password with a colleague. The 3rd Circuit of Appeals ruled that the CFAA can only be used in cases involving hacking and the theft of trade secrets. Australian authorities are investigating compliance company SafeTrack for breaching surveillance laws in the state of Victoria. According to the Australian Financial Review, SafeTrack recorded the laptop screens and audio of employees working from home. SafeTrack CEO Deborah Coram admitted to the practice in legal documents. Vietnamese authorities have arrested a foreign national for sending fraudulent SMS messages with an SMS blaster. The suspect drove around Ho Chi Minh City with two SMS blasters in the back of their car. The devices send SMS messages impersonating vietcombank and Vietnam Post. This is the third SMS blaster incident in the city in the last month. Amazon's security team has disrupted a cyber espionage operation linked to Russia's SVR intelligence service. The campaign used hacked websites to redirect victims to Microsoft device code phishing pages. Amazon took down the group's servers and domains and worked with cloudflare to prevent the group moving to new servers. This is the second time AWS has disrupted APT29 since October 2024. And finally, Meta's AI chatbots have been impersonating celebrities and flirting with users. The bots impersonated Taylor Swift, Sarah, Scarlett Johansson and Selena Gomez, all without their permission. According to Reuters. The AI chatbots also generated inappropriate nude images, including of underage child stars. A previous report found that Meta's AI chatbots engaged in romantic conversations with children. Attorneys general from 44 US states sent warning letters to 11 AI chatbot and social media companies last week. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them@pushsecurity.com thanks for your company.