Loading summary
Transcript1 lines
- [00:04]
A
A cybercrime group abuses routers to send SMS spam CISA announces a new collaboration model for state governments South Korea raises its cyber threat level after a data centre fire and tile tracking devices expose their location. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire Airdrop. Today is the 1st of October and this podcast episode is brought to you by Authentic in today's top story Hacked Milesite industrial routers are being abused to send SMS spam. The attacks are abusing a router feature intended to alert network admins via text message. Security firm Sequoia says hackers are exploiting a 2023 vulnerability to extract router logs and decrypt admin passwords. The campaign has been targeting Europe since February 2022. There are currently 19,000 mile site routers connected to the Internet. In other news, CISA will launch a new collaboration model for local governments to replace Ms. Isac. The new approach allows local governments access to grant funding, free tools and CISA cybersecurity experts in regional centres. CISA's funding for Ms. ISAC expired in March. Hackers accessed the U.S. federal Emergency Management Agency's Citrix environment in a recent security breach. According to NextGov. The the attackers likely abused a vulnerability known as Citrix bleed 2. They stole employee data from both FEMA and Customs and Border Protection during the breach in June. In August, DHS head Kristi Noem fired 24 members of FEMA's IT department, including the CIO and CISO. South Korea has raised its national cyber alert level following a state data centre fire. It's now at caution, which is the second level in a four tier system, and officials are concerned that threat actors could take advantage of the outage to launch cyber attacks. The fire started in the lithium battery of a backup power system. The government is in the process of moving to a new data centre. The FTC has filed legal proceedings against the anonymous messaging app sendit. The agency claims the app tricked users into paying to identify the sender of anonymous messages. In many cases, those messages were generated by the company itself. Sendit is also accused of failing to obtain parental consent before collecting data of children aged under 13. A cyber attack has disrupted several services at Japan's largest brewery call centres, orders and shipment operations at the Asahi Group are down. The impacts are confined to the company's domestic operations. Its international business has not been affected. No ransomware group has taken credit for the attack yet a download link for the Mockito Java testing framework has been redirecting users to a malicious file. The link is in the project project's wiki and was modified more than three years ago. The Mockito project is a popular Java unit testing framework with more than 15,000 stars on GitHub. A recent ICANN investigation into domain registrar Webnik was triggered by a complaint from security firm infoblox. The firm accused Webnik of refusing to take down malicious domains. Earlier this year, the domains were being used by the threat actor D2A dog, and to redirect hijacked web traffic to malware and online scams, according to Infoblox. When security firms sinkholed the malicious domains, Detour Dog registered new ones with webnick. The company also refused to take those down. An Android banking trojan has infected more than 3,000 devices since launching in late August. Most victims are located in Italy and Spain, according to security firm Kleefi. The Cleopatra Trojan appears to be the work of a Turkish speaking group. A Chinese cyber espionage group has been targeting government organisations and telcos in Africa, the Middle east and Asia. The phantom tourist group has been targeting email servers for more than two years. The group's operations have often coincided with geopolitical events and military operations. Broadcom has patched an actively exploited VMware zero day low privileged attackers in a virtual machine can leverage VMware tools to elevate themselves to admin inside the VM. Security firm Nvizo has linked the attacks to UNC5174. Google previously identified the group as a contractor for China's Ministry of State Security, academics say. Tile location trackers expose user location data to people nearby, according to researchers from Georgia Tech. The devices transmit a consistent Mac address and unique id. Unlike its competitors, the information is unencrypted and can be collected with simple radio equipment. Researchers reported the issues to Tile in November last year, but the company has since stopped responding. Tile's parent company, Life360, told the Register that improvements had been made, but did not provide further details. Image sharing website Imgur has blocked access from the uk. The site was expected to be fined for failing to implement age checks for British users. The UK's privacy watchdog started investigating the company in March. And finally, the Taliban has shut off access to the Internet in Afghanistan. The country's population of 43 million people have been isolated by the government's crackdown on what it calls immoral activities, A government official said an alternative system will be established for essential needs, and that is all for this podcast edition. Today's show was brought to you by Authentic Find them@goauthentic IO thanks for your company.