Loading summary
Transcript1 lines
- [00:04]
A
Windows 10 reaches end of life CISA cyber personnel avoided last week's layoffs, the US seizes $15 billion from a cyberscam compound operator and a secure boot bypass impacts 200,000 framework computers. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Clare Aird. Today is the 15th of October and this podcast episode is brought to you by nebuloc. Windows 10 reached end of life on Tuesday, more than 10 years after its release. The operating system won't receive new security updates unless users enrol in the Extended Security Updates program. Users can also Upgrade to Windows 11 for free. Supporters also ended for Microsoft Exchange 2016 and 2019. In other news, last week's CISA layoffs did not impact the agency's cybersecurity personnel. Some some affected employees worked in CISA's stakeholder engagement division, a team that manages relations with local and international partners. The layoffs also impacted CISA's chemical security unit and the Integrated Operations Division, which runs CISA's around the Clock watch centre. The UK has rolled out a new system to distribute encryption keys. The crypt keys system will replace the Legacy approach, which distributed cryptographic key material via punch tape and CDs. The upgrade has cost the UK 2.6 billion pounds. Taiwan's intelligence agency has identified more than 10,000 social media accounts distributing disinformation. Most of the accounts were on Facebook and distributed a combined 1.5 million messages. Officials said that China is attacking Taiwan's independence and pushing pro Chinese Communist Party views. China has issued bounties for information on 18 Taiwanese military members. Police in China's Fujian province claim the individuals are part of what it describes as Taiwan's psychological warfare unit. China has accused the unit of gathering intelligence and spreading disinformation and propaganda. Rewards of $1,400 per person have been offered for information leading to arrests. The US government has seized $15 billion worth of crypto from one of the largest cyberscam compound operators, the Prince Group. The US has also sanctioned and charges against the group and its CEO, Chen Ji. The organisation operated multiple prison like scam compounds from casinos and luxury hotels in Cambodia. Individuals trafficked into the country were forced to carry out scams under the threat of violence. German and Bulgarian authorities have seized more than 1,400 financial scam websites. The sites lured users to invest in cryptocurrency, collected funds and then disappeared. Officials recorded more than 866,000 attempts to access the sites in the 10 days after they were seized. The Altamides phone tracking and surveillance platform has been used to track the movements of more than 14,000 phones. Leaked records revealed that the platform was used to track political figures, famous executives, journalists and activists. According to a Lighthouse report, it exploited vulnerabilities in the SS7 telecommunications protocol to locate individuals using their phone numbers. The platform has been around for two decades. It was founded by an Austrian and is operated by Indonesian company First wap. A team of academics spent three years surveying satellite communications and found that almost half were unencrypted. Researchers intercepted mobile carrier calls, texts and even military and government communications. One telco T Mobile has begun encrypting its satellite communications following the research team's report. More than 100 SonicWall SSL VPN devices have been hacked in the last week. Security firm Huntress says attackers used valid credentials to authenticate and take over the devices. On some devices, the attackers moved laterally across the victims networks and escalated their access. Huntress believes the attacks are related to a recent breach which where hackers stole device configuration backups from Sonicwall's cloud service Threat actors are exploiting a vulnerability in ICT broadcast call center software. The vulnerability allows remote attackers to inject and run commands. Exploitation doesn't require authentication and only involves modifying the cookie field in an HTTP header. According to Volncheck, there are almost 200 ICT broadcast servers currently exposed on the Internet. More than 200,000 framework computers are vulnerable to a secure boot bypass. The devices shipped with a signed UEFI shell environment that can be abused to bypass the secure boot process and load malicious code. Framework released security updates after the company was notified by researchers from Eclipsium. A team of academics has developed a new attack that breaks the confidentiality of AMD secure enclaves. The RMPOCALYPSE attack targets the reverse map table Secur security feature of the AMD SEV SNP enclave. The attack exploits a short window of time during the boot where the attacker can overwrite the RMP with malicious code. It affects AMD Zen 3, 4 and 5 CPUs. A team of academics has developed a new attack that can recover sensitive information from Android smartphones named Pic Snapping. The. The attack uses a malicious app installed on target devices. It opens other apps and steals the contents of the screen via a side channel in the graphics rendering process. The attack was successfully used to recover signal chats and two FA codes from Google Authenticator. 75% of sites carrying out click fix attacks were already hosting attacker in the middle phishing pages. The overlap suggests that existing threat actors are incorporating the click fix technique in into their operations. Lab539 says it's now tracking more than 13,000 domains carrying click fix lures. 5ca has denied being the source of a recent Discord security breach. The company, which provides customer support services, says it never handled ID records for Discord users despite news reports identifying it as the source. It also said the breach occurred outside of its systems and and may have involved human error. South Korean law enforcement has been asked to investigate Korea Telecom over obstructing an official probe. The government says the telco failed to cooperate with its investigation into the company's micropayments platform. KT customers reported losing almost $170,000 to suspicious transactions that were later linked to a data breach. KT is the country's second largest telco. Australian rubber glove maker Ansell has disclosed a security breach. The company linked the hack to vulnerabilities in a third party software. It said most of the data is not sensitive. 4chan has been fined £20,000 for non compliance with the UK Online Safety Act. The law required 4chan to verify the age of its users before showing adult content. The fine issued by the UK communications watchdog will increase by £100 per per day until it's paid. And finally, a bad firmware update has bricked a hybrid model of Jeep. The update was shipped for the telematics module in the 4Xe variant of the vehicles. Users who installed it reported losing power to their electric engines mid drive. Jeep pulled the update once reports of problems started coming in. And that is all for this podcast edition. Today's show was brought to you by our sponsor Nebuloc. Find them@nebuloc IO thanks to your company.