Loading summary
Transcript1 lines
- [00:04]
A
RPKI relies on vulnerable service the French Ministry of Economy discloses a data breach. The UK gives tech platforms 48 hours to remove revenge porn and click fix attacks are responsible for half of malware infections. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire Airdrop. Today is the 20th of February and this podcast episode is brought to you by Run Zero, the Total Attack surface and exposure management platform. In today's top story, Chinese academics say many backend servers that support RPKI secure Internet route distribution are themselves vulnerable to takeover. Recent research analysed 64 servers that publish route origin authorisation data. This data is used by Internet networks to verify BGP route advertisements. The researchers found that almost half of the tested servers were vulnerable to DNS hijack attacks. Almost all ran on infrastructure that's not protected against malicious route advertisements, the very same attacks they're meant to prevent. In other news, hackers have compromised a French Ministry of Economy staffer and accessed a database of local bank accounts. The database stored information about more than 1.2 million accounts, including owner names and contact details. The the government will notify all affected account holders. Tech platforms will be given 48 hours to remove non consensual explicit images of UK users. The new requirement is being added to Britain's crime and policing bill. Companies that fail to act on reports risk fines of up to 10% of their global revenue. Platforms that don't pay their fines may also be blocked. In the UK, a coordinated DDoS attack is disrupting Germany's national rail operator Deutsche Bahn said Tuesday's attack has affected ticketing and real time information systems. The attack came shortly after the company announced layoffs in its freight cargo division. Six thousand of its 14,000 employees would be let go. No group has taken credit for the attack. A cyber attack has forced the University of Mississippi Medical Centre to temporarily close its 35 clinics. All surgeries and appointments will be rescheduled for later dates. The hospital group said it lost access to all IT funds functions, including its electronic medical records system. UMMC has more than 10,000 employees. Its campus includes the only children's hospital in the state. A ransomware attack has disrupted the IT systems of Oklahoma's Cyan and Arapaho tribes. The incident occurred in December and disabled the tribal government's IT phone and email systems. The incident primarily impacted its higher education program, delaying the processing of spring scholarships. Officials have now restored access to 80% of affected systems. The Raisida group has taken credit for the attack. The Predator spyware was used to hack the personal phone of a prominent Angolan journalist and activist, according to an Amnesty international investigation. Tayshire Kanjido's phone was infected in 2024 when he clicked a malicious link in WhatsApp. The spyware was removed after Kanjiro restarted his phone. Predator's developer Intellexa, said it only sells its spyware to government clients. A breach at an Australian finance tech company has exposed the personal information of more than 440,000 citizens. The breach at Sydney firm UX occurred last week. Hackers are now selling the data on underground forums. The stolen information includes the personal details of loan applicants, including government identification scans. A threat actor has hijacked the GitHub repository of the Klein AI coding agent. The attacker used the repo to push a malicious update to Klein's NPM library. The update didn't deploy malware. Instead, it deployed a version of the openclaw AI agent on Klein's user systems. The attacker stole the project's GitHub published token after security researcher Adnan Khan blogged about a vulnerability that exposed the token. Spanish police have detained a 20 year old who's accused of hacking a hotel reservation platform. He manipulated the site's payment system to book luxury hotel rooms for 1 cent. Police arrested him at a Madrid hotel on Wednesday, where he racked up a bill of more than €20,000. A Nigerian hacker has been sentenced to eight years in a US prison for hacking Massachusetts tax preparation firms. Matthew A. Akunde used to stolen data to file fraudulent tax returns with the IRS. He made almost $1.4 million before being arrested in Mexico in 2024. A joint operation between Interpol and multiple African countries has led to the arrest of 651 cybercrime suspects. The detained individuals have been linked to investment scams, mobile fraud and bad loan applications. Authorities also recovered $4.3 million in stolen assets. The US state of Texas has sued router maker TP Link. Texas Attorney General Ken Paxton claims the company granted the Chinese government access to Americans data. The suit also claims the devices have been used by Chinese hackers against Americans. Russian FSB chief Alexander Bortnikov has accused Telegram of harbouring criminal activity. In a statement, Bortnikov said the messaging platform ignored more than 150,000 content removal requests from Russian authorities. Russian officials also claim that foreign intelligence services have read messages exchanged between its soldiers. Telegram said the statement was a fabrication. Russia began blocking and throttling the platform's traffic last week. Hackers have impersonated Indonesia's tax platform and stolen up to $2 million. A large scale phishing operation that targeted Android users began in January, ahead of the country's tax deadlines. Security firm Group IB has linked the attacks to a group it tracks as the Gold Factory. The clickfix technique was the entry point for more than half of all malware infections spotted by Huntress Labs last year. The method was first spotted in 2024 and has since become a workhorse technique. It tricks users into copy pasting malicious commands into their Windows or MacBooks terminals. The FBI says the number of ATM jackpotting attacks have spiked. In the U.S. more than 700 attacks were last year, which resulted in $20 million in losses. In the four years prior, just 1,200 total attacks were reported. ESET has discovered a new Android remote access trojan that abuses Google Gemini to remain active on infected devices. PromptSpy uses Gemini to analyze contents on screens and plan its interactions with the user interface. The malware is distributed outside of the Play Store and has been used in campaigns targeting Argentina. A Vulnerability in an OpenID plugin for Tomcat allows threat actors to bypass authentication. According to security firm ERNW, the Tomcat's OpenID Connect authenticator will accept JWT tokens with an unknown signature algorithm. The issue was discovered in September but remains unpatched, as the library's developer could not be contacted. The Kubernetes project is retiring its nginx ingress controller in March. The project has warned administrators that continuing to use the controller will leave them exposed to attacks. Developers will need to migrate to a new ingress controller. And finally, the DEFCON Security Conference has banned three individuals who were mentioned in the Epstein files from attending its Vincenzo Iotto, Joichi Ito and Pablos Holman were added to the ban list this week. None of the individuals have been charged by US Authorities, but files released by the DOJ detailed their contact with the late Jeffrey Epstein. And that is all for this podcast edition. Today's show is brought to you by our sponsor Run Zero. Find them@runzero.com thanks for your company, Sam.