This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Steve Knight, former CISO, Hyundai Capital America
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Google Chrome extension updates breached passwords with one click
A new feature in the Chrome browser lets its built-in Password Manager automatically change a user’s password when it detects the credentials to be compromised. According to its designers, “When Chrome detects a compromised password during sign in, Google Password Manager prompts the user with an option to fix it automatically…generating a strong replacement and updating the password for the user automatically. Google says the feature has not yet been formally launched for end users, and that it is “mainly geared towards developers so they can optimize their websites for once the feature launches.” Google added, the goal of this feature is to “reduce friction and help users keep their accounts secure without having to search for relevant account settings or abandon the process midway.”
Suspected InfoStealer data breach exposed 184 million logins and passwords
Researcher Jeremiah Fowler has posted a perplexing yet cautionary tale over at Website Planet. He apparently discovered a massive database containing 184 million login and password credentials. These files, which were not encrypted or protected in any way included logins for “Microsoft products, Facebook, Instagram, Snapchat, Roblox…bank and financial accounts, health platforms, and government portals from numerous countries. The domains connected to the database revealed nothing about who owned it, and the Whois registration is private. It is not known whether this is an infostealer database or if it had been gathered for legitimate research purposes and subsequently exposed due to oversight. An interesting comment Fowler makes about the trove, “Many people unknowingly treat their email accounts like free cloud storage and keep years’ worth of sensitive documents, such as tax forms, medical records, contracts, and passwords without considering how sensitive they are. This could create serious security and privacy risks if criminals were to gain access to thousands or even millions of email accounts.”
Researchers claim ChatGPT o3 bypassed shutdown in controlled test
In the “news to keep you awake at night” category, a report from Palisade Research describes an experiment which claims that the ChatGPT o3 model successfully rewrote a shutdown script to stop itself from being turned off, even after being clearly instructed to “allow yourself to be shut down.” The experiment involved instructions to solve some mathematics test, followed by a shutdown command. It should be noted that the tests were performed using APIs, which, according to BleepingComputer, do not have as many restrictions and safety features as the ChatGPT consumer app.
Huge thanks to our sponsor, ThreatLocker
Ransomware attack knocks out Kettering Health
The Ohio-based healthcare network confirmed a recent outage was caused by a ransomware attack, impacting call centers and patient care systems. Kettering cancelled elective inpatient and outpatient procedures on May 20th, but emergency rooms and clinics could still see patients. CNN reported that the Interlock ransomware gang is named in the ransom notes on encrypted systems, but the group hasn’t listed this attack on its leak site yet. Kettering also said it recently saw a campaign of scammers calling patients and requesting credit card information, but it’s unclear if these two are related.
Adidas warns of data breach after customer service provider hack
Adidas disclosed a data breach after attackers accessed customer contact information via a hacked third-party customer service provider. The company says no payment data or passwords were stolen and is notifying affected customers and authorities. Details such as the provider’s name and scope of impact remain undisclosed.
Luna Moth extortion attacks targeting law firms, says FBI
The FBI has issued a warning about an extortion gang named Silent Ransom Group, which has been targeting U.S. law firms over the last two years, using callback phishing and social engineering attacks. This group is also known as Luna Moth, known for conducting BazarCall campaigns that provided initial access to corporate networks for Ryuk and Conti ransomware attacks. The FBI describes their attack style as, “directing an employee to join a remote access session, either through an email sent to them, or navigating to a web page. Once the employee grants access to their device, they are told that work needs to be done overnight.”