Oktacron - Cyber Security RSS Feeds History

Big Tech Retreats: Microsoft Exits OpenAI Board Amid Regulatory Pressure

cyberexpress Jul 10, 2024 Partnerships

In a move likely fueled by intensifying antitrust scrutiny, Microsoft is exiting OpenAI and stepping down from its non-voting observer seat of the AI company's board of directors. This comes just days after reports suggested Apple might take a similar observer role, but now the Cupertino giant has also opted out. show more ...

Microsoft's exit, communicated via a letter on Tuesday, cited "significant progress" made by OpenAI's newly formed board, according to Axios. This explanation rings somewhat hollow, considering Microsoft's role was established just last November following a period of upheaval at OpenAI that saw the ousting and reinstatement of CEO Sam Altman. OpenAI announced a new safety and security committee in May end as it began training a new AI model intended to replace the GPT-4 chatbot. A month later, OpenAI pushed out the rollout of its highly anticipated “Voice Mode” feature for ChatGPT to July, citing safety concerns. The company said it needed more time to ensure the model could “detect and refuse certain content.” Microsoft Exits OpenAI, Caving to Regulatory Pressure? The timing of these decisions coincides neatly with growing regulatory pressure on Big Tech's influence in the burgeoning field of artificial intelligence. Both the U.S. Federal Trade Commission (FTC) and the European Commission (EC) have expressed concerns that tech giants' investments in AI startups like OpenAI could stifle competition and create monopolies in key technological areas. In June, the FTC launched an investigation into Big Tech investments in generative AI startups, including Microsoft, Amazon, and Google. The EC, meanwhile, explored the possibility of an antitrust probe into the Microsoft-OpenAI partnership after deciding against a merger control investigation. AI Model Access Scrutinized While both Microsoft and OpenAI maintain the company's independence despite the multi-billion dollar investment, the optics surrounding the close relationship are not lost on regulators. Microsoft's access to cutting-edge AI models through this partnership gives them a significant advantage, potentially hindering the growth of smaller competitors. OpenAI seems to be taking a new approach to partner engagement. Moving forward, they plan to host regular meetings with key partners like Microsoft and Apple, alongside investors, to foster communication and collaboration. This strategy aims to maintain strong relationships without raising red flags for regulators. The future trajectory of Big Tech's involvement in AI development remains to be seen. The recent retreat from board positions suggests a potential shift as companies navigate the increasingly complex regulatory landscape as they strive to maintain a competitive edge in the race for AI dominance.

Speculation Surrounds Arabian Travel Agency Hack: Threat Actor Claims Air India Data Breach

cyberexpress Jul 10, 2024 Cybersecurity News

A threat actor known as "ghostr" on the XSS forum has claimed responsibility for a significant data breach targeting the Arabian Travel Agency, a prominent travel company based in the UAE. The Arabian Travel Agency data breach, which allegedly occurred in June 2024, compromised a substantial amount of show more ...

sensitive information, including corporate, accounting, and sales data, as well as personal information of over 228,303 Air India customers and 1,081,733 visa applicants. Additionally, the attacker claims to have obtained various personal documents and images of the company's employees. Details of Arabian Travel Agency Data Breach According to ghostr post, the compromised data includes a wide range of sensitive information: Corporate, Accounting, and Sales Information: Confidential business data from the Arabian Travel Agency, which serves as the official general sales agent for Air India in the UAE. Customer Personal Information: Data from 228,303 Air India customers, potentially including names, contact details, travel itineraries, and more. Visa Applicant Records: Information from 1,081,733 visa applicants, likely encompassing personal details submitted during the visa application process. Employee Documents and Images: Copies of employee documents such as certificates, driving licenses, Emirates ID cards, labor cards, Ministry of Labour (MOL) contracts, passports, and residence visas. To substantiate these claims, ghostr has reportedly provided sample records from the alleged database. The Cyber Express Team has made attempts to verify the claims by reaching out to both Arabian Travel Agency and Air India. However, as of this writing, no official response has been received from either organization, leaving the claims unverified. Potential Implications of Data Breach at Arabian Travel Agency If ghostr's claims are proven true, the consequences for both the Arabian Travel Agency and Air India could be severe. The alleged exposure of such extensive and sensitive information would not only compromise the privacy of millions of individuals but also pose significant risks to the affected organizations. The potential implications include: Privacy Violations: The personal information of customers and visa applicants, including potentially sensitive details, being exposed could lead to privacy violations and identity theft. Corporate Espionage: The breach of corporate, accounting, and sales information might expose the Arabian Travel Agency to corporate espionage, impacting its competitive standing and operational security. Regulatory Scrutiny and Legal Consequences: Both organizations could face intense regulatory scrutiny and potential legal actions due to the breach. Compliance with data protection regulations, such as the UAE's Personal Data Protection Law (PDPL), would be called into question. Reputational Damage: The loss of trust among customers and business partners could have long-term repercussions on the reputation and financial health of the affected companies. Operational Disruptions: Addressing the breach and mitigating its impact could lead to significant operational disruptions and financial costs for both the Arabian Travel Agency and Air India. As the situation continues to unfold, the Cyber Express Team remains committed to providing updates on this developing story. The team will diligently seek further information and official comments from the targeted companies. Until then, the claims by ghostr remain unverified. In 2021, Air India reportedly faced a cyberattack that affected over 4.5 million customers. In May of that year, it was revealed that the personal details of millions of customers worldwide had been compromised. This included sensitive information such as passports, credit card details, birth dates, names, and ticket information. The breach was initially reported to Air India in February 2021 by their data processor, SITA, a Swiss technology company known for providing passenger processing and reservation system services. The breach involved data registered in SITA's systems between August 26, 2011, and February 20, 2021. It was discovered that the cyberattackers had access to the systems for a period of 22 days. Conclusion The alleged data breach at the Arabian Travel Agency, purportedly orchestrated by ghostr, highlights the ever-present threats posed by cybercriminals. The potential exposure of vast amounts of sensitive information highlights the critical importance of strong cybersecurity measures. The Cyber Express Team will continue to monitor the situation closely, providing timely updates as new information becomes available. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

New OpenSSH Flaw (CVE-2024-6409) Hits Red Hat Enterprise Linux 9

cyberexpress Jul 10, 2024 Firewall Daily

A new security vulnerability has been discovered within select versions of the OpenSSH secure networking suite, potentially exposing systems to remote code execution (RCE) risks. Tracked under CVE-2024-6409 with a CVSS score of 7.0, this OpenSSH vulnerability affects versions 8.7p1 and 8.8p1 of OpenSSH, specifically show more ...

