In today’s cybersecurity news…
ShinyHunters hits Madison Square Garden
The infamous hacking group made an on June 12 that it had hacked Madison Square Garden data, and then threatened to expose more than 26 million records if no ransom was paid. It followed through on this threat four days later, exposing customer records, internal emails, celebrity contacts, and corporate data. According to the New York Times, multiple class action lawsuits have now been filed against the company.
(Security Magazine and The New York Times)
Cal Water finds no evidence of OT activity
Following up on a story we covered last week, the California Water Service (Cal Water) has now confirmed that it has found no evidence of activity in the water utility’s operational technology (OT) environment, following a claim made by Handala, a group believed to be a front for Iranian government hacking operations. In a statement to SecurityWeek, Cal Water said, “based on its investigation, Mandiant has confirmed that the threat actor activity was limited to unauthorized access to a small number of specific user accounts within two third-party service provider platforms.”
New CISA guide helps agencies adopt SASE for Zero Trust
This new guidance is intended to “help federal agencies replace their legacy internet gateways with Secure Access Service Edge (SASE) technology as part of the shift to zero trust.” The guide, published Wednesday, “explains how agencies can use SASE to move from the perimeter-based Trusted Internet Connections (TIC) 2.0 model to the more flexible TIC 3.0, which CISA built around zero trust principles. The goal is to reduce bottlenecks and to bundle networking and security functions into a single, mostly cloud-based service. The guidance is vendor-agnostic, focusing on the architecture rather than specific products.
IBM ‘block of flats’ design hailed as breakthrough for ultra tiny chips
This new chip design could “enable manufacturers to cram 100 billion transistors on a silicon chip the size of a fingernail.” This is based on IBM’s new chip design, which measures 0.7nm. For some context, a nanometer is one billionth of a meter or the size of a few atoms. The current industry-standard size for chips, is around two nanometers (nm). IBM says it will be several years before this new chip technology could go into production, however it says that its prototype “performed 50% better than its own 2nm chip and was 70% more energy efficient.”
(BBC News)
Huge thanks to our sponsor, Guardsquare
Indian auto giant Bajaj Auto suffers ransomware incident
The attack affected its operations and those of Bajaj Auto Technology Limited, a subsidiary focused on technology development, engineering and research. Company authorities became aware of the incident on Tuesday morning. They have not disclosed the identity of the threat actor behind the attack, whether any data was stolen or whether the attackers had issued a ransom demand. “Bajaj Auto is one of India’s largest vehicle manufacturers, producing motorcycles, scooters and commercial vehicles. The company is also the world’s largest manufacturer of three-wheelers, commonly known as auto-rickshaws.”
Malicious Edge extension abuses Native Messaging as bridge to malware
Dubbed Edgecution, this extension has already been used in a ransomware attack. Its tactic is to escape the browser sandbox and deploy a Python-based backdoor. It does this by “leveraging the Chrome Native Messaging protocol that allows browser extensions to interact with native desktop applications, such as a password manager communicating with the extension to fill in web forms.” An Edgecution compromise “begins with the attacker posing as IT support personnel on Microsoft Teams and directing employees to a fraudulent page under the pretense of installing a spam filter update.” Researchers at Zscaler believe that the Edgecution campaign is being deployed by “an initial access broker (IAB) connected to the Payouts Kings ransomware operation.”
Squidbleed, a 29-year old memory leak, discovered
A security researcher and Mythos Preview found the flaw and reported it to project maintainers, who fixed the code earlier this month. It is a Heartbleed-style vulnerability in Squid, which is a popular open-source caching proxy server used by large corporations, schools, and internet service providers. For almost three decades it has “silently leaked users’ plaintext HTTP requests and potentially revealed sensitive data, including credentials and session tokens.” Calif.io researcher Lam Jun Rong said he came across the open source proxy while attempting to connect to the internet on a flight.
Gaslight macOS malware uses prompt injection to disrupt AI-assisted analysis
“This previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst’s artificial intelligence (AI) tools and trick it into aborting or refusing an analysis of the artifact.” It has been codenamed Gaslight owing to this deceptive behavior, and is believed to be the work of North Korea-aligned threat actors. SentinelOne researcher Phil Stokes said in a technical report, “Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session.” “It attacks the agent’s perception, rather than the sandbox it runs in.”