This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Christina Shannon, CIO, KIK Consumer Products
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
All Okta customers exposed in breach
The access and identity stalwart disclosed that the breach it discovered in October saw threat actors steal data on all its customers. This contradicts Okta’s statement directly after the breach, which said the attack impacted 1% of customers. While the breach impacted all customers, 99.6% of them had only full names and email addresses stolen. Okta said it didn’t see signs of customers being actively exploited from the breach, but did say the information could prove effective social engineering fodder.
Former Uber CISO speaks out after 6-year silence
Back in May, former Uber CISO, Joseph Sullivan, was sentenced to three years’ probation, 200 hours of community service, and a $50,000 fine for failing to report the infamous breach that affected over 50 million Uber customer and driver records. Sullivan’s lawyers had advised him to remain silent despite what Sullivan claims were false accusations by the media that he covered up the breach. With the matter now settled, Sullivan is speaking out after six years of silence. Sullivan said people don’t realize that he and his team followed their internal incident playbook, engaging legal counsel, public relations and Uber’s CEO. Sullivan does admit that he made the mistake of not engaging third-party investigators and counsel to validate their internal handling of the incident. Sullivan plans to share his story in a keynote address at Black Hat Europe 2023 on December 7.
OpenAI’s chatbots leak secrets
With all the drama with OpenAI’s leadership, it’s easy to forget that less than a month ago, they announced availability for customer GPT chatbots, trained on unique datasets for more customized responses. Wired’s Matt Burgess found several security researcher able to download these source files and obtain system prompts using prompt injections on the chatbots. According to Adversa AI CEO Alex Plyakov, these prompts required low sophistication, needing only “basic proficiency in English.” Northwestern University researcher Jiahao Yu said they found a 100% success rate in obtaining files from custom GPTs tested.
(Wired)
Security sector: US Nuclear lab breach
The Idaho National Laboratory, a nuclear research lab, has allegedly been breached by SiegedSec which claims to be in possession of PII belonging to users, employees, and citizens. According to Cyberscoop, “The scientists at INL work on some of the United States’ most sensitive national security programs, including protecting critical infrastructure like the U.S. power grid from cyber and physical attacks. Personal data such as detailed employee and banking information would represent a treasure trove for foreign intelligence agencies looking to penetrate the lab.”
Thanks to today’s episode sponsor, SpyCloud
ID theft service resold by cybercriminals
According to Krebs On Security, since at least February 2023, a cybercriminal service advertised as JackieChan/USiSLookups allows anyone to look up the SSN or background report on virtually any American. For anywhere between $8 to $40 in virtual currency, a bot will return detailed consumer background reports in just a few moments. The service’s Telegram channel features sample background reports, including that of President Joe Biden, and podcaster Joe Rogan. Report data includes the subject’s date of birth, addresses, phone numbers, employers, known relatives and associates, and driver’s license information. JackieChan abuses the name and trademarks of Columbus, OH based data broker, USinfoSearch, whose website says it provides risk management, identity and fraud prevention services.
International AI agreement
The international community didn’t take a long Thanksgiving weekend. On November 26th, 18 countries, including the US, UK, Germany, Estonia, Israel, and Australia, released an international agreement pushing for the private development of “secure by design” AI systems. While non-binding, the 20-page agreement provides general recommendations, like monitoring AI systems for signs of abuse, vetting the software supply chain feeding their infrastructure, and protecting underlying data sets. It does not address how AI data sets are composed or gathered.
(Reuters)
ALPHV hits the Fortune 500
Yesterday on the show, we mentioned Fidelity National Financial disclosed a cyberattack to the SEC earlier this month. Subsequently the ALPHV ransomware group took credit for the attack. No word on what specifically the group accessed, with Fidelity only saying it accessed certain company systems and “acquired certain credentials.” The group also took credit for an attack on the healthcare company Henry Schein, resulting in the company taking down some apps and its e-commerce platform. This marks the second attack by the group against the company in a little over a month, initially hitting it on October 15th. It claims it stole over 35 terabytes of sensitive data.
(Bleeping Computer, The Record)
Ex-Motorola employee confesses to phishing scam
A cautionary tale from Graham Cluley at Tripwire about a New Hampshire man who has pleaded guilty to charges after having successfully tricked staff of his past employer – Motorola – to provide him with their login credentials to help him with a “task awaiting approval.” His phishing emails got them to click on a link to a site that asked them to provide this information. He also sent an SMS message to a Motorola employee asking for, and receiving, their MFA code. After his arrest he attempted to order a false passport, even writing to New Hampshire Senator Maggie Hassan asking that his application be expedited. That stunt might add 10 years to the potential 20 years for the Motorola hack.
(Tripwire)