those shipped with Red Hat Enterprise Linux 9. Security researcher Alexander Peslyak, widely known as Solar Designer, discovered the vulnerability during a comprehensive review following the disclosure of CVE-2024-6387, also known as RegreSSHion. This new OpenSSH vulnerability centers around a race condition in signal handling within the privsep child process of OpenSSH. Solar Designer detailed this finding in his communication to the security community: "OpenSSH versions 8.7 and 8.8 call cleanup_exit() from grace_alarm_handler() when operating in the privsep child process. cleanup_exit() was not originally intended to be invoked from a signal handler and may trigger other async-signal-unsafe functions." OpenSSH Vulnerability Targets Red Hat Enterprise Linux 9 Solar Designer highlighted that while the upstream versions of OpenSSH 8.7p1 did not initially trigger async-signal-unsafe functions, downstream patches in distributions like Red Hat's openssh-7.6p1-audit.patch altered this behavior. Specifically, this patch, present in Red Hat Enterprise Linux 9, introduces modifications to cleanup_exit() that exacerbate the vulnerability. In practical terms, this vulnerability manifests due to the signal handler's race condition, potentially leading to remote code execution scenarios. Notably, the risk differs from CVE-2024-6387 in that the exploit occurs within the lower-privileged privsep child process, offering a reduced immediate impact compared to its predecessor. Despite the lowered immediate impact, the exploitability and implications of CVE-2024-6409 remain significant, especially in environments where stringent security measures are not uniformly applied. Solar Designer, in his discussions with Qualys and the security community, pointed out the nuanced differences in mitigation strategies between CVE-2024-6409 and CVE-2024-6387: While both vulnerabilities can be mitigated with the 'LoginGraceTime 0' setting, the '-e' mitigation is effective against CVE-2024-6387 but not entirely against CVE-2024-6409. This distinction underscores the need for specific and targeted security measures to address each vulnerability adequately." Qualys Confirms Solar Designer's OpenSSH Vulnerability Qualys, a prominent security advisory firm, corroborated Solar Designer's findings and added insights into the technical aspects of the vulnerability. They noted: "The vulnerability in OpenSSH's signal handling mechanism, particularly within the privsep child process, represents a critical exposure. The race condition introduces potential avenues for remote code execution, albeit within the constraints of the lower-privileged child process." Qualys also highlighted additional challenges posed by downstream patches, such as those seen in Red Hat's distributions, which inadvertently exacerbated the vulnerability's severity. Specifically, modifications to cleanup_exit() in openssh-7.6p1-audit.patch was intended to enhance audit logging but inadvertently increased the vulnerability's scope. Solar Designer expressed regret for the delayed disclosure of CVE-2024-6409 relative to CVE-2024-6387, citing coordination challenges with Red Hat's internal release schedules: "I apologize for the separate disclosure of CVE-2024-6409, which could have streamlined efforts within the security community. Red Hat had already integrated fixes for CVE-2024-6387 into their pipeline, delaying simultaneous mitigation efforts for CVE-2024-6409." The impact of CVE-2024-6409 extends beyond immediate security patches, as it necessitates a thorough analysis of downstream patches across various Linux distributions. Solar Designer emphasized the importance of comprehensive security audits across distributions to ensure uniform mitigation strategies: "Effective mitigation strategies must account for downstream modifications like those in Red Hat's openssh-7.6p1-audit.patch. These alterations, while intended to bolster security measures, inadvertently expanded the vulnerability's attack surface." In response to these findings, Qualys noted potential collateral issues stemming from the audit patch's implementation, specifically regarding erroneous logging of SSH host key fingerprints: "The audit patch in Red Hat's OpenSSH package inadvertently led to multiple instances of logging SSH host key fingerprints, raising concerns about the integrity of audit logs in affected systems." Despite these challenges, the collaborative efforts between researchers like Solar Designer and firms like Qualys highlight ongoing efforts to strengthen OpenSSH's security infrastructure. Moving forward, Solar Designer and Qualys encourage users and administrators to remain vigilant and apply patches promptly to mitigate the risks posed by CVE-2024-6409.

Nokia Faces Data Breach Allegations: 7,622 Employee Records Reportedly Compromised

cyberexpress Jul 10, 2024 Firewall Daily

Nokia Corporation, a prominent Finnish telecommunications and technology company, reportedly fell victim to a data breach. According to reports on BreachForums, a threat actor identified as 888 disclosed that over 7,622 records containing personally identifiable information (PII) of Nokia employees were compromised. show more ...

This Nokia data breach, allegedly stemming from a third-party incident, exposed sensitive details such as employees' first and last names, job titles, company names, email addresses, phone numbers, and other pertinent information. Addressing the Nokia Data Breach Claims The leaked data, posted by the threat actor with the handle "888," included a sample entry detailing specific employee information. Despite claims linking the breach to LocService (locservice.fr), the exact source of the compromised data remains unconfirmed due to the absence of definitive proof. [caption id="attachment_81104" align="alignnone" width="1915"] Source: Dark Web[/caption] Nokia Corporation, known for its extensive presence in the telecommunications and technology sectors with operations spanning across Europe and the UK, has yet to issue an official statement regarding the incident. This cyberattack on Nokia potentially impacts not only the company's internal operations but also raises concerns about the security of personal information belonging to its employees. The threat actor claimed this Nokia data breach on July 8, 2024, stating “Today I have uploaded Nokia Data for you to download, thanks for reading and enjoy! In July 2024, Nokia suffered a data breach from a third party that exposed 7,622 rows of employees' details”. Talking about the compromised information in this breach, 888, said the data in this breach includes “First Name, Last Name, Job Title, Company Name, Email, Email Verification Status, Direct Phone Number, Corporate Phone Number, Employees, Industry, Person State, Person Country and Created Time”. The Cyber Express has reached out to Nokia Corporation for further details regarding the incident and any involvement of the threat actor in the alleged breach. However, at the time of writing this, no official statement or response has been received. This leaves the claims and implications of the Nokia data breach unresolved and under investigation. Moreover, the website for Nokia seems to be unaffected by this breach and doesn’t display any immediate sign of the intrusion. The threat actor could have targeted the backend of the website or its databases instead of launching a front-end cyberattack like a DDoS or website defacement. A Previous Data Breach Related to Nokia In 2021, SAC Wireless, a Nokia subsidiary based in the US, suffered a data breach due to a ransomware attack by Conti operators. The attack compromised SAC Wireless' network, leading to data theft and system encryption. The breach was detected on June 16 when Conti ransomware encrypted SAC Wireless' systems. A subsequent forensic investigation, conducted with external cybersecurity experts, confirmed on August 13, 2021, that the personal information of current and former employees, and their dependents or beneficiaries under health plans, was compromised. Affected data included names, dates of birth, contact details (addresses, emails, phone numbers), government IDs (driver’s licenses, passports), social security numbers, work information (titles, salaries), medical histories, health insurance details, license plate numbers, digital signatures, marriage or birth certificates, tax information, and dependent/beneficiary names. To prevent future breaches, SAC Wireless immediately implemented measures such as changing firewall rules, disconnecting VPNs, implementing geo-location restrictions, enhancing employee training, deploying additional monitoring tools, expanding multi-factor authentication, and improving threat detection and response capabilities. As for the current Nokia data breach claims, this is an ongoing story and The Cyber Express will be closely monitoring the situation and we’ll update this post once we have more information on the alleged breach or any official confirmation from Nokia. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Fresh Neiman Marcus Data Breach Claims: Threat Actor Targets Celebrities, Demands $1M Ransom

cyberexpress Jul 10, 2024 Cybersecurity News

A threat actor has claimed responsibility for orchestrating a cyberattack on Neiman Marcus, the luxury retailer in the U.S. The Neiman Marcus data breach claims come just days after the group issued a notification to its customers regarding a massive leak that occurred in May 2024, potentially exposing sensitive show more ...

personal information. In its notification filed with the Attorney General of Maine on June 24, the company claimed that the breach affected an estimated 64,472 victims. However, the threat actor, operating under the pseudonym “Sp1d3rHunters,” claimed that the group was downplaying the breach and alleged that they had illegal access to a database of 40 million customers, which included high-profile celebrities. Fresh Claims of Neiman Marcus Data Breach In a July 10 post on the darkweb markerplace BreachForums, the threat actor wrote, “Neiman Marcus had chance to stop sale of data from 40 million customers, but they said only 60,000 people are affected. We give Neiman last chance to buy back data and show how important it is, but now price is higher.” The anonymous hacking group then shared an alleged sample of the 40 million customers, which included names, email addresses, phone numbers, credit card details and addresses of high-profile individuals like Melania Trump, Ivanka Trump, Tiffany Trump, Jill Biden, Halie Biden, Sara Biden, Barbara Bush, Kylie Jenner, Kim Kardashian, Khloe Kardashian, Kanye West, Melinda Gates and Bill Gates. Sharing the sensitive data of celebrities, the malicious actor threatened, “Here are some famous people from your database we will leak if you don't pay. You decide if this info is important or not. To Neiman: We give you one more chance to secure your data and protect your customers. We partially blocking the phone numbers of these high-profile individuals and if you don't want us to sell or release the private details of these and 40+ million other customers, our price is $1 million.” “Do the right thing. Do not let this data get out,” the post added. The celebrities and politicians in the stolen database highlight the importance of the alleged breach, the group wrote in a footnote to its post: “Now is this data worth something now that you see how many celebrities, politicians, and their children are in this database? What about shopping habits? is it important to know that President Bill Clinton was in Honolulu in April 2023 and what was at your store and what did he purchase using his debit card?...Or more Celebrity shopping like what did Jennifer Lopez buy from your stores?...what about details on Megan Fox and Courtney Cox. $1 million is nothing to protect this information. Do the right thing and we will keep your data safe.” Neiman Marcus Yet to Respond The above claims have raised serious questions over the security checks in place at Neiman Marcus and the potential impact on its high-profile customers if the data leak happens to be validated. To ascertain the veracity of the claims, The Cyber Express has reached out to officials of the luxury retain chain. As of publication time, no response has been received, leaving the data breach claim unverified. Neiman Marcus Group, Inc., based in Dallas, Texas, is a popular luxury retailer that oversees brands such as Neiman Marcus, Bergdorf Goodman, Horchow, and Last Call. Since September 2021, it has been under the ownership of a consortium of investment firms led by Davidson Kempner Capital Management, Sixth Street Partners, and Pacific Investment Management. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Breaking Down Microsoft’s July 2024 Patch Tuesday: Zero-Days and New Features

cyberexpress Jul 10, 2024 Firewall Daily

On the second Tuesday of July 2024, Microsoft Corporation issued its latest round of security updates, marking another Patch Tuesday update. This month's release addresses a total of 139 vulnerabilities across various Microsoft products, including Windows operating systems and other software. Among these show more ...

