19.05.2023
NEWS:
Inactive Google accounts will be deleted
A week after Twitter announced it will be removing idle accounts after 30 days of inaction, Google has updated its account inactivity policy. Google says that the updated policy is effective immediately, but that it will start deleting accounts that haven’t been active for at least 2 years only later this year.
Malware turns home routers into proxies for Chinese state-sponsored hackers
Researchers on Tuesday unveiled a major discovery—malicious firmware that can wrangle a wide range of residential and small office routers into a network that stealthily relays traffic to command-and-control servers maintained by Chinese state-sponsored hackers. A firmware implant, revealed in a write-up from Check Point Research, contains a full-featured backdoor that allows attackers to establish communications and file transfers with infected devices, remotely issue commands, and upload, download, and delete files.
Ukraine officially joins NATO’s cyber defence centre
In its message, the ministry thanked CCDCOE members for inviting Ukraine and expressed gratitude to the Estonian government for its support of Kyiv’s path to joining the organization. “Today the National Flag of Ukraine is officially raised at the Headquarters of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, marking official accession of Ukraine to CCDCOE,” the ministry said. Ukraine submitted a request to join CCDCOE in August 2021, prior to Russia’s full-scale invasion of the country. In March 2022, Ukraine became a “contributing participant” at CCDCOE.
https://news.yahoo.com/ukraine-officially-joins-nato-cyber-181300349.html
OpenAI chief concerned about AI being used to compromise elections
WASHINGTON, May 16 (Reuters) – The CEO of OpenAI, the startup behind ChatGPT, told a Senate panel on Tuesday the use of artificial intelligence to interfere with election integrity is a “significant area of concern”, adding that it needs regulation. “I am nervous about it,” CEO Sam Altman said about elections and AI, adding rules and guidelines are needed. For months, companies large and small have raced to bring increasingly versatile AI to market, throwing endless data and billions of dollars at the challenge. Some critics fear the technology will exacerbate societal harms, among them prejudice and misinformation, while others warn AI could end humanity itself.
Microsoft is scanning the inside of password-protected zip files for malware
Microsoft cloud services are scanning for malware by peeking inside users’ zip files, even when they’re protected by a password, several users reported on Mastodon on Monday. Compressing file contents into archived zip files has long been a tactic threat actors use to conceal malware spreading through email or downloads. Eventually, some threat actors adapted by protecting their malicious zip files with a password the end user must type when converting the file back to its original form. Microsoft is one-upping this move by attempting to bypass password protection in zip files and, when successful, scanning them for malicious code.
INCIDENTS:
Britain’s largest private pension scheme reveals scale of Capita break-in
Universities Superannuation Scheme, the UK’s largest private pension provider, says Capita has warned that details of almost half a million members were held on servers accessed during the recent breach. The USS made the disclosure today, saying that it uses Capita technology platform, Hartlink, to manage in- house pension administration processes, and was working closely with the scandal struck Capita since the digital burglary in March. The data potentially accessed includes title, initials and name, date of birth, National Insurance number and US member number. It dates from early 2021 and covers “around 470,000 active, deferred and retired members.”
https://www.theregister.com/2023/05/12/uks_largest_private_pension_scheme/
Toyota: Data on More Than 2 Million Vehicles in Japan Were at Risk in Decade-Long Breach
A decade-long data breach in Toyota’s much-touted online service put some information on more than 2 million vehicles at risk, the Japanese automaker said Friday. Spanning from January 2012 to April 2023, the problem with Toyota’s cloud-based Connected service pertains only to vehicles in Japan, said spokesperson Hideaki Homma. The Connected service reminds owners to get maintenance checks and links to streaming entertainment and provides help during emergencies. It can call for help after a crash or locate a car that’s been stolen. No issues arising from the breach have been reported so far.
MALWARE:
PoC Tool Exploits Unpatched KeePass Vulnerability to Retrieve Master Passwords
A researcher has published a proof-of-concept (PoC) tool that exploits an unpatched KeePass vulnerability to retrieve the master password from the program’s memory. An open source password manager primarily designed for Windows, KeePass can also be used on macOS and Linux, through the open source .NET- compatible framework Mono. Tracked as CVE-2023-32784, the issue impacts KeePass 2.x versions and allows an attacker to retrieve the cleartext master password from a memory dump. The flaw is exploitable even on workspaces that have been locked or are no longer running.
Cybercrime gang pre-infects millions of Android devices with malware
A large cybercrime enterprise tracked as the “Lemon Group” has reportedly pre-installed malware known as ‘Guerilla’ on almost 9 million Android-based smartphones, watches, TVs, and TV boxes. The threat actors use Guerilla to load additional payloads, intercept one-time passwords from SMS, set up a reverse proxy from the infected device, hijack WhatsApp sessions, and more.
VULNERABILITIES:
Apple released security updates to address three zero-day vulnerabilities in iPhones, Macs, and iPads that are actively exploited in attacks.
The three vulnerabilities, tracked as CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373, reside in the WebKit browser engine. Below are the details of the three issues: CVE-2023-32409 – A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited. The flaw was reported by Clément Lecigne of Google’s Threat Analysis Group and Donncha Ó Cearbhaill of Amnesty International’s Security Lab. Despite Apple did not provide details about the attacks, the three issues were likely exploited in attacks conducted by nation-state actors or by surveillance firms.
Cisco warns of critical switch bugs with public exploit code
Cisco warned customers today of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches.
All four security flaws received almost maximum severity ratings with CVSS base scores of 9.8/10. Successful exploitation allows unauthenticated attackers to execute arbitrary code with root privileges on compromised devices.
Update now! Ruckus vulnerability added to CISA’s list of actively exploited bugs
Along with six older vulnerabilities, the Cybersecurity and Infrastructure Agency (CISA) has added a vulnerability in multiple Ruckus wireless products to the Known Exploited Vulnerabilities Catalog. This means that Federal Civilian Executive Branch (FCEB) agencies need to remediate these vulnerabilities by June 2, 2023.
Cyber4Dev collates data from Open-Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
