In today’s cybersecurity news…
Haugh fired from leadership of NSA and Cyber Command
As part of the many changes being made by the current administration, Air Force Gen. Timothy Haugh has been removed from his position in these agencies, just a little over a year into a traditionally three-year term. Army Lt. Gen. William Hartman, who had been second in command at Cyber Command, will assume leadership of both organizations in an acting capacity.
WinRAR flaw bypasses Windows Mark of the Web security alerts
This vulnerability, which exists in the WinRAR file archiver solution, could be exploited to bypass the Mark of the Web (MotW) security warning. This issue has a CVE number and affects all WinRAR versions except the most recent release, currently 7.11. Using this exploit, an attacker could execute arbitrary code by using a specially crafted symbolic link, called a symlink, which can be created on Windows only with administrator permissions. The issue has been fixed in the latest WinRAR release.
Researcher creates fake passport using ChatGPT
Polish researcher Borys Musielak used ChatGPT-4o to generate a fake passport in five minutes, suggesting that the document is “realistic enough to bypass automated Know Your Customer (KYC) checks.” Musielak emphasized “the growing risk of mass identity theft for purposes such as fraudulent credit applications or the creation of fictitious accounts…[enabling] malicious actors to mount broad attacks on banking, cryptocurrency, and other financial infrastructures.” Just 16 hours after his announcement ChatGPT modified its prompt rules to no longer generate fake passports.
North Korea deploys BeaverTail malware via npm packages
This is the same group involved with the ongoing Contagious Interview campaign, now using the npm ecosystem to deliver the BeaverTail malware along with a new remote access trojan (RAT) loader. According to researchers at Socket, “these latest samples employ hexadecimal string encoding to evade automated detection systems and manual code audits, signaling a variation in the threat actors’ obfuscation techniques.” This is part of an ongoing attack seeking to infiltrate developer systems under the guise of a job interview process.
Huge thanks to our sponsor, Nudge Security
Start a free 14-day trial
Port of Seattle says 90,000 people impacted in last year’s ransomware attack
Following up on a story we covered last fall, the organization now says about 90,000 people had information accessed by the ransomware hackers who breached the systems of the Port of Seattle last August. The organization runs Seattle-Tacoma International Airport, along with some parks and container terminals. The data accessed includes some basic PII for employees and contractors. Port officials said on Friday it holds “very little information about airport or maritime passengers, and systems processing payments were not affected.”
U.S., Australia, Canada agencies warn of ‘fast flux’ ransomware scheme
According to an advisory published on Thursday by government cybersecurity agencies from all three of these countries, cybercriminals and nation-state actors – especially from Russia – are increasing the use of this technique to rapidly change the Domain Name System (DNS) records associated with a single domain name. This helps hide the locations of malicious servers that are used as command-and-control home bases. It also makes individual computers in a botnet harder to find and block. Although this technique has been around for many years, a number of darknet hosting services are advertising this service more than they used to.
Max severity RCE flaw discovered in Apache Parquet
This flaw impacts all versions of Apache Parquet up to and including 1.15.0. Apache Parquet is an open-source, columnar storage format designed for efficient data processing. It is used by big data platforms like Hadoop, AWS, Amazon, Google, and Azure cloud services, as well as some large companies like Netflix, Uber, Airbnb, and LinkedIn. The issue stems from “the deserialization of untrusted data that could allow attackers with specially crafted Parquet files to gain control of target systems, exfiltrate or modify data, disrupt services, or introduce dangerous payloads such as ransomware…It should be noted that to exploit this flaw, threat actors must convince someone to import a specially crafted Parquet file.”
Australian pension funds hit by wave of credential stuffing attacks
This is being described as a massive wave, according to The Association of Superannuation Funds of Australia (ASFA), which is the country’s advocacy body for the superannuation industry. Its representatives state “a number of members were affected…even though the majority of the attempts were repelled.” According to Reuters, over 20,000 accounts were breached in this wave of attacks with some members reportedly losing some of their savings.