This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guests David Cross, CISO, Atlassian, and davidcrosstravels.com, and Montez Fitzpatrick, CISO, Navvis
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
DNS race condition brought AWS to a crawl last Monday
Following up on Monday’s AWS outage, Amazon has now released a report on the day-long outage. At the time we reported that the cause was a DNS failure in AWS’s critical US-East-1 region. The cause of that DNS failure has now been revealed as “a race condition in DynamoDB’s automated DNS management system that left an empty DNS record for the service’s regional endpoint,” This was triggered, the company says, “by a latent defect within the service’s automated DNS management system.” As described in The Register, “the DropletWorkflow Manager (DWFM), which maintains leases for physical servers hosting EC2 instances, depends on DynamoDB. When DNS failures caused DWFM state checks to fail, droplets – the EC2 servers – couldn’t establish new leases for instance state changes.” Amazon has apologized for the incident.
China accuses NSA of hacking national time center
China has accused the U.S. National Security Agency (NSA) of carrying out cyberattacks on its National Time Service Center, claiming the attacks exploited messaging service vulnerabilities and 42 types of “special cyberattack weapons” between 2022 and 2024. The center maintains and distributes China’s official standard time, which supports critical systems like communications, financial networks, power grids, transport, and defense, meaning any disruption could have widespread consequences. The U.S. has not responded to the allegations.
Deep Tech work culture pushes for 72 hour workweeks
The pace and intensity of development and growth in tech sectors responsible for AI, semiconductors and quantum computing has resulted in many companies eyeing an extended work culture to keep up. An article in Wired describes the spread of the 996 work culture, already established in China, in which employees are expected to work 9 am to 9 pm, six days a week, thus creating a 72-hour work week. As the article states, “many startups in the U.S. are asking prospective employees if they are willing to commit, and to get the job, the answer needs to be an unequivocal yes.” A link to the article is available in the shownotes to this episode.
(Wired)
Huge thanks to our sponsor, ThreatLocker
Hundreds of thousands remain exposed in F5 breach
A follow up to a story we first reported last week. More than 262,000 F5 BIG-IP devices remain exposed online after the company confirmed a breach by nation-state hackers. The attackers stole source code and data after gaining access to F5’s BIG-IP development and engineering systems. F5 said there were no signs of compromise in its financial, cloud, or CRM systems, and only limited customer configuration data was taken. The breach has been privately linked to the China-based threat group UNC5221 which was found to be active in the network for at least a year.
Laser auto cyberattacks emerge
Researchers at France’s Alternative Energies and Atomic Energy Commission (CEA) and semiconductor firm Soitec have developed a new chip architecture called Fully Depleted Silicon-on-Insulator to defend against laser fault injection attacks targeting automotive microcontrollers. The design adds an insulating oxide layer that makes it harder to manipulate circuits with focused laser beams, including attacks that can flip bits or bypass authentication. It also improves cost efficiency and helps automakers meet global cybersecurity standards.
Meta launches anti-scam tools for WhatsApp and Messenger
Meta introduced new anti-scam features for WhatsApp and Messenger to help protect users from fraud. Messenger is testing AI-powered scam detection that flags suspicious chats and suggests actions like blocking or reporting senders. WhatsApp now warns users not to share their screens with unknown contacts and adds context when being added to new groups. Meta says it’s disabled nearly 8 million scam-linked accounts this year and removed 21,000 fake support pages.
Increased use of AI in extortion and ransomware cyberattacks, says Microsoft
Following up on a story we covered on Friday’s Cyber Security Headlines as well in a great discussion in the Week In Review show, Microsoft’s annual Digital Threats Report shows that in addition to the proliferation of password attacks, that AI is increasingly being used by threat actors to boost their power, by “automating phishing, scaling social engineering, creating synthetic media, finding vulnerabilities faster, and creating malware that can adapt itself.” The report also adds that defenders are also increasing their usage of AI to “spot threats, close detection gaps, catch phishing attempts, and protect vulnerable users.” A link to the report is available in the show notes to this episode.
Multiple CISA divisions targeted in shutdown layoffs, people familiar say
“Several divisions in the Cybersecurity and Infrastructure Security Agency were affected in termination orders issued to the federal workforce on Friday evening, multiple people familiar told Nextgov/FCW.
Staff within the Stakeholder Engagement Division, as well as the cyber-defense agency’s Infrastructure Security Division, were targeted with reduction-in-force notices, or RIFs, said the people. OMB Director Russ Vought announced the actions on Friday in line with Trump administration promises to enact layoffs during the ongoing government shutdown.
The Integrated Operations Division is also believed to have been impacted, one of the people said. All sources in this story spoke on the condition of anonymity.”
(NextGov)