vulnerabilities, Microsoft has identified at least four zero-day exploits, underlining the critical nature of this update. Two of the zero-day vulnerabilities patched in July 2024 have been actively exploited in the wild, emphasizing the urgency of applying these updates promptly. One such vulnerability is CVE-2024-38080, affecting the Windows Hyper-V component found in both Windows 11 and Windows Server 2022. This flaw allows attackers to elevate their privileges on a compromised system. Microsoft has confirmed active exploitation of this vulnerability but has not disclosed specific details regarding the attacks. Microsoft Patch Tuesday Fixes Zero-Day Vulnerabilities The 2023 Microsoft Patch Tuesday fixes several vulnerabilities existing within the Microsoft ecosystem. These vulnerabilities range from denial of service, elevation of privilege, and remote code execution. In a conversation with The Cyber Express, Satnam Narang, Senior Staff Research Engineer at Tenable, shared his opinions on Microsoft Patch Tuesday and the vulnerabilities associated with this update. "CVE-2024-38080 is an elevation of privilege flaw in Windows Hyper-V. A local, authenticated attacker could exploit this vulnerability to elevate privileges to the SYSTEM level following an initial compromise of a targeted system”, said Narang. The second zero-day, CVE-2024-38112, targets MSHTML, Microsoft's proprietary engine used in Internet Explorer. This vulnerability involves spoofing, where an attacker could deceive a user into opening a malicious file, leading to potential exploitation. Similar to CVE-2024-38080, Microsoft has acknowledged the exploitation of this vulnerability in the wild without providing specific details. Narang further commented on CVE-2024-38112, stating, "Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment." Microsoft's July 2024 Patch Tuesday addresses a total of 139 vulnerabilities, including five critical ones known for their potential to allow remote code execution (RCE). These vulnerabilities cover a range of exploit categories, including 26 elevations of privilege issues, 24 security feature bypass vulnerabilities, 59 instances of remote code execution risks, 9 information disclosure flaws, 17 denial of service vulnerabilities, and 7 spoofing vulnerabilities. Fixing Vulnerabilities and New Windows Enhancements Satnam Narang further provided valuable insights into the severity and implications of these vulnerabilities. Regarding the broader impact of such patches, Narang stated, "Since 2022, there have been 44 vulnerabilities in Windows Hyper-V, though this is the first one to have been exploited in the wild to our knowledge." He also highlighted another critical vulnerability, CVE-2024-38021, affecting Microsoft Office, which allows attackers to leak NTLM credentials. This flaw underscores ongoing challenges in securing Microsoft's software suite against sophisticated cyber threats. In addition to the actively exploited zero-days, Microsoft's July 2024 Patch Tuesday release addresses two other publicly disclosed vulnerabilities: CVE-2024-35264, a remote code execution flaw in .NET and Visual Studio, and CVE-2024-37985, a side-channel attack on Arm processors known as "FetchBench" that could compromise sensitive information. While these vulnerabilities were not actively exploited at the time of the patch release, they highlight the critical importance of proactive patch management to mitigate potential risks effectively. Beyond security updates, Microsoft's July 2024 Patch Tuesday includes several enhancements and new features for Windows 11. Notably, the update introduces a controversial Game Pass advertisement within the Settings app, visible to users engaged in gaming activities. This addition aims to promote Microsoft's gaming subscription service directly within the operating system environment.

Threat Actor Claims Data Breach at Microsoft Exposing Records of 2,073 Employees

cyberexpress Jul 10, 2024 Cybersecurity News

A Threat Actor (TA) has claimed to have orchestrated a data breach from Microsoft which allegedly compromises sensitive data of over 2,000 employees. The notorious TA, operating under the pseudonym, 888, shared that the data was allegedly compromised in an undisclosed third-party breach in July 2024, but the data has show more ...

the latest date of 2022. Details of Alleged Microsoft Data Breach According to the TA’s post on dark web marketplace BreachForums, the hacked data included information about 2,073 personally identifiable information (PII) records of Microsoft employees, including the first name, last name, job title, email, linkedin profile urls, city and country. To substantiate the data breach claim, the threat actor shared a sample of the data breach which included sensitive PIIs of users mostly from New Zealand and one user from Greece. The TA, however, did not elaborate on which third-party app of Microsoft was hacked to initiate the leak. Potential Impact on Microsoft Employees If proven, the potential consequences of this data breach could be critical as the sensitive PII records could be leaked. The organization should take appropriate measures to protect the privacy and security of the stakeholders involved. Leak of personal information can lead to identity theft, financial fraud, and a loss of trust among clients, potentially jeopardizing the company’s standing in the industry. Currently, details regarding the extent of the compromised Microsoft data and the motive behind the cyber assault remain undisclosed. Despite the claims made by the TA “888”, there is no public information of a leak from any of Microsoft’s assets which remain fully functional. This discrepancy has raised doubts about the authenticity of the bad actor’s assertion. he hacker, 888, has previously been linked to several high-profile data breaches, including those of Credit Suisse, Accenture India, Shell, Heineken, and UNICEF. To ascertain the veracity of the claims, The Cyber Express has reached out to Microsoft officials. As of the writing of this news report, no response has been received, leaving the data breach claim unverified. Microsoft Criticized for Poor Security Measures Microsoft has come under severe scrutiny over its security failures in the recent past. In April 2024, a significant data leak exposed sensitive employee credentials and internal company files to the internet, raising serious concerns about data security protocols within the organization. The data leak was identified through an open and public storage server hosted on Microsoft’s Azure cloud service. According to a report by TechCrunch, the data leak was not highlighted or detected by Microsoft’s internal security systems, raising questions about the efficacy of their monitoring mechanisms. The report further highlighted that the data accessible online included a myriad of sensitive information such as code, scripts, and configuration files containing passwords, keys, and credentials utilized by Microsoft employees for accessing internal databases and systems. In February, ‘Three high-risk vulnerabilities’ were reported in the Azure components of Microsoft’s cloud software solutions along with a critical IoT device vulnerability that potentially allowed for remote code execution(RCE) attacks. Last month, Microsoft pushed ahead with the new Windows Recall screen recording feature despite the concerns of security and privacy advocates that the company belatedly tried to address. After criticism, the company then announced that it will delay the Recall feature for further testing. Microsoft President Brad Smith, in a hearing by the House Committee on Homeland Security in June, said to strengthen cybersecurity measures, the company has added 1,600 more security engineers this fiscal year and would add another 800 new security positions in the next fiscal year. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Microsoft China Bans Employees from Using Android Phones; Shift to iPhones Over Security Concerns

cyberexpress Jul 10, 2024 Cybersecurity News

In a significant move to thwart cyberattacks, Microsoft China has mandated that its employees transition from using Android smartphones to iPhones. This decision highlights the increasing importance of cybersecurity and data protection in corporate operations, especially in regions where geopolitical dynamics can show more ...

