Loading summary
Transcript1 lines
- [00:04]
A
The Plone CMS stops a supply chain attack, French cops raid the Ex Paris office, the number of malicious open claw skills grows, and a Chinese APT hacked notepad servers. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 4th of February and this podcast episode is brought to you by Dropzone AI. In today's top story, a threat actor managed to insert code into the Plone CMS project, but the modifications were removed before release. The incident occurred in January. The attacker compromised a developer on the project. Their personal account token was used to add code that was designed to steal credentials, API keys and crypto wallet data, according to GitHub's security team. The code targeted developers working with Plone rather than visitors to clone based sites. In other news, the number of malicious skills on the Clawhub portal reached 400 on Tuesday, up from 28 last week. OpenClaw is an open source AI assistant that users can connect to their apps and personal accounts, add on skills from the portal, allow the AI to perform additional tasks. Security researchers recently spotted a growing number of malicious open claw skills that steal user credentials or or deploy malware. The assistant was previously known as Claudebot or Maltbot. More than 1.5 million API tokens were exposed in a backend database for the Maltbook AI platform, according to reports. The platform is a social network for OpenClaw personal AI assistants. Cloud security firms Permeso and Wiz reported on the leak. They said it exposed the API tokens, messages between agents and and information on the owners. The source of the leak was a misconfigured super based database that was left exposed on the Internet with full read and write permissions. The Eclipse foundation will roll out a series of security features for the VS code extension marketplace OpenVSX. The platform will scan extensions for malicious code, typo squatted names and accidentally included credentials. In recent months, OpenVSX has hosted hundreds of malicious extensions, including the self replicating malware Glass worm. The French offices of social media network X have been raided by Europol and local authorities. The raids were part of a criminal investigation over child sexual abuse images and pornographic deepfakes. The investigation was triggered by the Grok AI feature that allows X users to generate nude images. EX CEO Elon Musk and former CEO Linda Yaccarino have been summoned to appear at hearings in April. The California city of Mountain View will disable Flock automated license plate readers, officials say. The move comes after out of state agencies accessed the city's data without its consent. They also said Flock failed to notify them of the unauthorised access. A Chinese state hacking group spent six months inside the server infrastructure of the Notepad app. Cybersecurity firm Rapid7 has linked last year's attack to a group known as Billbug and Lotus Blossom. The attackers used the Axe access to ship malicious updates to a specific set of targets. The final payload was a novel backdoor named Chrysalis. Hackers who breached a Belgian high school are extorting parents after the school refused to pay a ransom. They're demanding €50 from each parent. The hack targeted the Our Lady Institute Pulhof School in Antwerp last month. The original ransom demand was €15,000. Hackers have stolen almost $30 million worth of tokens from the Step Finance Defi platform. The company says the hackers used a well known attack vector to access its treasury wallets. The platform's token plummeted more than 80% following the hack. Meantime, hackers have stolen $3 million from the Cross Curve cryptocurrency bridge after exploiting a bug in its smart contracts. The company's CEO, Boris Pover has threaten to take legal action against the attacker if they don't return the funds in three days. This will include a criminal complaint and a separate civil litigation. The nation states Browser game has reported a security breach. A player of the game gained access to a production server and downloaded the game's source code and user data. Nation States says emails, passwords and IP addresses were exposed. The player has apologised. It retailer Canada Computers has suffered a security breach that exposed customer card data. Malicious code was added to the Canadian company's website in December. Customers who used the guest checkout option had their payment card details and personal information collected. Meta is now using a Rust component to safely process media files shared on WhatsApp. Meta moved to Rust after the majority of WhatsApp's security flaws were caused by memory safety bugs in its C and C code. The company says it will prefer using memory safe languages like Rust for future code. Citrix devices have been targeted in a recent reconnaissance campaign. More than 60,000 residential IPs were used to search for the login pages of Citrix ADC and netscaler gateway devices. According to Greynoys, reconnaissance activity like this typically precedes exploitation. CISA has quietly updated entries for 59 vulnerabilities on the KEV list. The updates tagged the vulnerabilities as having been used in ransomware attacks. Security firm Greynoise says the updates are welcome, but most Security teams would not be aware of them since the agency didn't announce the update. Threat actors are exploiting a vulnerability in Metro, a development server that ships with the React native app framework. The vulnerability was disclosed in November and attacks started a month later. It's an unauthenticated OS command injection flaw. Security firm Voncheck has spotted attacks targeting Windows systems with PowerShell based loaders. The nitrogen ransomware contains a bug that permanently corrupts encrypted files. The bug overwrites a part of the ransomware's public key. It only impacts the variant of nitrogen that targets VMware. ESXi security firm Mzisoft has urged victims to avoid paying the attackers since since they won't be able to decrypt their files. An underground cybercrime service that sold code signing certificates has exit scammed. The certificates were used by multiple malware operations to sign their payloads. The service, Globalman, claims its source code was compromised. Funds deposited by customers have also disappeared. A cybercrime operation known as the Naish team has survived a takedown by Russian authorities. Russian security firm F6 found new server infrastructure and malware developed by the group. Russia's National Domain Registrar seized 110 domains operated by the group last July. The NIOSH team has been active since 2022 and primarily develops remote access trojans. And finally, nearly a third of Meta ads shown over 23 days in Europe and the UK pointed to online scams. A small cluster of 10 advertisers were responsible for more than 50 of the malicious ads. The ads and the scam sites shared payment and infrastructure linked to China and Hong Kong. Gendigital believes this is an indicator of an organised industrial scale operation. And that is all for this podcast edition. Today's show was brought to you by our sponsor DropZone AI. Find them at DropZone AI thanks to your company.