Recent Cybersecurity Issues In The News - mccright/FCCSCybersecurityInput GitHub Wiki

Some relatively-random cybersecurity incidents as an introduction

(use 'current' incidents... and there should be no trouble finding 'current' incidents whenever the session is presented):

“They pretty much have full access to Uber,” said Sam Curry, a security engineer at Yuga Labs who corresponded with the person who claimed to be responsible for the breach. “This is a total compromise, from what it looks like.”

  • In early August 2022, Check Point Software detected "supply-chain attacks" that used 10 malicious packages on PyPI (The Python Package Index). PyPI is a repository of software components for the Python programming language (pypi.org indicates that it had 615,673 active users on 2002-08-17). Most Python developers are familiar with the 'pip install' to download the Python components they need for any given application. Following responsible disclosure by Check Point, PyPI removed the following Python packages:

    1. ascii2text -- executed a hostile script that identified local passwords and then uploaded them.
    2. Pyg-utils -- harvested users' AWS credentials
    3. Pymocks -- harvested users' AWS credentials
    4. PyProto2 -- harvested users' AWS credentials
    5. Test-async -- executed "probably malicious code"
    6. Free-net-vpn -- harvested the user's credentials
    7. Free-net-vpn2 -- harvested the user's credentials
    8. Zlibsrc -- downloaded and ran a malicious file
    9. Browserdiv -- stole the installers credentials
    10. WINRPCexploit -- harvested the user's credentials

  • In late July 2022, Anurag Sen, @hak1mlukha and TechCrunch, Zack Whittaker reported that JusTalk and JusTalk Kids (owned/operated by Ningbo Jus/Juphoon) exposed what appeared to be all user mobile phone numbers (and JusTalk 2nd Phone Numbers), IP addresses, physical location, and message content via a rolling, 30-day, clear text log of all user interactions (hundreds of GB of data for months, at least since Jan 2022). JusTalk has around 20 million international users, and JusTalk Kids has over 1 million Android downloads so the data exposure is material. Despite that long-running data exposure JusTalk asserts end-to-end encryption -- In late July 2022 JusTalk still assures current, future, and past users that their data is safe:

"Secure Data Encryption: Rest assured your calls and messages are secured. Only you and the person you communicate with can see, read, or listen to them: even the JusTalk team won't access your data!" Quote viewed on justalk.com/ on 2022-07-27.

  • In early July 2022 cybersecurity giant Entrust -- which describes itself as a global leader in identities, payments and data protection -- announced to its customers that it had a breach on June 18th allowing an unauthorized party to access its internal operations. Entrust says its customers include 10,000 companies so the exposure could be material. See the Okta incident below for another example of a security incident at a top-tier security organization.

  • In May 2022 popular Python and PHP libraries were hijacked to steal AWS keys, credentials, and other sensitive information. Ax Sharma reported that the PyPI module 'ctx' -- downloaded over 20,000 times a week -- had been compromised in a software supply chain attack. The threat actor replaced the older, safe versions of 'ctx' with code that exfiltrates data to the Heroku endpoint: https://anti-theft-web.herokuapp[.]com/hacked. The malicious versions stole the developer's/the system's environment variables to collect secrets like Amazon AWS keys and credentials. Similarly, widely used versions of a 'phpass' fork published to the PHP/Composer package repository Packagist was altered to steal secrets in a similar fashion. Later Sharma wrote that "the hijacker of these libraries is an Istanbul-based security researcher, Yunus Aydın aka SockPuppets, who has attested to the fact when approached by BleepingComputer. He claims his rationale for stealing AWS tokens was to demonstrate the 'maximum impact' of the exploit." Because it involved actual theft of other's identities and secrets, this seems unethical and possibly an inaccurate description of Mr. Aydin's activities. The attacker used automation to seek out components owned by users with expired domains, then he took over an expired domain, re-created the maintainer's email address, and brute forced the credentials for an associated github repository (i.e. repo-jacking).

  • Sultan Qasim Khan, principal security consultant at the security firm NCC Group recently (announced 2022-05-16) demonstrated how to unlock keyless entry, start and drive away on Tesla Model 3 and Y cars. They accomplish this by redirecting communications between a car owner’s mobile phone, or key fob, and the targeted car, hostile parties can trick the keyless entry system into believing the owner is located physically near the vehicle (and therefore trusted). Tesla and other vendor's engineers, architects, and developers appear to have trusted Bluetooth Low Energy (BLE) communications because they wrongly assumed that it would come from the authorized client device and that the device was nearby and in the hands of an authorized party. NCC Group researchers showed that this trust was misplaced and that the vendor's did not invest enough in resisting relatively simplistic abuse cases. In reality, using this relay model

"An attacker could walk up to any home at night – if the owner's phone is at home - with a Bluetooth passive entry car parked outside and use this attack to unlock and start the car (and) once the device is in place near the fob or phone, the attacker can send commands from anywhere in the world."

The bullets below are from the original presentation in the summer of 2019. The bullets above are more recent additions...

'Cybersecurity' - What is it?

Discuss the breadth of this topic: https://en.wikipedia.org/wiki/Computer_security and https://en.wikipedia.org/wiki/Category:Computer_security

RESOURCES