← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
Claire Aird
A spyware app infected the Syrian army soldiers before the regime collapsed. NSO appeals its WhatsApp verdict Chrome and Qualcomm patch zero days and an emergency services information sharing group shuts down this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 4th of June and this podcast episode is brought to you by Asset Inventory and Network Visibility company Run zero. Members of the Syrian army were reportedly duped into installing spyware on their Android devices, according to New Lines magazine. The spyware was hidden in an app that offered financial aid for military personnel. The app, STFD686, appeared to be associated with the Syria Trust for Development, a humanitarian organisation overseen by Bashar al Assad's wife. It contained a version of the Spymax Remote Access Trojan, and this allowed attackers to track the movement of Syrian soldiers. The app rolled out in June last year, five months before the collapse of the Assad regime. In other news, Israeli spyware maker NSO Group has filed an appeal in its WhatsApp lawsuit. The company is seeking reduced damages for a new trial. It called the verdict unlawful and excessive. Last month, NSO was ordered to pay Meta $167 million in damages after an NSO exploit was used to hack 1,400 WhatsApp users in 2019. A US organisation that gave cyber security assistance to emergency services has shut down. The Emergency Management and Response Information Sharing and Analysis Centre ceased operations in late May. The group provided cyber security assistance to first responders, bomb squads, search and rescue teams and other emergency services. EMR ISAC is one of several ISAC groups that have shut down following federal funding cuts this year. Microsoft is testing a new way for Windows to recover if it fails to boot up. The Quick Machine recovery feature will allow the OS to check directly with Microsoft for a solution. Microsoft developed the feature after a bad CrowdStrike update sent more than 8 million Windows computers into a reboot loop last year. A hacker has wiped the service of Indian grocery delivery startup Korana Pro. The hacker deleted the company's customer data along with the source code for its mobile app. The Korana Pro app is still online but can't process payments. According to TechCrunch. The hack originated from a former employee's account. Some Marks and Spencer stores are holding walk in recruitment days after a ransomware attack crippled the UK retail chain in April. The HR systems are still offline, so individual stores have resorted to posting Facebook ads telling prospective employees to show up in person. Marks and Spencer expects the disruption to its systems to last at least another month. A hacker has stolen customer data from luxury fashion house Cartier. The company notified users about the breach this week. Stolen data includes names, emails and countries of residence. Cartier joins fashion brands Christian Dior, Tiffany & Co. Victoria's Secret and Adidas who all recently disclosed breaches. Morocco's land and property service has been hacked and its database stolen Algerian hacking group Jabiroot has released over 10,000 files on Telegram. It claims the files real estate transactions by Moroccan public figures. The same group hacked Morocco's Social Security database in April. At the time, Moroccan officials accused the group of releasing modified and misleading documents. A hacker has stolen $11.5 million worth of cryptocurrency from Taiwanese crypto exchange Bitapro. The hack occurred in early May and was confirmed by the company this week. The funds have already been laundered through Tornado Cash and Thorchain. Hackers have stolen $3.7 million worth of crypto assets from cross chain platform ForceBridge, according to Blockchain security firm Hashex. The attackers exploited weak access control mechanisms to bypass the bridge's protections. They then manipulated the bridge to steal its assets. Nigerian Authorities have arrested 22 suspects linked to a sextortion campaign. The individuals were detained following a joint investigation between Australian and Canadian police. The group has been linked to the suicide of a year old Australian in 2023. A Romanian man who swatted US government officials has pleaded guilty in a DC court. 26 year old Thomas Szabo was the moderator of the online chat room shenanigans which called in fake bomb threats and police swattings. In late 2023, Szabo was involved in a large scale campaign that targeted multiple U.S. government officials. Victims included members of Congress, state governors, federal officials and law enforcement. Sabo as well as a Serbian were identified and arrested last year after using Google Voice to place the swatting calls. A new threat actor is breaching DevOps infrastructure and deploying cryptocurrency miners. The attacks have targeted software packages such as Consul Docker, Gitea and Nomad. Cloud security firm Wiz says this is the first publicly documented case of Nomad servers being exploited in the wild. Socket Security has discovered two malicious Ruby libraries designed to intercept Telegram messenger traffic. The plugins are advertised as Telegram proxies built on the Fastlane App Automation service socket. Researchers believe the plugins were created to target developers in Vietnam, where authorities recently announced a nationwide block on Telegram. The Crocodylus Android malware now allows attackers to add contacts to victims, address books. Researchers speculate that the update is to make social engineering attacks seem more legitimate. The malware launched this year and is primarily distributed via malvertising campaigns. To date, it's been used to collect login credentials for mobile banking apps and extract crypto wallet seed phrases. Meta and Yandex have abused local host ports to track the online activity of mobile users. Websites using the MetaPixel and Yandex Metrica scripts connect to local ports on Android devices. Meta and Yandex apps running on the same device listened on those ports to receive browsing metadata, cookies and advertising IDs. Researchers say the technique bypasses privacy protections such as incognito mode, Android's permission controls and clearing cookies. Meta stopped using the technique after it was disclosed by researchers. Four major cybersecurity firms have announced an initiative to work together on apt group naming. Microsoft CrowdStrike, Google and Palo Alto Networks will publish documents detailing how each of their apt names overlap. The companies don't plan on developing a universal apt naming taxonomy. Chipmaker Qualcomm has patched three zero day vulnerabilities exploited in its Adreno GPU driver. The zero days were discovered by Google's security team in attacks against Android smartphones. The patches have been made available to smartphone manufacturers and updates will be delivered to users. Google has released a security update to patch an actively exploited Chrome zero day. The vulnerability is a memory corruption issue in the browser's V8 JavaScript engine. It's the third Chrome Zero day to be patched this year. And finally, Poland's cert has found vulnerabilities in apps pre installed on smartphones from local vendors. The vulnerabilities in Kruger and Mats and Ulefone devices allow local attackers to steal PIN codes and factory reset the phones. They can also allow attackers to inject and run malicious code with system level privileges. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Run Zero. Find them@runzero.com thanks for your company, Sam.