Loading summary
Transcript1 lines
- [00:04]
Claire Aird
The US Removes Tornado Cash sanctions, the White House shifts cyber responsibility to state and local governments, a Michigan football coach is indicted for hacking and Google sues a Maps scam syndicate. This is the Risky Bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 24th of March and this podcast episode is brought to you by Sublime Security, an email security platform that's not a black box. In today's top story, the U.S. treasury has removed sanctions against the Tornado Cash cryptocurrency mixer. Last year, a US Court ruled that the treasury overstepped its authority when it sanctioned the service in September 2022. Tornado Cash has been accused of laundering more than $7 billion worth of crypto assets since 2019. The criminal charges against Tornado Cash's founders have not been withdrawn. In other news, last Week's changed files GitHub Action Compromise was part of a supply chain attack targeting cryptocurrency exchange Coinbase. The ultimate target for the attack was a Coinbase open Source Project Agent kit. The aim was to leak access tokens for the Coinbase platform, according to security firms Wiz and Palo Alto Networks. The attack failed and Coinbase was unaffected. Wiz claims to have identified the attacker as French and English speaking, with working hours corresponding to the those in Europe or Africa. US President Donald Trump has signed an executive order shifting responsibility for managing critical infrastructure from federal agencies to state and local governments. Those responsibilities include defending and responding to cyber attacks, wildfires, hurricanes and other events. The executive order comes amid ongoing cuts to the US Federal government workforce. The French parliament has rejected an anti drug trafficking bill that would have mandated encryption backdoors in messaging services. France is one of several European countries that's considered similar laws with the others, including the Netherlands, Sweden and the UK Signal has said it would withdraw its service in France if the law passed. The U.S. department of justice indicted a former University of Michigan football coach on hacking related charges. Officials claim Matthew Weiss gained unauthorised access to student athlete databases and collected the personal information of more than 150,000 people. Weiss allegedly used that stolen data to access social media and email accounts of more than 3,000 students, where he downloaded intimate photos and videos. The offences allegedly took place between 2015 and January 2023. Authorities in two US states have detained more than a dozen Chinese nationals who were allegedly part of a Tap to Pay mobile phone fraud scheme. The suspects allegedly used relay attacks to conduct fraudulent contactless payment card transactions. The transactions were done by mules in America using cell phones, but the credit card Information was being relayed to the phones from China. The mules purchased gift cards and other products. This style of payment card relay fraud had previously only been seen in Southeast Asia. Google has filed a lawsuit against a criminal group that ran thousands of scams on Google Maps. The group created fake companies called Duress Verticals. These are companies offering the types of services people usually need in a hurry, like locksmiths or car towing services. When a prospective customer contacts the fake company, the operator scams them by demanding gift card or credit card details. Google discovered the syndicate last year and has removed more than 10,000 scam listings so far. Taiwanese white label laptop maker Klevo has leaked secure boot private keys in its firmware updates. Attackers can use the leaked keys to sign malicious firmware. Security firm Binaly found private keys in 15 firmware images corresponding to 10 laptop models, most of which are gigabyte branded. Router maker Kinetic left its mobile app database exposed without a password. Passwords configured in home network routers were leaked, including vpn, wi fi and local password hashes. Most of the affected routers are located in Russia. A hacker has stolen $8.85 million worth of crypto assets from the Zoth blockchain project. The attacker gained access to a privileged account and deployed a malicious contract that withdrew the platform's funds. The company is offering a $500,000 reward to anyone who can identify the hacker and recover the stolen assets. The Cloak ransomware gang has taken credit for breaching the Virginia attorney general's office last week. The agency has taken down its computer network and has instruct to use hard copy court filings while they deal with the attack. The Cloak gang has published the agency's data, which suggests officials decline to pay the ransom. Clearview AI has settled a class action lawsuit in the state of Illinois granting plaintiffs a 23% stake in its future IPO. This marks the first time a major privacy lawsuit has been settled for a stake in the company's future value rather than an agreed dollar amount. The settlement comes a month after Clearview's CEO resign. CISA says threat actors are exploiting a vulnerability in the Nakevo backup and replication software. The vulnerability allows attackers to retrieve a backup server's password or the backup files themselves. Nakevo silently patched the bug without responding to the researchers who found it and only acknowledged the issue a week after it was disclosed. NASMaker QNAP says it's temporarily removed the Nakevo backup system from its products until it receives a fixed version from the company. Steam has removed the demo of an upcoming game named Phantom's Resolution for installing malware on user devices. Valve has removed the game after reports on Reddit that the demo was installing an infostealer. This is the second malicious game removed from Steam this month, a rare occurrence for the usually clean platform. A Russian exploit reseller is offering up to $4 million for Telegram zero days and exploit chains. The exploits must run on Windows, Android or iOS. The company is suspected of supplying Russian state agencies and has previously declared it only sells exploits to non NATO countries. It regularly offers higher prices than rival vendors, mostly due to its association with Russian authorities. And finally, the EU says China and Russia were behind most of the disinformation and foreign interference campaigns targeting the EU and partner countries in 2024. The EU's External Action Team has uncovered over 38 online channels involved in the spread of disinformation across the eu. Twitter, Facebook and third party websites were the most used channels to spread disinformation and that is all for this podcast edition. Today's show was brought to you by our sponsor, Sublime Security. Buy them at Sublime Security thanks to your company.