complicate technological reliance and security protocols. Security and Authentication Concerns in Microsoft China According to a report by Bloomberg, Microsoft's directive comes in response to heightened concerns over security and authentication issues associated with Android devices. Android, being an open-source operating system, is often perceived as more vulnerable to security breaches compared to Apple's iOS. The company's internal security teams have reportedly identified several vulnerabilities in Android devices that could potentially be exploited for unauthorized data access or cyberattacks. The decision reflects a broader strategy by Microsoft to mitigate risks associated with the use of Android devices in a country where cybersecurity threats are a growing concern. By switching to iPhones, Microsoft aims to leverage the advanced security features and robust encryption protocols that Apple devices offer, thereby enhancing the overall security framework for its Chinese operations. Implications for Microsoft China Employees Microsoft’s latest switch is part of its new Secure Future Initiative. As Google Play Store is unavailable in China, Android users download apps directly or through device manufacturers like Huawei and Xiaomi. This increases the risk of potential malware attacks due to lack of security features. Microsoft has assured that it will provide necessary support and resources to ensure a smooth transition for its workforce. According to the Bloomberg report, Microsoft plans to distribute iPhone 15, as a one-time purchase, to its employees in China who currently use Android devices, including those from Xiaomi or Huawei. These phones will be distributed through various hubs throughout the country, including Hong Kong. The shift to iPhones is expected to streamline security protocols and enhance the protection of corporate data. Apple's ecosystem, known for its stringent security measures and closed-loop system, offers a more controlled environment, which is less susceptible to the kind of threats that Android's open system faces. A memo was sent out to Microsoft China employees that due to lack of Google services; the company proposed a ban on Android devices. The move also intends to increase the use of the Microsoft Authenticator and Identity Pass apps. Microsoft’s decision underscores the serious nature of cybersecurity threats and the lengths to which companies are willing to go to protect their data. This move could potentially influence other multinational corporations operating in China to re-evaluate their own security protocols and consider similar shifts to more secure platforms. Microsoft’s Security Controls Under Scanner Microsoft security controls came under scrutiny in April with the release of a U.S. Cyber Safety Review Board (CSRB) report that detailed “a cascade of security failures at Microsoft” that allowed threat actors linked to China to access “the official email accounts of many of the most senior U.S. government officials managing our country’s relationship with the People’s Republic of China” in a July 2023 attack. In March, US Senator Ron Wyden has launched a scathing attack on Microsoft, urging the U.S. government to hold the tech giant responsible for what he claims are “negligent cybersecurity practices” that facilitated a successful Chinese espionage campaign against the United States government. Microsoft's decision to ban the use of Android phones by its employees in China and mandate a shift to iPhones underscores the critical importance of cybersecurity in today’s corporate landscape. By prioritizing security and data protection, Microsoft is taking proactive steps to safeguard its operations in a region marked by complex geopolitical and cybersecurity challenges. As the tech landscape continues to evolve, decisions like these highlight the intricate balance between technology, security, and geopolitics that global companies must navigate.

FBI Releases Joint Advisory on Russian AI Tool Used to Sow Disinformation On Social Media

cyberexpress Jul 10, 2024 Cybersecurity News

The U.S. Federal Bureau of Investigation (FBI), along with the domestic Cyber National Mission Force and several international intelligence agencies, have uncovered a sophisticated Russian-backed operation that used an artificial intelligence-powered bot farm to spread disinformation on social media platforms. The show more ...

agencies - which included international partners such as the Netherlands General Intelligence and Security Service and the Canadian Centre for Cyber Security - have released a joint advisory to warn social media companies about Russian state-sponsored actors employing the Meliorator software for malign influence activity in foreign nations and the United States. While currently focused on X (formerly Twitter), analysts believe the tool's developers intend to expand to other platforms. Meliorator Bot Farm Characteristics and Capabilities [caption id="attachment_81055" align="alignnone" width="2004"] Agencies Involved in the investigation of Russian operation (Source: www.ic3.gov)[/caption] The Meliorator tool creates bot persona 'souls' (false identities) with varying levels of information on their profiles and relevant 'thoughts' (automated actions). The first bot archetype has complete profiles, including a profile photo, cover photo, and biographical data, while the second archetype has very little information. The third archetype appears real by generating a lot of activity and garnering followers. [caption id="attachment_81052" align="aligncenter" width="505"] Source: www.ic3.gov[/caption] The bot personas are capable of deploying content similar to typical social media users, mirroring disinformation from existing bot personas, perpetuating specified pre-existing false narratives, and formulating messaging based on the specific archetype of the bot. To avoid detection, the creators of the Meliorator tool used various obfuscation techniques, including IP address obfuscation, bypass of dual factor authentication, and modification of browser user agent strings to appear more consistent. The bot personas also follow genuine accounts reflective of their political leanings and interests listed in their biography, making them appear more authentic to viewers. The tool has been used by FSB services since 2022 to generate mass quantities of social media profiles that appear to be authentic. The software includes an administrator panel called "Brigadir" and a seeding tool named "Taras," which contains backend files to control the personas used to spread disinformation. These "souls" are stored in a MongoDB database for easy manipulation. Operators access Meliorator through virtual network computing that is hosted at dtxt.mlrtr[.]com using project management software from Redmine. Justice Department Seizes Associated Domains In relation to the joint action by intelligence agencies, the U.S. Justice Department announced the seizure of two related domain names, and 968 social media accounts used in malign influence operations. According to the press release, the bot farm was developed by an individual identified as Individual A, who worked as the deputy editor-in-chief at RT, a state-run Russian news organization. In early 2022, when RT leadership sought to develop alternative means for distributing information beyond traditional news broadcasts, Individual A had led the development of software to create and operate a social media bot farm, with the capability of creating fictitious online personas on a wide-scale basis to advance the mission of the FSB and the Russian government. The bot farm's operators used the network to spread disinformation on various topics, including the Russia-Ukraine conflict. These included videos in which President Putin justified Russia's actions in Ukraine, and claims that certain areas of Poland, Ukraine, and Lithuania were "gifts" to those countries from the Russian forces that liberated them from Nazi control during World War II. [caption id="attachment_81046" align="alignnone" width="420"] Source: justice.gov[/caption] [caption id="attachment_81047" align="alignnone" width="430"] Source: justice.gov[/caption] The bot farm was also used to spread videos claiming that the number of foreign fighters fighting for the Ukrainian forces was significantly lower than public estimates. Deputy Attorney General Lisa Monaco stated, “Today’s action demonstrates that the Justice Department and our partners will not tolerate Russian government actors and their agents deploying AI to sow disinformation and fuel division among Americans.” “As malign actors accelerate their criminal misuse of AI, the Justice Department will respond and we will prioritize disruptive actions with our international partners and the private sector. We will not hesitate to shut down bot farms, seize illegally obtained internet domains, and take the fight to our adversaries,” she added. The FSB’s use of U.S.-based domain names, which the software used to register the bots, violates the International Emergency Economic Powers Act. In addition, the accompanying payments for that infrastructure violate federal money laundering laws. X (formerly Twitter) took action to voluntarily suspend bot accounts identified in the investigation for violation of its terms of service. The FBI worked with cybersecurity agencies from Canada, the Netherlands and other partners to analyze the bot farm's technology. The Justice Department has released a joint cybersecurity advisory on the research findings of the intelligence agencies, allowing social media platforms and researchers to identify and prevent further use of the technology. [caption id="attachment_81049" align="alignnone" width="1434"] Source: www.ic3.gov[/caption] The publication includes IP addresses, SSL certificates, mail server domains, and related details associated with the infrastructure of the Meliorator bot network.

CISA Adds Critical Zero-Day Vulnerabilities from July 2024 Patch Tuesday to Exploited List

cyberexpress Jul 10, 2024 Firewall Daily

CISA has added two zero-day vulnerabilities from the cluster of vulnerabilities fixed in this month’s patch Tuesday. In its latest patch Tuesday release for July 2024, Microsoft has addressed a total of 138 vulnerabilities, including two zero-day exploits that have been actively exploited in the wild. These show more ...

vulnerabilities, specifically CVE-2024-38080 and CVE-2024-38112, have been highlighted by the Cybersecurity and Infrastructure Security Agency (CISA) in their Known Exploited Vulnerabilities Catalog. CVE-2024-38080 affects Microsoft's Hyper-V, a core component used for virtualization in Windows and Windows Server environments. This vulnerability enables a local attacker with basic user permissions to escalate their privileges to gain SYSTEM-level access on the host machine. While exploitation requires initial local access, the potential consequences of successful exploitation are significant, allowing attackers to compromise the entire virtualized environment. Two Zero-Days Vulnerability Added to CISA’s Known Exploited Vulnerabilities Catalog [caption id="attachment_81145" align="alignnone" width="2134"] Source: CISA[/caption] The two vulnerabilities listed by CISA are highly concerning since both of them carry a CVS score of 7.8 and 7.5. In a conversation with The Cyber Express, Satnam Narang, Senior Staff Research Engineer at Tenable, expressed his view of these two vulnerabilities, stating, "CVE-2024-38080 is an elevation of privilege flaw in Windows Hyper-V. A local, authenticated attacker could exploit this vulnerability to elevate privileges to the SYSTEM level following an initial compromise of a targeted system." The second zero-day vulnerability, CVE-2024-38112, targets Microsoft's MSHTML platform, which is integral to applications like Internet Explorer. This vulnerability involves spoofing, where attackers can deceive users into interacting with malicious content disguised as legitimate. This could lead to the installation of malware, theft of sensitive information, or further compromise of the affected system. Microsoft has acknowledged active exploitation of this vulnerability in the wild, though specific details about the attacks remain undisclosed. Discussing CVE-2024-38112, Narang added, "Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment." Microsoft Patch Tuesday Fixes Several Flaws and Vulnerabilities These vulnerabilities are part of a broader set of patches released by Microsoft to address 138 CVEs across various products and services. The patch includes fixes for critical vulnerabilities known for their potential to facilitate remote code execution (RCE) and other severe impacts on system security. Among these are flaws affecting Windows Remote Desktop Licensing Service, which could allow remote attackers to execute arbitrary code by sending specially crafted packets to vulnerable servers. In addition to the actively exploited vulnerabilities, the patch addresses several other security issues, including those affecting .NET, Visual Studio, and Windows 11 on ARM64-based systems. Two of these vulnerabilities, CVE-2024-35264 and CVE-2024-37985, had been publicly disclosed prior to the release of the patches. CISA's inclusion of CVE-2024-38080 and CVE-2024-38112 in its Known Exploited Vulnerabilities Catalog highlights the critical nature of these vulnerabilities and the importance of prompt mitigation. Organizations are strongly advised to apply patches as soon as possible to mitigate the risks associated with these vulnerabilities. If immediate patching is not feasible, CISA recommends implementing vendor-provided mitigations or considering discontinuing the use of affected products until patches can be applied. Microsoft's July 2024 patch Tuesday release represents a crucial update for system administrators and IT security professionals. The inclusion of actively exploited vulnerabilities such as CVE-2024-38080 and CVE-2024-38112 highlights the evolving threat landscape and the ongoing efforts needed to safeguard against potential cyber threats. By prioritizing these patches and adopting best practices in vulnerability management, organizations can enhance their resilience against emerging security risks in today's digital environment.

