Loading summary
Transcript1 lines
- [00:04]
A
A second iOS hacking framework has been found in the wild Belgium launches its own government communications app AWS kills S3 bucket squatting and a cyber attack cripples car Breathalysers this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 20th of March and this podcast episode is brought to you by Sublime Security. In today's top story, a second professional iOS hacking framework has been seen in the wild. The Dark Sword toolkit was used against targets in Ukraine, Turkey, Malaysia and Saudi Arabia. It's been used in both espionage and financially motivated operations. According to Google, Iverify and Lookout, the kit used at least six iOS exploits. All have been patched. In other news, the Belgian government has launched its own secure messaging app. The Beam app has been developed for internal, government and military use. It's designed to replace foreign apps like WhatsApp and Facebook messenger for official communications. Military and intelligence officials gained access to Beam last week. Government workers will receive it next week. Japanese defence forces will be ready to carry out offensive cyber operations from October. A law was passed last year that allows the country's military and police to pre emptively hack adversary networks. Cabinet approved the law after confirming its alignment with the country's constitutional principles. Principles of non aggression the US House Judiciary Committee has subpoenaed 10 US tech companies for copies of their communications with the EU. They've been ordered to hand over communications related to enforcement of the EU's Digital Services Act. The commission has accused Europe of trying to censor Americans through its tech rules. Subpoenaed companies include Amazon, Apple and Microsoft. FBI Director Kash Patel has admitted the agency has resumed purchasing data about American citizens from private brokers. Politico has reported the data is used to track people's movement and location history. Law enforcement is not allowed to obtain the data from tech companies without a warrant. US Law does not, however, prevent them from buying it from data brokers. A hacker has leaked data from a law enforcement confidential TIP database. The leaker, who goes by the name Internet Yif Machine, said they exploited a vulnerability to breach P3 Global intel and a platform managed by Navigate360. The hackers shared more than 93 gigabytes with journalists and the DDoS Secrets project. The leak implies Navigate360 stored enough details to de anonymise people who submitted tips. A cyber attack has crippled vehicles equipped with Intoxalock breathalysers. Devices installed in cars in the US have been unable to connect back to Intoxalock service to confirm Breath test results. In some cases, US Courts have ordered people convicted of drunk driving to use the devices. They've been unable to start their cars for two days. Suspected North Korean hackers have breached an online platform that allows users to buy gift cards and sim top ups with cryptocurrency. Bitrefill said hackers stole crypto assets and customer records. They also attempted to alter its gift card inventory. The entry point has been traced back to a compromised employee laptop. The company said the attack resembled previous intrusions by the Lazarus and Blue Noroff groups. Hackers using a Chinese cybersecurity firm as a front have stolen millions in cryptocurrency. They used supply chain attacks to compromise Electron apps and browser plug ins. From there, they collected private keys and seed phrases to empty out crypto wallets. The attacks were exposed after the secret operations of the company, Wuhan and Shun, were revealed by a disgruntled employee. One of the company's victims was Trust Wallet, whose users lost $7 million in December. Hackers have stolen $3.6 million worth of crypto from Venus Protocol. The attackers exploited the platform's Flash loan system to extract the funds. Venus protocol also lost $27 million in a separate hack last September. US authorities have seized two websites operated by Iranian hacking group Handala. The group had used the websites to leak data and offer bounties on Israeli and US officials earlier this month. The group breached US MedTech company Stryker and wiped more than 200,000 systems in retaliation for the US attacks. The Interlock ransomware group exploited a Cisco Zero Day for close to a month before patches were available. Attacks began on January 26, and the patch was released on March 4. The vulnerability allowed threat actors to run malicious code on Cisco firewalls that were running the Secure Firewall Management Console. Software exploitation is triggered by its serialized Java Objects, doesn't require authentication, and runs the malicious code as root. Apple has rolled out its first background security update for iOS. The update, released this week, fixes a low severity bug in Safari. It was delivered through Apple's Background Security Improvement System, which allows the company to apply patches without any user interaction. This system was first used in 2019 to push a silent fix for macOS. A new AWS security feature prevents S3 bucket squatting attacks. The feature ties AWS bucket names to account IDs and regions. This prevents threat actors from registering expired buckets. Both Azure and Google Cloud also have protections against this type of attack, but using different approaches. A major vulnerability remains unpatched in the GNU inet UTILS Telnet daemon. The bug allows remote unauthenticated attackers to overflow memory on a Telnet server and run malicious code. This is the second major bug disclosed in the Telnet server this year. Threat actors are exploiting an RCE vulnerability to take over Microsoft SharePoint servers. The bug was initially patched in January, but was added to the CISAKEV list this week. CISA also added a Zimbra Cross site scripting vulnerability. And finally, Ubiquiti has patched a critical vulnerability in its UNIFI Internet Gateway and WI Fi Management application. The firmware update fixes a path traversal bug that allows threat actors to access configuration files and take over UNIFI gateways. The vulnerability has a severity rating of 10 out of 10, and that is all for this podcast edition. Today's show is brought to you by our sponsor, Sublime Security. Find them at Sublime Security. Thanks to your company.