This week’s Cyber Security Headlines – Week in Review is hosted by David Spark with guest Steve Gentry, Advisor, Clari
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Classified Five Eyes data theft announced
A threat actor going by the name of IntelBroker is claiming to be in possession of documents belonging to the Five Eyes Intelligence Group. According to a post made by the group on a darkweb forum, the data stolen allegedly includes “full names, government and military email addresses, office and personal phone numbers, and classified information and communications between the Five Eyes, 14 Eyes and U.S. allies.” The group states that they breached a Virginia-based federal technology consultancy named Acuity Inc., which works directly with the U.S. government and its allies, and which claims to have “deep expertise” in areas such as IT modernization, DevSecOps, cybersecurity, data analytics, and operations support.
Report criticizes Microsoft’s Chinese hack response
The Washington Post obtained early access to a report from the Cyber Safety Review Board on a breach of Microsoft Exchange Online by Chinese threat actors. We’ve covered the specifics of the attack previously so I’ll spare the specifics. But the report concluded the attack “should never have occurred” and found Microsoft’s “security culture was inadequate and requires an overhaul.” The board chided Microsoft’s inconsistent public messaging, which lagged for months with inaccurate statements referring to the attack as a “crash dump,” only updating public statements on March 12th. The report found Microsoft still remains unsure what led to the breach. The report also found failure with Mcirosot key rotation system, maintaining signing keys that operated across business and consumer networks, and failures with employee offboarding.
(WaPo)
Data of 73 million AT&T customers leaked on dark web
On Saturday, AT&T said that data on roughly 73 million current and former customers was exposed on the dark web, including social security numbers and other personal information. The data appears to be from 2019 or earlier. Interestingly, AT&T disclosed the news on Easter holiday weekend, though data that surfaced on the dark web roughly two weeks ago. AT&T said a “robust investigation” is underway but so far they have no evidence of unauthorized access to their systems.
Huge thanks to our sponsor, Vanta
With Vanta, you can automate compliance for in-demand frameworks like SOC 2, ISO 27001, and HIPAA.
Even more, Vanta’s market-leading Trust Management Platform enables you to unify security program management with a built-in risk register and reporting, and streamline security reviews with AI-powered security questionnaires.
Over 7,000 fast-growing companies like Atlassian, Flo Health, and Quora use Vanta to manage risk and prove security in real time.
Watch Vanta’s on-demand demo at vanta.com/ciso.
CISA releases draft rule for cyber incident reporting
Considered to be one of the most significant cybersecurity policy reforms in recent memory, CISA has released its notice of proposed rulemaking (NOPR) that requires critical infrastructure organizations to report cybersecurity incidents. This is intended to provide the federal government with “better insight about breaches that affect highly sensitive entities such as water and power utilities.” This NOPR is the next step in a process that began after the Cyber Incident Reporting for Critical Infrastructure Act was signed into law in March 2022, following the SolarWinds ordeal.
Google now blocks spoofed emails for better phishing protection
Google has now started to automatically block emails sent by bulk senders who do not authenticate their messages. This follows an announcement made last October and places a requirement on companies that send over 5,000 messages daily to Gmail accounts to set up email authentications for their domains. Throughout this year, Google will ramp up the pressure on non-compliant bulk email senders, starting with temporary error codes on a small portion of messages that don’t meet the requirements, but ramping up the rejection process. This, Google says, is to give bulk emailers a chance to become compliant.
Poland investigates spyware usage
Poland’s justice minister Adam Badnar announced an investigation into the previous government’s usage of NSO Group’s Pegasus spyware. This will see a full parliamentary inquiry and potential criminal charges. The justice ministry will begin notifying Pegasus targets over the coming months, who are eligible for financial compensation. Last year Citizen Lab reported the Polish government used Pegasus against targets affiliated with the Civic Platform party, then in opposition but now part of the governing coalition. It’s believed Poland stopped using Pegasus in 2021.
Accidental Linux backdoor discovery likely prevented thousands of infections
On Friday, Red Hat issued an urgent security advisory that Linux users should immediately stop using Fedora 41 or Fedora Rawhide. Red Hat said these Linux distributions contain a 10.0 CVSS severity backdoor vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utility. The backdoor was slowly introduced through updates by the alias “Jia Tan”, which is likely not a real name and possibly a group of individuals or even a nation state. A developer named Andres Freund discovered the stealthy backdoor by accident after noticing some odd ssh performance issues and valgrind crashes. Some are saying Freund’s discovery could potentially prevent thousands of infections. The US Cybersecurity and Infrastructure Security Agency (CISA) has advised XZ Utils users to downgrade to an earlier, uncompromised version and hunt for any malicious activity.
(The Hacker News and Dark Reading and The Record and Security Boulevard)