Houthi-Deployed Android Surveillance Tool ‘GuardZoo’ Targeted Middle Eastern Militaries

cyberexpress Jul 10, 2024 Cybersecurity News

Cybersecurity researchers observed an Android surveillance campaign active since October 2019 that has targeted the military personnel of various countries in the Middle East. The researchers believe the operation has ties to a Houthi-aligned threat actor. Referred to as "GuardZoo," the spyware has infected show more ...

devices belonging to more than 450 victims. The campaign remains active with researchers still analyzing related activity. GuardZoo Infection of Middle Eastern Military Targets GuardZoo is based on Dendroid RAT, an underground RAT program available for purchase at $300 that also included a binding utility to infect legitimate programs that had been leaked online in 2014. Researchers noted many modifications to the original source code to implement additional capabilities while removing some unused functions. The GuardZoo malware uses a new C2 backend created with ASP.NET. instead of relying on the native Dendroid RAT's PHP web panel for remote Command and Control (C2). The researchers from Lookout attribute the campaign to a Yemeni, Houthi-aligned threat actor based on the application lures, exfiltrated data, targeting, and the C2 infrastructure location. The campaign has been observed to primarily target victims in Yemen, Saudi Arabia, Egypt, Oman, the UAE, Qatar, and Turkey. [caption id="attachment_81170" align="alignnone" width="314"] Source: www.lookout.com[/caption] [caption id="attachment_81169" align="alignnone" width="896"] Source: www.lookout.com[/caption] The researchers observed the use of two C2 addresses, the first of which functioned as the primary address - https://wwwgoogl.zapto[.]org - and the second as a backup address: https://somrasdc.ddns[.]net. The malware is able to receive over 60 different commands from these C2 servers. These commands are mostly exclusive implementations to Guardzoo. The researchers compiled a list of some of the most notable C2 commands and their respective functions: [caption id="attachment_81175" align="alignnone" width="446"] Source: www.lookout.com[/caption] GuardZoo can collect a wide range of data from infected devices, including photos, documents, location data, saved GPS routes and tracks, device model number, mobile carrier, and Wi-Fi configuration. Moreover, it can enable the actor to deploy additional invasive malware on the infected device. The device's location, model, and cellular service carrier can also be collected. The surveillanceware is distributed via WhatsApp, WhatsApp Business, and direct browser download, and uses military themes to lure victims. Lookout researchers have observed recent samples of GuardZoo posing as religious, e-book, and military-themed apps, such as 'The Holy Quran,' 'Constitution of the Armed Forces,' 'Limited - Commander and Staff,' and 'Restructuring of the New Armed Forces.' [caption id="attachment_81186" align="alignnone" width="1274"] Source: www.lookout.com[/caption] Researchers Trace Houthi Connection Researchers found evidence linking GuardZoo to Yemen's Houthi militia, which the U.S. government recently redesignated as a global terrorist group. Analysis of server logs revealed that many of the identified victims appeared to be members of the pro-Hadi forces in Yemen. Additionally, the malware's C2 servers were found to be hosted on YemenNet infrastructure belonging to an ISP that is state-owned by the Yemeni government. Researchers noted that some of the log entries indicated that the devices belonged forces aligned with President Hadi's government that operates from Aden. One of the exfiltrated documents contained phrases that translated to “Very Confidential, Republic of Yemen, Ministry of Defense, Chief of the General Staff, War Operations Department, Insurance division.“ Protection Against GuardZoo Aaron Cockerill, Executive Vice President of Product & Security at the security firm, stated, “These spyware packages can be used to collect a wide range of data from infected devices, which in the case of GuardZoo, could put military personnel and operations at risk. We urge security professionals to be aware of this threat and to take steps to protect their users, and work and personal data.” To protect both business and personal Android devices from GuardZoo and other surveillanceware, the researchers have recommended the following basic steps: Keep your operating system and apps up to date, as most updates nowadays are related to security patches. Only install apps from Google Play, not third-party sources. If you receive a message asking you to install an app from a website, immediately block the number and report the incident to your IT or Security team. Be mindful of the permissions that mobile apps ask for. Overly invasive permissions, even from legitimate apps, could create data risk for your organization. Implement a mobile security solution that can detect and protect against malware and keep your organization safe.

Google Introduces Passkeys for High-Risk Users in Advanced Protection Program

cyberexpress Jul 10, 2024 Firewall Daily

Google has introduced a significant enhancement to its Advanced Protection Program (APP), catering specifically to high-risk users with the introduction of passkeys. The Google passkey aims to upgrade account security by offering an alternative to traditional physical security keys. Until now, users looking to enroll show more ...

in Google's Advanced Protection Program needed a physical security key. With the addition of passkeys, Google now provides a more flexible and accessible option for securing accounts, especially beneficial for those who may not always have access to physical keys. According to Shuvo Chatterjee, Product Lead, Advanced Protection Program, and Grace Hoyt, Privacy Safety and Security Partnerships, this update allows high-risk users to choose a passkey as their authentication method, alongside or in place of a physical key. Google Passkey for Advanced Protection Program (APP) [caption id="attachment_81158" align="alignnone" width="1000"] Source: Google[/caption] The Google passkeys operate on the FIDO Authentication standard, ensuring robust security against phishing and unauthorized access attempts. They are designed to be faster and more convenient than passwords, utilizing biometrics such as fingerprints or facial scans, or a PIN code for verification. This makes them not only secure but also user-friendly, reducing the reliance on memorizing or typing passwords. Shuvo and Grace elaborate on the significance of this update, stating, "Passkeys are now available for high-risk users to enroll in the Advanced Protection Program, offering a more streamlined and accessible way to secure their accounts." The Advanced Protection Program itself is Google's most secure account protection offering, tailored for individuals vulnerable to sophisticated cyber threats, such as journalists, political campaigners, and human rights workers. It defends against common attacks like phishing, malware, and fraudulent access attempts by requiring strict authentication measures. How to Use Google Passkey To enroll using a passkey, users need to ensure compatibility with their devices and browsers. The process involves visiting Google's Advanced Protection Program enrollment page, selecting "Get started," and following the on-screen instructions to complete the setup either with a passkey or a physical security key. Recovery options, such as a phone number or email, are also required during enrollment to facilitate account recovery if necessary. In addition to enhancing user security, Google has announced a partnership with Internews aimed at providing additional safety and security support to journalists and human rights workers globally. This initiative will leverage Internews' extensive network of security partners and trainers across ten countries, spanning Asia, Latin America, and Europe. This partnership highlights Google's commitment to supporting high-risk individuals by expanding access to critical online safety tools and resources. It complements existing efforts such as Project Shield and various security training programs conducted in collaboration with organizations like Defending Digital Campaigns and IFES. Google's introduction of passkeys into the Advanced Protection Program represents a significant step forward in enhancing online security for high-risk users. By offering a versatile alternative to physical security keys, Google aims to make account protection more accessible and user-friendly, reinforcing its commitment to safeguarding individuals facing cyber risks.

