This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Christina Shannon, CIO, KIK Consumer Products
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
GitHub comments abused to push malware via Microsoft repo URLs
The Redline stealer story brings to light the issue of the GitHub flaw that was abused by the threat actors behind RedLine. According to BleepingComputer, the use of the Microsoft GitHub repository makes the files appear trustworthy and the flaw itself “could be abused with any public repository on GitHub, allowing threat actors to create very convincing lures.” Their research shows that the malware zip files are uploaded as part of a comment left on a commit or issue in the project. “When leaving a comment, a GitHub user can attach a file. Instead of generating the URL after a comment is posted, GitHub automatically generates the download link which allows threat actors to attach their malware to any repository without them knowing.”
The art of penetrating a business without touching the endpoint
Experts from Push Security are presenting detailed information in The Hacker News about the practice of “networkless” attack techniques targeting cloud apps and identities. Describing them as the new perimeter, the article describes techniques such as Adversary-in-the-Middle AiTM phishing, Instant Messaging IM phishing, SAMLjacking is where an attacker makes use of SAML SSO (Security Assertion Markup Language), and Oktajacking, in which an attacker can set-up their own Okta tenant to be used in highly convincing phishing attacks. A link to the report is available in the show notes to this episode.
Cops may soon use AI to generate reports from body cams
Taser maker and police contractor, Axon, has announced a new product called “Draft One,” which leverages OpenAI’s GPT-4 large language model to generate police reports from body cam audio. Critics are quick to point out that this use of AI could potentially lead to baseless accusations due to “hallucination” and further institutional ills like racial bias. Further, because police aren’t AI experts, they may not be well positioned to spot issues with AI outputs. Axon asserts that it has adjusted the AI model to ensure it can’t go off the rails. Axon’s CEO, Rick Smith, points out, “If an officer spends half their day reporting, and we can cut that in half, we have an opportunity to potentially free up 25 percent of an officer’s time to be back out policing.”
Thanks to today’s episode sponsor, Veracode
Get ready to experience the future of application security at RSAC 2024 with Veracode. Join us as we unveil cutting-edge innovations and insights to tackle today’s most pressing security challenges. From live demos showcasing our newest products to engaging discussions with industry experts. See you at RSAC!
Russian hackers claim cyberattack on Indiana water plant
Over the weekend, the threat actor known as the Cyber Army of Russia posted a video on its Telegram channel showing how they hacked systems of the Tipton Wastewater Treatment Plant. Tipton provides the city of Tipton and surrounding areas with electric power, water, and wastewater collection and treatment. An Indiana official confirmed that the plant suffered a cyberattack on Friday evening. Tipton’s general manager, Jim Ankrum, said, “TMU experienced minimal disruption and remained operational at all times.” Security research firm Mandiant recently reported that the Cyber Army of Russia has ties to the Russian state actor, Sandworm, which was responsible for a separate attack on a water facility in Muleshoe, Texas that caused a tank to overflow.
New research discovers vulnerability in archived Apache project
A vulnerability has been uncovered in an archived Apache project called “Cordova App Harness,” that could lead to software supply chain attacks. Attackers could use techniques such as Typosquatting, RepoJacking, and dependency confusion to insert vulnerable dependencies in open-source software. Ultimately, the issue could lead to execution of arbitrary code on the host machine where the vulnerable application is deployed. Researchers highlight the risk associated with dependencies on archived open-source projects that may not receive regular security updates. They recommend conducting regular code security scans, avoiding use of deprecated projects, following best practices for configuring dependencies, and providing security education to developers.
Threat actors plant fake assassination story
The Czech News Agency, CTK, reports that an unidentified threat actor accessed its website to publish a fake story. The story claimed that Slovakia’s Security Information Service prevented an assassination attempt against newly elected Slovak president Peter Pellegrini by Ukrainian nationals. The faked story was published in English and Czech but did not get distribution to CTK’s clients. Researchers at Mandiant previously tied similar spoofed new stories to the Belarusian-affiliated threat group Ghostwriter, but no indication so far of their involvement here.
Chinese keyboard app flaws exposed
Last year, researchers at Citizen Lab found that the popular Sogou Chinese keyboard app failed to use TLS when sending keystroke data to the cloud for typing predictions. This opens the door to potential spying on typed content. In a follow up, the researchers discovered that virtually all Chinese keyboard mobile apps had the same flaw. The researchers found a lack of TLS in apps from Baidu, Tencent, and iFlytek, as well as ones preinstalled on Android devices sold in China. The only device tested without the flaw was one preinstalled on a Huawei device. The researchers say the ease of exploiting this flaw likely means its been exploited at scale in the wild. The researchers contracted the app developers, with the majority fixing the issue before publication, although its unclear if preinstalled Android apps would receive an update.