Podcast Summary: "Denmark is Done with Teams!" - Talkin' About [Infosec] News, Powered by Black Hills Information Security

Release Date: June 18, 2025

In this episode of Black Hills Information Security's weekly infosec podcast, the hosts delve into significant developments in the cybersecurity landscape, focusing on governmental shifts away from established tech giants, emerging AI vulnerabilities, and innovative attack vectors. The discussion is rich with insights, critiques, and forward-looking perspectives on the state of information security.

1. European Governments Transitioning from Microsoft to Open Source

Overview:
The episode kicks off with a discussion about European municipalities, specifically in Germany and Denmark, making substantial moves away from Microsoft products. These governments are transitioning to Linux operating systems and LibreOffice, signaling a broader trend towards open-source solutions.

Key Points:

• Germany and Denmark's Shift:
  Both nations have reportedly moved away from Microsoft Teams and Office, adopting Linux and LibreOffice as their primary tools. This transition aims to reduce dependency on costly licensing fees and enhance data sovereignty.

• Challenges Faced:
  The hosts express skepticism about the practicality of this shift, highlighting compatibility issues and the learning curve associated with retraining staff. There's also concern about the effectiveness of alternative open-source communication tools in handling large-scale operations.

Notable Quotes:

• John at [05:22]: "Denmark is done with Teams! The German state has already switched both of them away and have been using LibreOffice for like a year."
• John at [10:14]: "Security monocultures... Everything's by the same vendor. Therefore if one vulnerability pops up we're completely insecure."

2. Critique of the Linux and Open Source Community

Overview:
The hosts delve into frustrations with the open-source community's approach, particularly regarding LibreOffice and Linux. They argue that efforts to create new open standards hinder practical compatibility with widely used Microsoft products.

Key Points:

• LibreOffice's Compatibility Issues:
  There's criticism over LibreOffice's inability to seamlessly integrate with Microsoft Office formats, which poses significant challenges for governmental operations reliant on extensive document handling.

• Linux Adoption Hurdles:
  Transitioning to Linux introduces complexities in security management, patching, and configuration across diverse distributions, making it a daunting task for large organizations.

Notable Quotes:

• John at [03:53]: "Rather than making their stuff completely seamlessly compatible with PowerPoint, Excel, and Word, they develop a new standard. It's like, screw you, stop."
• Ryan at [10:14]: "If you had Copilot... this is a great example. Everyone's slapping AI into Atlassian, Teams, every tool."

3. AI Security Vulnerabilities: The Echo Leak

Overview:
A significant portion of the discussion centers around AI security, specifically a vulnerability dubbed "Echo Leak" affecting Microsoft Copilot. This zero-click vulnerability resembles a stored XSS attack but tailored for AI interactions.

Key Points:

• Nature of Echo Leak:
  The vulnerability allows threat actors to embed malicious prompts within documents, which, when processed by Copilot, can exfiltrate sensitive data without user interaction.

• Microsoft's Response:
  Microsoft participated in a challenge to identify and mitigate such vulnerabilities, showcasing the complexity of securing AI-integrated tools.

Notable Quotes:

• Tim at [19:00]: "The threat actor sends a seemingly innocuous looking document. But inside of that document is a prompt that... exfiltrate data."
• Ryan at [20:23]: "If your Copilot was reading your business documents... you are vulnerable to this."

4. Ransomware Exploiting Employee Monitoring Tools

Overview:
The podcast highlights a novel ransomware tactic where attackers misuse legitimate employee monitoring software, such as Sciteca, as a keylogger to infiltrate systems.

Key Points:

• Sciteca Misuse:
  Attackers leverage compromised accounts to deploy Sciteca undetected, avoiding traditional malware detection mechanisms.

• Comparison to Traditional Methods:
  This approach underscores the evolving tactics of cybercriminals, who increasingly exploit legitimate software tools for malicious purposes.

Notable Quotes:

• Ryan at [26:44]: "They're using Sciteca, which is a legitimate tool designed for employee monitoring... I'm assuming through compromised attacks or compromised accounts."
• Ryan at [30:16]: "Block these tools in your environment if you use them. Definitely monitor their use."

