Loading summary
Transcript1 lines
- [00:04]
A
America's Government Accountability Office says the Pentagon employs more than 70,000 cyber personnel. Hackers steal sonic wall firewall configs, Deepseek returns insecure code for groups that China doesn't like and two scattered SPIDER members arrested in the uk. This is the risky bulletin prepared by Catalyn Campanu and read by me, Amberly Jackson. Today is September 19th and this podcast episode is brought to you by application. Allow listing software maker Airlock Digital A US Government Accountability Office investigation has found that the Pentagon employs more than 70,000 people in cybersecurity and cyberspace operation roles. The report says the cyber workforce is spread across 500 organisations and includes 61,000 military and civilian personnel and 9,500 temporary contractors. The report found that many military organisations provide overlapping services and could allow room for cost cutting. The GAO report is the first full review of US cyber personnel and capabilities. A DHS office leaked unclassified data for two months in 2023. The leak occurred due to a misconfiguration in a platform managed by the DHS Office of Intelligence and Analysis. The office collects surveillance data to share with other US law enforcement agencies. The misconfiguration exposed investigative leads to thousands of users who were not authorised to view them. U.S. immigration and Customs Enforcement has signed a $3 million contract with Magnet Forensics. The company merged with GreyShift in 2023 and makes the Grey Key tool, which can forcibly unlock phones and extract user data. ICE also recently signed a $10 million contract with facial recognition company Clearview AI and reactivated a contract with Israeli spyware and surveillance maker Paragon Solutions. Brazil has passed a new data protection law similar to the UK Online Safety Act. The digital ECA will require companies to limit children's access to sexual and violent content by introducing age verification checks. It also requires tech companies to introduce parental control systems. All platforms are banned from using a child's data for targeted advertising. The Moldovan government is establishing an agency to counter disinformation. Stratcom will have 29 employees and will begin operating within a month. Plans to establish the centre were announced in 2023. It will launch days after Moldova holds its parliamentary elections on September 28. Recent research has shown that DeepSeek AI returns code with security flaws to coders that are working for groups deemed sensitive by China. According to the Washington Post, programmers from Tibet and Taiwan received code of lower quality. Deepseq also refused requests if queries suggested that code would be used by the Islamic State or the Falun Gong movement. Hackers have accessed backups of firewall configuration files stored on the MySonicWall cloud service SonicWall is notifying customers and asking them to reset firewall credentials. Less than 5% of the company's firewalls are affected. The attacker allegedly used a brute force attack to break into the accounts and steal the backup config files. The world leaks data Extortion Crew has leaked patient data from an emergency medical transportation company. Survival Flight was hacked in July and almost 11,000 patients were impacted. The company provides rapid response medical air transportation services in the U.S. according to Data Breaches.net, this is the company's second hack in less than a year. Two teenage members of the Scattered Spider hacking group have been arrested in the UK. 19 year old Thala Joubert and 18 year old Owen Flowers were arrested at their homes on Tuesday. They were accused of hacking Transport for London, the city's public transportation agency, back in August last year. Joubert has also been charged in the US for the hacks of 47American companies and extorting ransoms of at least $115m. A former UK Labour councillor has been charged with blackmail after an investigation into the Westminster honey trap scandal in 2023. Oliver Stedman allegedly posed as a woman and sent flirtatious WhatsApp messages and explicit images to 12 individuals. Five of those were UK politicians. The incident was initially believed to be the work of foreign hackers. Stedman was arrested in April 2024. This week he was charged with blackmail and improper use of a public phone network. He resigned from his position shortly after the arrest. A supply chain attack that deployed a worm on the NPM repository has now reached more than 500 packages. Attackers steal access tokens and upload them to public GitHub repositories. The worm only runs on macOS and Linux systems. Security firm Upguard has identified at least 17 major companies impacted by the token thefts. The worm has been linked to the same group that carried out a previous NPM supply chain attack known as Singularity. The System BC malware botnet is infecting new devices after its servers were seized by Europol last year. According to Lumen, the botnet is now targeting virtual private servers instead of home consumers. Access to the hacked servers is being rented to multiple proxy network operators. A large number of current router models are still vulnerable to a 10 year old wifi attack. The Pixie dust attack allows threat actors to recover router wps pins and access their WI FI networks. A NETRISE study of 24 current routers found that 20 of them were still vulnerable. Google has patched and actively exploited Chrome Zero Day. It is a vulnerability in Chrome's V8 JavaScript engine and was discovered by one of Google's internal security teams. It is the sixth Chrome Zero day to be patched this year. Threat actors are exploiting a vulnerability in a WordPress plugin. The case Theme User plugin is bundled with multiple commercial WordPress themes. The vulnerability allows remote attackers to access any account on a site as long as they know a user's email address. According to WordFence, the plugin is installed on more than 12,000 websites. Exploitation began at the end of August, and finally, three major EDR vendors have pulled out of evaluations for the MITRE, ATT and CK framework. The evaluations check if the EDRs detect common TTPs that are used in the real world by known threat actors. Sentinel One and Palo Alto Networks pulled out last week while Microsoft left in June. That's all for this podcast edition. Today's show was brought to you by our sponsor, Airlock Digital. Find them@airlockdigital.com thanks for your company.