Security News w/ Ed Skoudis – PSW #676
Ed Skoudis returns to talk to us about the Holiday Hack Challenge! Then, in the Security News, Thousands of unsecured medical records were exposed online, Advanced Persistent Threat Actors Targeting U.S. Think Tanks, WarGames for real: How one 1983 exercise nearly triggered WWIII , The Supreme Court will hear its first big CFAA case, TrickBoot feature allows TrickBot to run UEFI attacks, and Cyber Command deployed personnel to Estonia to protect elections against Russian threat!
Announcements
SCYTHE is offering a FREE purple team workshop where attendees get hands-on in an isolated enterprise environment for three hours! It is scheduled for December 9th (the day before Security Weekly Unlocked!) Register for this free workshop now: https://securityweekly.com/purpleteamsw
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Guest
Ed Skoudis has taught cyber incident response and advanced penetration testing techniques to more than 12,000 cybersecurity professionals. He is a SANS Faculty Fellow and the lead for the SANS Penetration Testing Curriculum. His courses distill the essence of real-world, front-line case studies he accumulates because he is consistently one of the first experts brought in to provide after-attack analysis on major breaches where credit card and other sensitive financial data is lost.
Hosts
- 1. COVID-19 and Cybersecurity: ‘Catastrophic Attack on Our Technology Systems’Ransomware attacks shut down school systems in Baltimore and Chicago.
- 2. The ‘smartest man in the room’ has joined Sidney Powell’s teamSomeone sent me this link and asked me if the guy is a big deal in our industry...I think this is fake news! But how can you be reasonably sure?
- 1. Thousands of unsecured medical records were exposed online
- 2. An iOS zero-click radio proximity exploit odyssey
- 3. Call Fraud Operator Ordered to Pay $9M to Victims
- 4. Evilginx-ing into the cloud: How we detected a red team attack in AWS – Expel
- 5. Hackers are trying to disrupt the COVID-19 vaccine supply chain
- 1. Carrefour Handed $3.7m GDPR FineFrance-based retailer Carrefour and its banking division have been fined more than €3 million EUR (~$3.6 million USD) by the French Commission nationale de l’informatique et des libertés (CNIL) for multiple data breaches that violated the EU's GDPR.
- 2. Talos reported WebKit flaws in WebKit that allow Remote Code ExecutionTalos experts found flaws in the WebKit browser engine that can be also exploited for remote code execution via specially crafted websites. Consider this medium-risk due to the potential to execute arbitrary code, offset by the user interaction required for exploitation.
- 3. Palo Alto researchers said Baidu apps could have tracked users ‘over their lifetime’According to Palo Alto Networks, the Baidu apps were collecting user data such as MAC addresses, carrier information, and IMSI numbers stored on SIM cards from victims' phones.
- 4. This critical software flaw is now being used to break into networks – so update fastThe U.K.'s National Cyber Security Centre (NCSC) has issued a warning about a critical remote code execution vulnerability (CVE-2020-15505) affecting the MobileIron mobile device management (MDM) software that is reportedly being used by state-backed hackers and organized crime groups to access and steal data from government, healthcare provider, and other networks.
- 5. Advanced Persistent Threat Actors Targeting U.S. Think Tanks
- 6. Vietnam-Linked Cyberspies Use New macOS Backdoor in AttacksTrend Micro’s security researchers say they believe the Vietnamese advanced persistent threat (APT) group "OceanLotus" (APT-C-00, APT32) has been leveraging a new macOS backdoor in attacks designed to steal sensitive data from government and corporate organizations throughout Southeast Asia.
- 7. Industrial computer manufacturer Advantech hit with a ransomware attack – SiliconANGLEAdvantech received a ransom demand for 750 Bitcoin ($13.8 million), but publication of stolen data by Conti operators indicates that the company has at least so far refused to make the payment.
- 8. Digitally Signed Bandook Malware Once Again Targets Multiple SectorsThe "Dark Caracal" cyber espionage group, which is suspected to have ties to the Kazakh and Lebanese governments, has been spotted leveraging a re-tooled version of the 13-year-old "Bandook" Windows Trojan, also known as HAIRBALL, in attacks targeting various sectors in Chile, Cyprus, Germany, Indonesia, Italy, Singapore, Switzerland, Turkey, and the U.S.
- 9. iPhone zero-click Wi-Fi exploit is one of the most breathtaking hacks everReally cool hack. Be sure to read the linked white paper from Ian Beer.
