Loading summary
Transcript1 lines
- [00:04]
Claire Airdrop
A security researcher scores $250,000 for a Chrome bug, WinRAR patches another zero day new vulnerabilities found in the Tetra communications protocol, and a researcher gains access to Microsoft's internal network for fun and no profit. This is the Risky bulletin prepared by Catalyn Kimparnu and read by me, Claire airdrop. Today is the 11th of August and this podcast episode is brought to you by Yubico, the inventor of the Yubikey. Google has paid a bug hunter $250,000 for a novel sandbox escape in Chrome. The flaw was reported in April and it was patched the following month. The vulnerability was in Mojo, a Chrome component for managing how the browser's internal processes communicate. The bug allowed attackers to impersonate the browser's privileged parent process and from there escape the sandbo. The bounty is one of Google's largest to date. In 2022 it paid $605,000 in a single reward. An EU law restricting the use of spyware and surveillance against journalists has come into effect. The European Media Freedoms act was introduced in 2022 and adopted in early 2024. Multiple press freedom organisations have said the legislation is ineffective as most EU governments have not begun implementing it at a national level. Large Russian corporations will be prohibited from storing the personal data of citizens in foreign cloud environments. The ban is expected to come into effect in September 2027. It will not apply to small and medium sized companies or individuals. The credit's DeFi platform has disappeared from the Internet following a hack last week. The platform has deleted its social media accounts and taken down its website. Last Monday, the attacker took control of an admin wallet and stole almost $4.5 million worth of assets before it went offline. Credits promised to reimburse users Four nationals of Ghana have been extradited to the US to face charges over their roles in a scam operation. The four allegedly stole more than $100 million using romance and BEC scams. If found guilty, they each face up to 75 years in prison. 18 Chinese nationals accused of operating a scam call centre in Thailand have been detained. The call centre operated for three months from a rented house in the city of Chiang Mai. It targeted other Chinese speakers. According to the Bangkok Post. The suspects all attempted to flee. Eight were injured after jumping from the second floor of the house. Russian authorities have opened the country's first criminal dropper investigation. The term dropper refers to an individual who manages money mules. A Moscow man was charged last with paying mules to open bank accounts that received stolen funds. Russian police tracked down the suspect after a mule took advantage of a law offering immunity for cooperating with authorities. Retired and elderly Americans lost $700 million to scams last year, according to the Federal Trade Commission. Its statistics showed a dramatic increase since 2022, when the figure was 120 million, the report said. Many of the scammers impersonate the FTC and target older Americans wanting to protect their funds. A group of white hat hackers has volunteered to help protect the water systems of small US Municipalities. The DEFCON Franklin team will offer no cost support on network mapping, password protocols and OT assessments. The group's already deployed volunteers across four US States as part of a pilot program. Team Atlanta has won DARPA's AI competition. The AI Cyber Challenge took place over two years. The final was held at the DEFCON Security Conference over the weekend. The winning team is comprised of experts from Georgia Tech, Samsung, Pohang University and the Korea Advanced Institute of Science and Technology. Security firm Trailer Bits and Theory finished second and third. The top three teams will receive $4 million, $3 million and $1.5 million, respectively. A security researcher has gained access to more than 20 Microsoft internal services isecurity's Vaisha Bernard to systems that managed Copilot, Bing, Azure, APIs and Microsoft billing. Bernard says he exploited an Entra ID OAuth misconfiguration that was shared by many Microsoft systems. He even gained access to a system that could approve his own bounty payments. Despite this, Bernard was not paid a reward. Security researchers have broken the Terrestrial Trunked Radio Communications Protocol for the second time. Also known as tetra, the protocol is widely used by law enforcement, military and critical infrastructure operators. Security firm Midnight Blue first cracked Tetra in 2023. It found new vulnerabilities in the protocol's updated end to end encryption. The updated version was intended to address the previously discovered vulnerabilities. Midnight Blue's latest findings include a scenario where the protocol intentionally weakens its encryption key, allowing for traffic decryption. The Winrar file archiver has patched an actively exploited zero day. The path traversal vulnerability allows attackers write files outside the intended location. Security firm ESET discovered and reported the zero day. Russian security firm Bizone appears to have linked the attacks to the paper. Werewolf APT group, also known as GoFi. The Embargo ransomware gang has collected more than $34 million since last April. Blockchain intelligence firm TRM Labs said most victims were located in the US the group is believed to be a rebrand of the Alf V operation that was shuttered by authorities last year. A threat actor has uploaded more than 60 malicious packages to the RubyGems repository. The libraries posed as automation utilities but stole login credentials for social media and marketing tools. Their campaign's been running for more than two years. According to Socket Security, the packages have been downloaded more than 275,000 times. Instagram has released a new feature allowing users to share their location. The Instagram map feature was released last week and is turned off by default. When turned on, posts are shown on a map with precise locations. Instagram had a similar feature about a decade ago. It was discontinued after complaints about harassment and stalking. And finally, a California man is suing Microsoft over the discontinuation of Windows 10 later this year. Lawrence Klein claims the Windows 10 end of life is part of Microsoft's plan to monopolize the generative AI market. Klein says Microsoft is using forced obsolescence to make users switch to Windows 11, which comes pre installed with the company's gen AI tools. And that's all for this podcast edition. Today's show was brought to you by our sponsor, Yubico. Find them@yubico.com thanks for your company.