Fujitsu Data Breach: No Ransomware, But Advanced Attack Evades Detection

cyberexpress Jul 10, 2024 Cybersecurity News

Fujitsu, the renowned Japanese tech giant, has confirmed a data breach that compromised personal and business information of some individuals and customers. The Fujitsu data breach, discovered earlier this year, did not involve ransomware but utilized sophisticated mechanisms to evade detection while exfiltrating show more ...

sensitive details. "We would like to inform you of the results of our investigation into the possible leak of personal information, which we announced on March 15, 2024, and the measures that have already been implemented. Customers affected by this incident have already been notified individually," reads the company's official statement. In March 2024, Fujitsu detected malware infections in several of its systems, raising concerns about potential compromises of sensitive customer information. The company promptly initiated a comprehensive investigation, in collaboration with an external specialist research firm, to identify the scope and cause of the Fujitsu data breach. The investigation included a thorough analysis of log information and interviews with internal personnel. Here is what the investigation revealed: Fujitsu Data Breach: Malware Behavior and Scope of Impact The Fujitsu data breach investigation revealed that the malware was installed on one of Fujitsu's business computers and subsequently spread to other work computers within the company's internal network in Japan. This malware, unlike ransomware, employed advanced techniques to disguise itself and evade detection. Despite its sophistication, the investigation confirmed that the number of infected work computers and those affected by executed copying commands did not exceed the initially detected 49 computers. "After malware was installed on one of our company's business computers, it was confirmed that the malware's behavior spread from that computer to other business computers. This malware was not ransomware, but rather a type of attack that used advanced techniques, such as disguising itself in various ways to make it difficult to detect, making it extremely difficult to detect," informed Fujitsu Team. Importantly, these compromised computers were not involved in managing Fujitsu's cloud services, and no traces of access to customer-provided services were found. Therefore, it was determined that the impact did not extend beyond the company’s internal network to customer environments. Scope of Information Leak in Fujitsu Data Breach Further examination of Fujitsu's communication and operation logs revealed that the malware executed commands to copy certain files. These files contained personal information of some individuals and business-related information of customers. Although there have been no reports of misuse of the compromised information, Fujitsu has proactively notified the affected customers and is taking necessary measures to mitigate any potential risks. "The files that were able to be copied contained personal information of some individuals and information related to the business of customers, and we have reported this to the affected customers individually and are taking the necessary measures. At this time, we have not received any reports that personal information or information related to customers' business has been misused," the Fujitsu team informed further. So What Measures Fujitsu Is Taking Fujitsu has implemented several measures to address the breach and enhance its information security: Isolation and Initialization: Upon detecting suspicious behavior, all business PCs suspected of being affected were isolated from the company network and initialized to prevent further spread of the malware. Blocking External Connections: Connections to external servers used by the attackers as sources of intrusion were blocked to cut off the malware's communication channels. Enhanced Security Monitoring: The characteristics of the malware’s attack method were identified and incorporated into security monitoring rules for all business PCs within the company. Additionally, virus detection software was enhanced and updated to improve its effectiveness against such sophisticated threats. Fujitsu has assured its customers that it is committed to further strengthening its information security measures to prevent similar incidents in the future. Fujitsu extends its deepest apologies to all individuals and customers affected by this incident. "We would like to offer our deepest apologies to all those involved for the great concern and inconvenience caused," said Fujitsu. The data breach at Fujitsu highlights the evolving nature of cyber threats and the importance of strong security measures. The company’s swift response and transparent communication demonstrate its dedication to maintaining trust and accountability in the face of cyber challenges.h

7.64 Million Individuals Impacted in Evolve Bank Ransomware Attack

cyberexpress Jul 10, 2024 Cybersecurity News

Evolve Bank & Trust, a financial institution with both traditional banking and open banking services, disclosed a data breach impacting a staggering 7.64 million individuals. The Arkansas-based bank initially believed a "hardware failure" caused system disruptions in late May, but an investigation revealed show more ...

a cyberattack with a much longer timeline. Evolve confirmed hackers infiltrated their network as early as February, potentially compromising sensitive customer data. While the official notification letter filed with the Maine Attorney General avoids specifics, the bank has acknowledged stolen information, including names, Social Security numbers, bank account numbers, and contact details. Affirm and Wise Customers Hit By Attack This breach extends beyond Evolve's core clientele, impacting customers of its open banking platform (often referred to as Banking-as-a-Service) used by several fintech firms. "Buy now, pay later" provider Affirm and money transfer service Wise are among those notifying their customers of potential data exposure due to Evolve's security lapse. The incident adds another layer of concern for Evolve, which faced a regulatory order from the Federal Reserve Board in June. The order mandated improvements to Evolve's anti-money laundering (AML) and risk management programs, citing the need for enhanced procedures in record keeping and consumer compliance. This regulatory action raises questions about whether vulnerabilities exploited in the cyberattack might have been linked to the bank's AML/compliance shortcomings. LockBit Claims Evolve Bank Attack LockBit, a Russian-speaking ransomware-as-a-service (RaaS) group, claimed responsibility for the attack. Interestingly, LockBit initially attributed the stolen data to the Federal Reserve, likely due to a stolen document referencing the central bank. “The threat actor also encrypted some data within our environment. However, we have backups available and experienced limited data loss and impact on our operations. We refused to pay the ransom demanded by the threat actor. As a result, they leaked the data they downloaded. They also mistakenly attributed the source of the data to the Federal Reserve Bank,” Evolve Bank said at the time. This error highlights the evolving tactics of RaaS groups, who often employ misinformation or disinformation campaigns alongside cyberattacks to create confusion and maximize impact. The Evolve breach serves as a stark reminder for financial institutions of the critical need for robust cybersecurity measures. With the increasing adoption of open banking platforms and the ever-present threat of RaaS attacks, institutions must prioritize data security and implement strong access controls, encryption, and incident response protocols. Regulatory bodies are likely to intensify their scrutiny of financial institutions' cybersecurity posture in the wake of this incident.

City of Philadelphia Data Breach: 35,881 Affected, Including Maine Residents

cyberexpress Jul 10, 2024 Cybersecurity News

The City of Philadelphia has disclosed about data breach that occurred in May 2023, impacting the personal information of 35,881 individuals. This revelation came through a filing with the Office of Maine's Attorney General. On July 8, 2024, the City of Philadelphia sent out written notifications to those show more ...

potentially affected, including approximately 15 residents of Maine. The City of Philadelphia clarifies that by providing this notice, it does not waive any rights or defenses concerning the applicability of Maine law, the Maine data event notification statute, or personal jurisdiction. City of Philadelphia Data Breach: What Exactly Happened? On May 24, 2023, the City detected suspicious activity within its email environment. An investigation was immediately launched with the help of third-party cybersecurity experts to understand the extent and nature of the breach. The investigation revealed that between May 26, 2023, and July 28, 2023, an unauthorized individual gained access to specific City email accounts. On August 22, 2023, the City learned that these compromised email accounts potentially contained protected health information (PHI). Although the investigation could not conclusively determine whether any information was accessed or acquired, the City opted to conduct a comprehensive review to identify what information was potentially exposed and who was affected. To comply with regulations such as the Health Insurance Portability and Accountability Act (HIPAA), the City notified the U.S. Department of Health and Human Services (HHS) on October 20, 2023, posted substitute notices on its website, and informed the media through the Philadelphia Inquirer. Once the data review concluded, the City validated the findings and sought to obtain missing address information for those potentially affected. Subsequently, on May 16, 2024, the City mailed written notices to individuals whose PHI might have been compromised (excluding Maine residents), provided additional notice to HHS, updated its website, and informed the Philadelphia Inquirer once more. By June 12, 2024, the City had completed the validation of the review results and had located the necessary address information. The personal information related to Maine residents that was potentially accessible during the event included names, addresses, Social Security numbers, and financial account information. Steps Taken and Future Actions Upon learning of the data breach, the City of Philadelphia acted swiftly to investigate and respond to the event. They assessed the security of their network and email system and identified the individuals who might be affected. The City also notified federal law enforcement and is working to implement additional safeguards and provide employee training to prevent future incidents. Affected individuals, including Maine residents, were offered twelve months of credit monitoring services at no cost. The City has also provided guidance to potentially impacted individuals on protecting against identity theft and fraud. This includes advising them to report any suspected incidents to their bank, credit card company, or other relevant institutions. The City has also provided instructions on how to place fraud alerts and credit freezes on credit files, the contact details for national consumer reporting agencies, information on obtaining free credit reports, and reminders to stay vigilant by reviewing account statements and monitoring credit reports. Affected individuals are encouraged to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report any attempts or actual instances of identity theft and fraud.

