Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Russia suspected of hacking a US court system Researchers break the Darkbit ransomware's encryption, A new attack can leak sensitive data from AMD processors and a brute force campaign targets fortinet devices. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 13th of August and this podcast episode is brought to you by Yubico, the inventor of the Yubikey. Russian hackers are suspected of being behind a recent breach of the US Federal court filing system. The hackers allegedly search for criminal cases featuring Russian and Eastern European surnames. It's unclear if the hack is the work of state cyber units or cybercrime groups. The hack occurred around the July 4th US holiday. Hackers accessed the PACER and CM ECF systems. In other news, the Interlock ransomware gang has published more than 43 gigabytes of files from the Minnesota city of St. Paul. The group published the data after officials refused to pay the ransom. The city called in the National Guard's cyber units to assist with recovering and securing its network. It set up operations at the Roy Wilkins Auditorium and urged employees to visit and secure their accounts. More than half of the city's employees reset passwords, entered and updated devices on Monday. The personal Data of almost 500,000 women has been stolen from a Dutch cancer testing program. The data was stolen from a third party testing laboratory. It impacted women who were tested for cervical cancer. The Dutch government has not identified the threat actor responsible. A ransomware attack has once again disrupted the operations of South Korean online bookstore and ticketing platform Yes24. The company's apps and websites were down on Monday morning but were restored by the afternoon. Yes24 suffered a similar ransomware attack in early June. McDonald's Poland has been fined almost 4 million euros for leaking employee personal data. The leak occurred at a partner company that managed employee work schedules. The data included names, passport numbers, positions and work schedules. It was left in a publicly accessible location on a web server. This is the second largest GDPR fine handed out by Polish authorities. The largest was a 6.3 million euro fine handed to the country's postal service earlier this year. Staff and students at the University of Western Australia were locked out of their accounts following a security breach. UWA reset passwords for all accounts on Monday, the university said. No information other than passwords appears to have been accessed. The Russian government is extending its SORM traffic interception system to 5G satellite communications. Operators will have to install interception equipment at ground stations located in Russ. The new legislation is expected to go into effect next March. Four of Russia's largest telcos have petitioned the government to ban voice calls using foreign instant messengers. They argue that a ban would return traffic to the phone networks and increase their revenue. The telco said they need the revenue to support rising infrastructure maintenance costs. Returning voice calls to traditional systems would also improve the state's interception capabilities. The Netherlands first BEC related lawsuit has been ruled in favour of the victim. A local car company was ordered to reimburse €27,000 to an Australian man who paid for a car in 2022. The company's email was hacked and scammers redirected payment to their own bank accounts. The customer sued after the company refused to deliver the car or provide a refund. Physical attacks on cryptocurrency holders have significantly increased this year and according to crypto tech firm Satoshi Labs, at least one bitcoin owner gets kidnapped each week. Many are tortured for access to their wallets. The company says the attacks are often aided by data leaks from cryptocurrency exchanges. A brute force campaign is targeting Fortinet devices. The campaign started on Aug. 3. It first targeted Fortinet VPNs and shifted to 40 manager devices, Greynoys said. In a single day, almost 800 unique IPs were involved in the attacks. Israeli security firm Profero has developed a decryptor for the Darkbit ransomware. The decryptor exploits a weak key generation algorithm used by the Darkbit group. The group launched in 2023 and is believed to be associated with the muddy water Iranian espionage operation. Profero has not publicly released the decryptor but has offered to help victims. Two hackers have leaked files from the back end of a state sponsored hacking group. The files contain phishing kits, stolen data and the hackers claim the data belongs to the North Korean state sponsored espionage group Kimsuki. They claim the data suggests Kimsuki may also operate on behalf of China and might have Chinese speaking members. A more complete analysis of the data will be published in the Frac magazine this week. A new Russian cyber espionage group has been spotted targeting Georgia and Moldova. Attacks from the Kirli Comrades group coincided with Russian influence operations pushing pro Kremlin geopolitical shifts in both countries. The attacks targeted judicial and government bodies in Georgia and an energy distribution company in Moldova. The Chinese government is using AI companies to monitor and manipulate public opinion on social media. A company named Golaxy has used AI tools to run influence operations targeting users in Hong Kong and Taiwan. Golaxi used a tool named GoPro to build psychological profiles of social media users. The company then deployed bot networks to sway public opinions. The company allegedly removed blog posts mentioning its work with the Chinese government after it gained Western attention. Severe vulnerabilities have been found in a major car manufacturer's online dealership portal. Security researcher Eaton Zvere said the bugs could have allowed attackers to create their own admin accounts. The vulnerabilities resided in the portal's login system and were patched in February. Zwehr has not named the company. Meantime, an unpatched vulnerability could allow attackers to hijack smart bus systems. The vulnerabilities impact routers from VEE technologies that are commonly installed on smart buses in Taiwan. Attackers can bypass authentication and access the router's management panel. Trend Micro says attackers can easily escalate access from the router to the critical systems that manage collision detection, traffic sign recognition and GPS tracking. Researchers said they notified the router maker, but the company failed to reply. A new attack can leak sensitive data from confidential virtual machines that rely on AMD's SEV SNP technology. The new Heracles attack exploits the process of moving confidential data to a new memory location. It was developed by academics and has been successfully used to leak kernel memory, cryptographic keys, user passwords and web sessions. AMD released patches this week. And finally, 71 open source projects have received funding from GitHub to improve their security. The company established its GitHub Secure Open Source Fund last November. Each project received $10,000 to allocated to fixing security flaws. According to GitHub, projects fixed more than 1,100 vulnerabilities and prevented the leak of over 90 secrets and tokens. Projects that received the funding include Node JS, Next JS, Bootstrap, Log4j, and Jupyter. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Yubico. Find them@yubico.com Thanksg Company.