5. Discord-Based Attacks and Vanity Link Takeovers

Overview:
The hosts discuss the rise of malicious activities on platforms like Discord, including the takeover of expired vanity links to distribute malware.

Key Points:

• Vanity Link Exploitation:
  Cybercriminals register expired Discord vanity links, redirecting users to phishing sites that deploy malware via PowerShell commands.

• Security Implications:
  This method highlights the need for organizations to monitor and secure their online identities actively, preventing attackers from leveraging recognizable links for malicious ends.

Notable Quotes:

• Ryan at [30:16]: "If you're a city with 30,000 employees, you better have Symantec at the very... You're not going to get Crowdstrike. That's too expensive."
• John at [32:50]: "I wonder why is this allowed for people's work? It's just strange."

6. Innovative Covert Channels: Smartwatch-Based Communication

Overview:
A segment is dedicated to exploring research on using smartwatches as covert communication channels for transferring data across air-gapped networks.

Key Points:

• Attack Feasibility:
  While theoretically possible, practical implementation poses significant challenges due to low data transmission rates and the necessity of physical proximity.

• Defense Measures:
  Recommendations include prohibiting the use of such devices in sensitive environments and employing frequency scramblers to disrupt unauthorized communication attempts.

Notable Quotes:

• John at [34:06]: "Researchers suggest prohibiting using smartwatches to eliminate the attack surface for covert channels."
• Ryan at [38:35]: "The best way to counter this is to have files bigger than 50 bits air gapped machines."

7. Cloud Service Resilience: Google Cloud Outage

Overview:
The podcast reviews a recent significant outage in Google Cloud services, analyzing the incident's timeline and Google's rapid response.

Key Points:

• Outage Breakdown:
  The Google Cloud outage affected services like Cloudflare, lasting approximately two hours and forty minutes, with the root cause identified within ten minutes.

• Response Efficiency:
  Despite the widespread impact, Google's swift identification and resolution demonstrate robust infrastructure resilience and incident management protocols.

Notable Quotes:

• Corey at [46:09]: "They identified the problem within 10 minutes and resolved it in about two and a half hours. That's just like a lunch break."
• John at [46:31]: "Google has some crazy SLAs. If they're down for two hours, that's a significant amount of money."

8. Additional Cybersecurity News

Overview:
Towards the episode's end, the hosts touch upon several other noteworthy cybersecurity incidents and reports.

Key Points:

• UNFI Cyberattack:
  A ransomware attack on UNFI disrupted the food supply chain, leading to shortages in grocery stores, specifically affecting chicken supplies.

• GitHub Device Code Phishing:
  Exploring vulnerabilities in federated GitHub logins, enabling device code phishing attacks targeting journalists.

• Citizen Labs Report on Spyware:
  A new report reveals that a US-backed Israeli company, potentially Paragon, targets journalists with advanced spyware, echoing previous concerns associated with NSO Group's Pegasus.

• Salesforce Omni Studio Vulnerabilities:
  Identification of multiple misconfigurations and vulnerabilities in Salesforce's Omni Studio, raising questions about the security of newly acquired products.

Notable Quotes:

• Ryan at [50:14]: "GitHub device code phishing is interesting... federates GitHub login with Microsoft or OAuth providers... device code phishing."
• Ryan at [53:31]: "Paragon was acquired by AE Industrial Partners, a private investment firm based in Florida... targeting prominent journalists."

9. Wrap-Up and Final Thoughts

Overview:
The episode concludes with a lighthearted banter among the hosts, reflecting on the discussed topics and looking forward to future developments in the cybersecurity realm.

Notable Quotes:

• John at [55:20]: "The S in AI stands for security. That's a good one."
• Ryan at [55:43]: "There's no I in team, too. That's why I'm switching to Linux, because it has another."

Conclusion:
This episode offers a comprehensive look into the shifting dynamics of cybersecurity, emphasizing the tension between proprietary systems and open-source alternatives, the evolving nature of AI-related vulnerabilities, and the inventive strategies employed by threat actors. Through insightful discussions and expert critiques, the hosts provide listeners with a nuanced understanding of the current infosec landscape and the challenges that lie ahead.