Blast-RADIUS Vulnerability Affects Widely-Used RADIUS Authentication Protocol

cyberexpress Jul 10, 2024 Cybersecurity News

A critical vulnerability in the widely used RADIUS authentication protocol could allow attackers to gain unauthorized access to networks and devices, researchers have discovered. The flaw, dubbed "Blast-RADIUS," affects a protocol that has functioned as a cornerstone of modern network infrastructure. RADIUS, show more ...

which stands for Remote Authentication Dial-In User Service, is used by nearly every switch, router, access point and VPN concentrator sold in the last 20 years. It verifies user credentials for remote access to networked devices. including network routers and switches, industrial control systems, VPNs, ISPs using DSL or FTTH, 2G and 3G cellular roaming, and 5G DNN authentication The Blast-RADIUS Attack Researchers from several universities along with some private firms discovered that a man-in-the-middle attacker could exploit a weakness in how the RADIUS protocol authenticates server responses. By injecting malicious data into a legitimate authentication request, an attacker can forge a valid "Access-Accept" message in response to a failed login attempt. [caption id="attachment_81227" align="alignnone" width="2391"] Source: blastradius.fail[/caption] This allows the attacker to transform a reject into an accept, and assign themselves arbitrary network privileges. The attack is made by the abuse of the MD5 hash function, which has been known to be vulnerable to chosen-prefix collisions. The attacker can use this collision to create a modified Response Authenticator that matches the authentic one generated by the server, without requiring any knowledge of the shared secret between the client and server. [caption id="attachment_81242" align="alignnone" width="1977"] Source: blastradius.fail[/caption] While MD5 hash collisions have been known since 2004, the researchers state that their attack technique is much more complex than older forms of MD5 collision attacks. Further, MD5 collision was not previously thought of as a possible way to exploit the RADIUS protocol. The new attack technique requires the use of the internet, with the attacker having to compute for the chosen-prefix MD5 collision attack in a matter of mere minutes or seconds. The researchers state that the best previously reported chosen-prefix collision attack typically took hours of operation to produce, collisions that were not found to be compatible with the RADIUS protocol. The researchers' Blast-RADIUS attack technique incorporates several improvements in speed, space, and scaling ahead of existing MD5 attacks, demonstrating that they can occur in shorter intervals to compromise the popular RADIUS protocol. While the proof-of-concept attacks described in the paper took about 3 to 6 minutes for MD5 chosen-prefix hash collision computation, longer than the 30- to 60-second timeouts commonly used in practice for RADIUS, each step of the new collision algorithm parallelizes rather well and allows for further hardware optimization. The researchers expect that a well-resourced attacker could obtain computational processing times tens or hundreds of times faster by running the attack on better GPUs, FPGAs, or other optimal hardware. The Blast-RADIUS attack technique affects all known RADIUS implementations that use non-EAP authentication methods over UDP, including the common FreeRADIUS implementation. The researchers disclosed details of the vulnerability to the IETF (Internet Engineering Task Force) and CERT( Computer Emergency Readiness Team) and expect patches for mitigations in the Message-Authenticator specifications from major implementations of the RADIUS protocol. RADIUS Mitigation and Future Outlook The IETF RADEXT working group is said to be working on pushing for the standardization of the RADIUS protocol as more secure alternative, which the researchers state would help mitigate against the Blast-RADIUS vulnerability. While the researchers note that major RADIUS implementations are working on releasing various patches to mitigate the vulnerability, they said the attack demonstrates the need to scrap and move away from the aging protocol entirely. In the meantime, the researchers urge system administrators to check with vendors for possible patches against the vulnerability and to follow best practices for secure RADIUS configuration. The Blast-RADIUS attack serves as a reminder that even long-standing protocols can harbor critical flaws. The research demonstrates that as networks deployments grow more complex, there must be continued scrutiny of these technologies to maintain security.

The Stark Truth Behind the Resurgence of Russia’s Fin7

krebsonsecurity Jul 10, 2024 Ne'er-Do-Well News

The Russia-based cybercrime group dubbed “Fin7,” known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 — setting up thousands of show more ...

websites mimicking a range of media and technology companies — with the help of Stark Industries Solutions, a sprawling hosting provider that is a persistent source of cyberattacks against enemies of Russia. In May 2023, the U.S. attorney for Washington state declared “Fin7 is an entity no more,” after prosecutors secured convictions and prison sentences against three men found to be high-level Fin7 hackers or managers. This was a bold declaration against a group that the U.S. Department of Justice described as a criminal enterprise with more than 70 people organized into distinct business units and teams. The first signs of Fin7’s revival came in April 2024, when Blackberry wrote about an intrusion at a large automotive firm that began with malware served by a typosquatting attack targeting people searching for a popular free network scanning tool. Now, researchers at security firm Silent Push say they have devised a way to map out Fin7’s rapidly regrowing cybercrime infrastructure, which includes more than 4,000 hosts that employ a range of exploits, from typosquatting and booby-trapped ads to malicious browser extensions and spearphishing domains. Silent Push said it found Fin7 domains targeting or spoofing brands including American Express, Affinity Energy, Airtable, Alliant, Android Developer, Asana, Bitwarden, Bloomberg, Cisco (Webex), CNN, Costco, Dropbox, Grammarly, Google, Goto.com, Harvard, Lexis Nexis, Meta, Microsoft 365, Midjourney, Netflix, Paycor, Quickbooks, Quicken, Reuters, Regions Bank Onepass, RuPay, SAP (Ariba), Trezor, Twitter/X, Wall Street Journal, Westlaw, and Zoom, among others. Zach Edwards, senior threat analyst at Silent Push, said many of the Fin7 domains are innocuous-looking websites for generic businesses that sometimes include text from default website templates (the content on these sites often has nothing to do with the entity’s stated business or mission). Edwards said Fin7 does this to “age” the domains and to give them a positive or at least benign reputation before they’re eventually converted for use in hosting brand-specific phishing pages. “It took them six to nine months to ramp up, but ever since January of this year they have been humming, building a giant phishing infrastructure and aging domains,” Edwards said of the cybercrime group. In typosquatting attacks, Fin7 registers domains that are similar to those for popular free software tools. Those look-alike domains are then advertised on Google so that sponsored links to them show up prominently in search results, which is usually above the legitimate source of the software in question. A malicious site spoofing FreeCAD showed up prominently as a sponsored result in Google search results earlier this year. According to Silent Push, the software currently being targeted by Fin7 includes 7-zip, PuTTY, ProtectedPDFViewer, AIMP, Notepad++, Advanced IP Scanner, AnyDesk, pgAdmin, AutoDesk, Bitwarden, Rest Proxy, Python, Sublime Text, and Node.js. In May 2024, security firm eSentire warned that Fin7 was spotted using sponsored Google ads to serve pop-ups prompting people to download phony browser extensions that install malware. Malwarebytes blogged about a similar campaign in April, but did not attribute the activity to any particular group. A pop-up at a Thomson Reuters typosquatting domain telling visitors they need to install a browser extension to view the news content. Edwards said Silent Push discovered the new Fin7 domains after a hearing from an organization that was targeted by Fin7 in years past and suspected the group was once again active. Searching for hosts that matched Fin7’s known profile revealed just one active site. But Edwards said that one site pointed to many other Fin7 properties at Stark Industries Solutions, a large hosting provider that materialized just two weeks before Russia invaded Ukraine. As KrebsOnSecurity wrote in May, Stark Industries Solutions is being used as a staging ground for wave after wave of cyberattacks against Ukraine that have been tied to Russian military and intelligence agencies. “FIN7 rents a large amount of dedicated IP on Stark Industries,” Edwards said. “Our analysts have discovered numerous Stark Industries IPs that are solely dedicated to hosting FIN7 infrastructure.” Fin7 once famously operated behind fake cybersecurity companies — with names like Combi Security and Bastion Secure — which they used for hiring security experts to aid in ransomware attacks. One of the new Fin7 domains identified by Silent Push is cybercloudsec[.]com, which promises to “grow your business with our IT, cyber security and cloud solutions.” The fake Fin7 security firm Cybercloudsec. Like other phishing groups, Fin7 seizes on current events, and at the moment it is targeting tourists visiting France for the Summer Olympics later this month. Among the new Fin7 domains Silent Push found are several sites phishing people seeking tickets at the Louvre. “We believe this research makes it clear that Fin7 is back and scaling up quickly,” Edwards said. “It’s our hope that the law enforcement community takes notice of this and puts Fin7 back on their radar for additional enforcement actions, and that quite a few of our competitors will be able to take this pool and expand into all or a good chunk of their infrastructure.” Further reading: Stark Industries Solutions: An Iron Hammer in the Cloud. A 2022 deep dive on Fin7 from the Swiss threat intelligence firm Prodaft (PDF).

