Loading summary
Transcript1 lines
- [00:00]
A
Foreign Russia wants to revoke small ISP licenses A cyber attack has disrupted access to US newspaper archives. Node JS pauses its bug bounty program after its funding lapses and Apple Backport's patches for Dark Sword. This is the risky bulletin prepared by Catalan Kimpanu and read by me, Patrick Gray filling in for Claire Ed, who is not feeling well. Claire, we hope you feel better soon. Today is April 3rd and this podcast episode is brought to you by Knock Knock. That's Knoc Knoc Russia is preparing to shut down small ISPs that fail to meet the country's censorship requirements. Small ISPs have been a weak spot in Russia's attempt to control the Internet. Some have failed to block websites or deploy SARM traffic interception equipment. Proposed new laws would allow the Russian Ministry of Digital Development, Communications and Mass Media to revoke ISP licences without a court order. European officials and staff have been told to stop discussing sensitive information on Signal. The warning came after the European Commission learned of a signal group which contained many high ranking officials. Intelligence agencies in both the EU and the US have warned that Russia is attempting to hack signal and WhatsApp accounts for espionage. The US State Department has ordered embassies and consulates to push back against foreign influence operations. Iranian, Chinese and Russian info ops are currently leveraging the war in the Middle east to discredit US policies. The State Department shut down its counter disinformation units last year. A cyber attack on a US newspaper archiving firm is still disrupting access to its digital records. The incident against newspaper archive occurred in late February. The company had hoped to restore services by the end of March. The Utah company archives more than 16,000 publications from 3,500 US cities. American toymaker Hasbro says it will take weeks to recover from a recent hack. In an SEC filing, the company says it shut down affected systems and deployed temporary infrastructure to continue fulfilling orders. No group has taken credit yet. AI training startup Mercor has disclosed a security breach. The company says the breach was a result of the supply chain attack on the Light LLM Python library. Mercor said it contained the breach as soon as it was discovered. The company connects other AI firms with experts in various fields to train specialised models. It's valued at more than $10 billion. A recent breach of the European Commission's Amazon Cloud Environment has been linked to the Trivi supply chain attack. The hacking group Team PCP compromised the Trivey security scanner last week to steal credentials and access tokens. The credentials appear to have been sold to other hacking groups who used them to steal data and extort victims. Certeu says the Shiny Hunters group subsequently stole 90 gigabytes of data from the EU's AWS account and leaked it on the Dark Web. Hackers have disrupted police and fire departments in at least four towns in Massachusetts. The attack targeted the Patriot Regional Emergency Communications Centre, which handles communications for first responders. The hack impacted non emergency and business phone services. The towns of Ashby, Dunstable, Pepperell and Townsend have reported disruptions. Hackers have stolen $280 million worth of crypto from the Drift Defi platform. The company said the attack had been prepared weeks in advance. Drift said the attackers obtained multisig transaction approvals from its Security Council in advance, allowing them to move funds. WhatsApp has notified users who were infected with spyware after installing a fake iOS version of the app. Most of the 200 victims are located in Italy. WhatsApp has sent a cease and desist letter to the spyware's maker, Italian surveillance vendor Sio Spa. The company's website says it only works with intelligence and law enforcement agencies. Cambodian officials have extradited another member of the Prince Group to China. Chinese state media described Li Zhong as a core member of the organisation. He also served as chairman of Hui Wan Group, a subsidiary of the Prince Group. Both organisations have been sanctioned by the United States. The Prince Group was sanctioned for running cyber scam compounds, while Hui Won laundered the proceeds. North Korean hackers have breached more than 400 GitHub repositories to plant malicious tasks. JSON files VS code Users who load or clone the repos would be infected by malware. The campaign abuses a VS code feature that auto executes instructions placed in the JSON file. A rootkit has been spotted inside more than 50 Android apps in the Play Store. The no voice malware is designed to steal WhatsApp sessions and can survive factory resets. It only works on smartphones running Android 7 or earlier, which last received security updates in in 2021, according to McAfee. The infected apps have been downloaded more than 2.3 million times. The Node JS project has paused its bug bounty program after a lapse in its external funding. The program had been running since 2016. It was sponsored by the Internet Bug Bounty, a program funded by several tech giants, including Microsoft Meta and Adobe. No node JS is used by about 6% of Internet sites. Apple has backported security updates to iOS 18. The updates patch exploits used in the Dark Sword hacking framework, which appeared online last month. Dark Sword has been used in the wild and mass exploitation is expected. Google has patched a Chrome zero day that was being used in the wild. The flaw was a memory corruption bug in Chrome's web graphics component, Dawn. It is the fourth Chrome Zero day to be patched this year. The FreeBSD project has patched a remote code execution attack in a kernel component. The vulnerability resides in Generic Security Services, an API that is used to set up encrypted communications. Oversized packets sent to the GSS service can allow attackers to run malicious commands. The Mongoose Web Server project has patched three major vulnerabilities this week, an authentication bypass and two remote code execution issues. The Mongoose server is typically used on embedded devices due to its lightweight and built in TLS support. Progress has patched authentication bypass and remote code execution vulnerabilities in its ShareFile servers. The bugs can be combined to upload web shells to unpatched servers. There are more than 30,000 sharefile instances available online to, but only version 5 is vulnerable to attacks. And that's all for this podcast edition. Today's show was brought to you by Knock Knock Knoc Knoc, a fabulous product that helps you really reduce your attack surface both externally and internally by allowing you to allow list network connections. It's really great stuff. You can find them at Knoc Knoc IO. And that's all from me for now. We do hope you enjoyed this bulletin. Until next time, I've been Patrick Gray Goodbye Sam.