← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
An ICE tracking app blames a recent hack on a government agent Microsoft will disable NTLM in the next release of Windows Poland bans Chinese cars from military bases and Avanti patches 2 new 0 days this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 2nd of February and and this podcast episode is brought to you by Dropzone AI. In today's top story, a recent breach of the Stop Ice app has been tracked to a U.S. customs and Border Protection agent, according to the app's administrator. Last week, the app's users received SMS alerts claiming their personal data had been compromised and shared with law enforcement. StopICE has denied having such data in the first place. In other news, Microsoft will disable NTLM by default in the next version of Windows. The company deprecated the protocol last week and has stopped updating it. Microsoft will also improve Kerberos this year to allow it to work in network topologies where previously NTLM was required. The Polish government has banned Chinese made cars from entering its military bases. Warsaw cited national security concerns Chinese officials have allegedly called on Poland to stop abusing the concept of national security. China itself banned Tesla cars from its military bases for five years ago. The French government wants the country to have the largest pool of cyber talent in Europe. According to the updated National Cybersecurity Strategy, France will prioritise training and investment in the sector to compete with the us. The move is part of a larger goal of increasing European digital sovereignty. The Nobel Committee believes hackers obtained the name of the Nobel Peace Prize winner Maria Corinna Machado ahead of time. One of Norway's intelligence services is investigating a possible breach. Hours before the prize announcement, significant cryptocurrency wages were placed on Machado's win. The possibility of an internal leak has not been excluded. The US government has launched an investigation into WhatsApp. Former contractors have filed whistleblower complaints against the company, claiming that some Meta staff have unfettered access to WhatsApp messages. The investigation is being led by the US Commerce Department. Polish officials have attributed the data wiping attack on its national power grid to a Russian hacking group known as Dragonfly. It's a group widely considered to be associated with Russia's FSB intelligence service. Initially, ESET reports linked the attack to Sandworm, a cyber unit inside Russia's military threat. Intel researcher Joe Slowik believes multiple Russian groups may have collaborated on the attack. A report published by Poland's Certified found that the affected energy providers failed to adequately secure their networks, which aided the attack. The developers of a popular AI chatbot left their backend database exposed on the Internet. The Chat and Ask AI app has leaked more than 300 million messages due to a misconfiguration of its Google Firebase backend. The app claims to have more than 50 million users. South Korean police are investigating a breach of Seoul's public bike sharing service. Hackers are believed to have stolen the personal data of 4.5 million to Tehrangi users in April 2024. Officials say a DDoS attack at the time might have distracted IT staff during the breach. Comcast has agreed to pay $117.5 million to settle a lawsuit over its 2023 security breach. Hackers stole the personal details of more than 31 million customers after exploiting the Citrix Bleed vulnerability. Customers who can prove out of pocket losses related to the breach may receive up to 10,000 do. Those who can't can receive up to $50. Hackers have stolen more than $17 million worth of assets from cryptocurrency platforms Aperture Finance and Swapnet. The attackers allegedly exploited similar vulnerabilities in their smart contracts. They stole $3.6 million from Aperture and $13.4 million from Swapnet. Cambodian authorities have raided the A7 Cyberscam compound in the city of Bavet. More than 100 suspects were detained a Cambodia's newest scam compounds and was housing around 2,000 workers. Convicted sex offender Jeffrey Epstein had allegedly hired a personal hacker, according to a new batch of the Epstein files released last week. The hacker was an Italian national born in Calabria. He allegedly developed and sold zero day exploits to foreign governments, including the Hezbollah paramilitary group. Italian Authorities have arrested 31 suspects that ran four illegal IPTV services. The operated via websites and telegram channels that sold access to pirated TV streams. The sites had millions of registered users. The suspects were tracked by the alliance for Creativity and Entertainment, an anti piracy coalition that formed in 2017. A jury has convicted a former Google engineer of stealing AI trade secrets. Lin Wei ding was arrested two years ago after he was caught transferring more than 500 confidential Google files to his personal account. The files contain data on chip architecture, software designs and performance metrics. He allegedly planned to share the information with two Chinese startups where he'd been promised executive positions. Cloudflare has mitigated a new record DDoS attack of 31.4 terabits per second. The attacks originated from a DDoS for hire botnet known as Isuru or Kimwoof. The botnet has infected up to 4 million devices globally and is regularly used to attack gaming and web hosting. Dallas county in Iowa was ordered to pay $600,000 to two pen testers that were unjustly arrested. In 2019, Gary DiMicurio and Justin Wynn were arrested after they broke into the Dallas county courthouse. They were charged despite being hired by the state to assess the courthouse's security. The charges were later dropped. Avanti has released security updates to Patch two actively exploited zero Days. Both vulnerabilities allow unauthenticated code. Avanti says it's aware of attacks against a limited number of customers. According to Greynoys, reconnaissance for this campaign appeared to originate from networks in Romania and Moldova. The Tales operating system has released an emergency security update. The patch incorporates fixes from the OpenSSL project. One of the bugs allowed remote code execution attacks against systems running the library. And finally, a major vulnerability has been found in Comfyui, an app for managing Genai models. The bug was discovered by Tencent's security team. It's an unauthenticated file upload vulnerability that can lead to remote code execution. It impacts the Official Extension Manager, the component used for the installation and maintenance of custom nodes, models and dependencies. ComfyUI zero days have previously been used to deploy the PIK AI backdoor, and that is all for this podcast edition. Today's show is brought to you by our sponsor, DropZone AI. Find them at DropZone AI thanks to your company.