Houthi-Aligned APT Targets Mideast Militaries With 'GuardZoo' Spyware

darkreading Jul 10, 2024 Feed

Simple malware and simple TTPs play against a backdrop of complex geopolitical conflict in the Arab world.

Peloton Takes a Spin Through Court, Thanks to AI Privacy Lawsuit

darkreading Jul 10, 2024 Feed

The case alleges a third-party marketer for the exercise giant improperly used customer chat data to train its AI models.

Cloud-Based Investigations Platform Targets Complexity in Incident Response

darkreading Jul 10, 2024 Feed

Software-as-a-service company Command Zero launches with a platform for investigating cybersecurity incidents that aims to minimize the grunt work.

Feds Uncover Sprawling, GenAI-Enabled Russian Troll Farm

darkreading Jul 10, 2024 Feed

The bot farm was created using AI-enhanced software that was able to create a host of different false personas to spread disinformation in convincing and unsettling ways.

Gen Launches Scam Artists to Highlight Emotional Toll of Cybercrime Through Creative Artwork

darkreading Jul 10, 2024 Feed

Saviynt Expands Capabilities With EY Alliance, Elevating Approach to External User Management With its Identity Cloud

darkreading Jul 10, 2024 Feed

Privacy & Security Concerns With AI Meeting Tools

darkreading Jul 10, 2024 Feed

Businesses need to find a balance between harnessing the benefits of AI assistants and safeguarding sensitive information — maintaining trust with employees and clients.

5 Tips to Minimize the Costly Effects of Data Exfiltration

darkreading Jul 10, 2024 Feed

The more sensitive data an organization collects, the more at risk it is to a cyberattack. Here's how to limit the damage.

Poco RAT Burrows Deep Into Mining Sector

darkreading Jul 10, 2024 Feed

The novel malware targets Spanish-speaking users via malicious Google Drive links, and taps a popular C++ library to evade detection.

Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months

darkreading Jul 10, 2024 Feed

Likely two separate threat actors are using the just-patched CVE-2024-38112 in targeted, concurrent infostealer campaigns.

What's Bugging the NSA? A Vuln in Its 'SkillTree' Training Platform

darkreading Jul 10, 2024 Feed

Even the NSA leaves bugs in its software. In this case, it's the kind of cross-site issue that regularly slips past developers.

Google Targets Passkey Support to High-Risk Execs, Civil Society

darkreading Jul 10, 2024 Feed

The tech giant has rolled out passkey support for account authentication within its Advanced Protection Program to complement existing compatibility with FIDO2 hardware keys.

Microsoft July 2024 Patch Tuesday Fixes 142 Flaws, 4 Zero-Days

cyware Jul 10, 2024 Malware and Vulnerabilities

As part of Microsoft's July 2024 Patch Tuesday, 142 flaws were addressed, including two zero-days actively exploited and two publicly disclosed. Five critical vulnerabilities were fixed, all related to remote code execution.

Crypto Thefts Double to $1.4 Billion, TRM Labs Finds

cyware Jul 10, 2024 Trends, Reports, Analysis

Cryptocurrency exchange hacks and exploits are on the rise, with $1.38bn stolen in the first half of 2024, double the amount stolen in 2023. While it is lower than the record-breaking $2bn stolen in 2022, the surge may be due to higher token prices.

Blast RADIUS Attack can Bypass Authentication for Clients

cyware Jul 10, 2024 Malware and Vulnerabilities

This vulnerability, known as Blast RADIUS and rated 7.5 out of 10 on the severity scale, affects the RADIUS networking protocol, potentially granting unauthorized access to network devices and services without credentials.

Monocle: Open-Source LLM for Binary Analysis Search

cyware Jul 10, 2024 Security Products & Services

Monocle is an open-source tool powered by an LLM for searching natural language in compiled binaries. It can analyze binaries based on criteria like authentication code or password strings, using Ghidra headless for decompilation.

New Flaw in OpenSSH can Lead to Remote Code Execution

cyware Jul 10, 2024 Malware and Vulnerabilities

A vulnerability in certain versions of the OpenSSH secure networking suite may allow for remote code execution. The vulnerability, identified as CVE-2024-6409 with a CVSS score of 7.0, affects specific versions of OpenSSH such as 8.7p1 and 8.8p1.

How CISA Plans to Measure Trust in Open-Source Software

cyware Jul 10, 2024 Govt., Critical Infrastructure

The CISA is developing a new framework to assess the trustworthiness of open-source software projects. The agency's open-source software security roadmap aims to increase visibility into OSS use and risks across the federal government.

Hackers Target WordPress Calendar Plugin Used by 150,000 Sites

cyware Jul 10, 2024 Malware and Vulnerabilities

Hackers are targeting a vulnerability in the Modern Events Calendar WordPress plugin found on over 150,000 websites to upload files and execute code remotely. The plugin by Webnus is used to manage events.

UK Government Advises Best Practices for Embedded Device Security

cyware Jul 10, 2024 Security Tips and Advice

The cybersecurity arm of the UK government, RITICS, has released a new guide to assist companies in enhancing the security of their operational technology (OT) and industrial control system (ICS) hardware.

Persistent npm Campaign Shipping Trojanized jQuery

cyware Jul 10, 2024 Malware and Vulnerabilities

Approximately 68 malicious packages were created between May 26 and June 23, 2024, with deceptive names like cdnjquery and jquertyi. These packages were manually crafted, unlike automated attacks, allowing the threat actor to steal website form data.

Most Security Pros Admit Shadow SaaS and AI Use

cyware Jul 10, 2024 Trends, Reports, Analysis

A recent Next DLP poll revealed that 73% of cybersecurity professionals used unauthorized apps, including AI, last year. Top concerns were data loss, lack of control, and breaches, with 10% admitting to a breach due to these tools.

US Busts Russian AI-Driven Disinformation Operation

cyware Jul 10, 2024 Social Media Threats

The Department of Justice investigated around 1,000 accounts on social media platform X, previously Twitter, which were used by the Kremlin to spread pro-Moscow propaganda created by the AI-driven Meliorator software.

Regional Transport Office Themed Phishing Campaign Targets Android Users In India

cyware Jul 10, 2024 Malware and Vulnerabilities

Phishing messages impersonating the Regional Transport Office have been circulating since 2024, claiming traffic violations and prompting users to download a malicious APK named "VAHAN PARIVAHAN.apk".

As CISOs Grapple with the C-Suite, Job Satisfaction Takes a Hit

cyware Jul 10, 2024 Trends, Reports, Analysis

Research shows that 75% of CISOs are considering a job change due to various challenges and pressures. CISOs often face accountability for cyber incidents and compliance failures, leading to discontent.

CISA Adds Microsoft Windows and Rejetto HTTP File Server Bugs to its Known Exploited Vulnerabilities Catalog

cyware Jul 10, 2024 Malware and Vulnerabilities

The vulnerabilities added include CVE-2024-23692 affecting Rejetto HTTP File Server, CVE-2024-38080 impacting Windows Hyper-V, and CVE-2024-38112 targeting Windows MSHTML Platform.

Ticket Heist Network of 700 Domains Sells Fake Olympic Games Tickets

cyware Jul 10, 2024 Identity Theft, Fraud, Scams

QuoIntelligence discovered the operation called Ticket Heist, with convincing websites selling fake Olympic tickets. The prices on these websites are much higher than the official ones.

US Senate NDAA 2025 Boosts Military Cyber and AI Initiatives

cyware Jul 10, 2024 Govt., Critical Infrastructure

The Senate Armed Services Committee presented the NDAA for fiscal year 2025, totaling $923.3 billion for defense funding. This includes $878.4 billion for the Pentagon and $33.4 billion for national security programs under the Department of Energy.

Announcing The Bug Bounty Program Pack 1.0

packetstormsecurity Jul 10, 2024 headline,hacker,flaw

Malware Wormed Its Way Through Fujitsu Japan's Systems

packetstormsecurity Jul 10, 2024 headline,malware,japan

Citrix Patches Critical NetScaler Console Vulnerability

packetstormsecurity Jul 10, 2024 headline,flaw,patch,cisco

Four Zero Days Headline Hefty July Patch Tuesday Drop

packetstormsecurity Jul 10, 2024 headline,microsoft,flaw,patch,zero day