Information Security News 8-12-2024

GPS Spoofers ‘Hack Time’ on Commercial Airlines, Researchers Say

Article link: https://www.reuters.com/technology/cybersecurity/gps-spoofers-hack-time-commercial-airlines-researchers-say-2024-08-10

• As technology advances, so do the tactics of those seeking to exploit it, creating a sense of urgency for the aviation industry to strengthen its defenses against these sophisticated attacks to ensure the safety and reliability of air travel.
• GPS spoofing, which involves broadcasting false GPS signals to deceive aircraft, has dramatically increased, with a rise of 400% in reported incidents, particularly in conflict areas. This type of attack can mislead aircraft navigation system and manipulate onboard time systems, potentially causing serious disruptions.
• This emerging threat has already had a significant impact, as demonstrated by a major Western airline experiencing a malfunction that set its onboard clocks years ahead, resulting in weeks of grounding and manual repairs.
• This issue has real-world consequences, as seen in Finnair’s suspension of flights to Taru, Estonia, due to suspected GPS spoofing linked to regional tensions. Despite not directly causing plane crashes, GPS spoofing poses significant risks to operational disruptions and safety concerns.

US Dismantles Laptop Farm Used by Undercover North Korean IT Workers

Article Link: https://www.bleepingcomputer.com/news/security/us-dismantles-laptop-farm-used-by-undercover-north-korean-it-workers

• The U.S. Justice Department has arrested Matthew Isaac Knoot for helping North Korean IT workers impersonate U.S. employees from a Nashville-based “laptop farm,” allowing them to infiltrate U.S. companies and fund North Korea’s nuclear program.
• Knoot used a stolen U.S. identity and provided housing for laptops, which North Korean workers in China used to access U.S. company networks and cause damage. He faces charges including wire fraud and identity theft, with a potential 20-year prison sentence.
• Knoot’s arrest is part of the “DPRK RevGen: Domestic Enabler Initiative,” launched in March 2024, aimed at targeting U.S.-based operations supporting North Korean hackers and addressing the growing cyber threat.
• This case follows the arrest of Christina Marie Chapman, who was also charged with running a laptop farm for North Korean hackers, highlighting the ongoing issue of North Korean cybercriminals gaining access to U.S. businesses.

#BHUSA: Ransomware Drill Targets Healthcare in Operation 911

Article Link: https://www.infosecurity-magazine.com/news/ransomware-drill-healthcare/?&web_view=true

• In 2024, a ransomware simulation was held at Black Hat USA, targeting the healthcare sector. Conducted by Las Vegas law enforcement, the FBI, and Semperis, the drill focused on a fictitious hospital, Sunshine Healthcare, to prepare for real-life scenarios similar to the Change Healthcare attack, which disrupted prescription services and compromised personal data.
• The exercise demonstrated how attackers could exploit minor security flaws to cause major disruptions, emphasizing the need for rapid decision-making in actual incidents. It also highlighted the challenges healthcare organizations face, as seen in the $22 million ransom paid by United Healthcare.
• Jeff Wichman, the Director of Incident Response at Semperis, advised against direct communication with attackers and recommended using third-party services for investigations to obtain more effective responses.

“0.0.0.0-Day” Vulnerability Affects Chrome, Safari, and Firefox

Article Link: https://www.helpnetsecurity.com/2024/08/09/0-0-0-0-day-vulnerability-affects-chrome-safari-and-firefox/

• The “0.0.0.0-Day” vulnerability found in Chrome, Safari, and Firefox affects macOS and Linux users by allowing attackers to exploit internal network services via the 0.0.0.0 IP address. This flaw can lead to unauthorized access, setting changes, or even remote code execution but does not affect Windows systems.
• To combat this security issue, Google, Apple, and Mozilla are rolling out updates to block the 0.0.0.0 address in future browser versions, aiming to protect users, especially those running local services or development environments.
• Developers are urged to enhance local application security as the number of websites using the 0.0.0.0 address increases, with the estimated 100,000 public websites potentially exploiting this flaw.

Interpol Halts $40M Business Compromise Heist in a Largest-Ever Recovery

Article Link: https://cybernews.com/news/interpol-halts-40m-business-compromise-heist

• Working with local authorities, Interpol got back $40 million from a scam after a Singapore-based company had transferred $42.3 million to a fake account in Timor Leste (East Timor), an island country along the southernmost point of Indonesia.
• The scammers used an almost identical email address to trick the company into paying. The payment was made on July 19, 2024. The scam was discovered four days later when the real supplier said they didn’t get any money.
• Thanks to the quick action of the Singapore Police Force and Interpol’s Global Rapid Intervention of Payments (I-GRIP) mechanism, seven suspects were arrested and $40 million was recovered.
• Since 2022, Interpol’s I-GRIP has recovered hundreds of millions of dollars in fraud cases globally. This includes COVID-19 scams and business email compromise (BEC) incidents.

20K Ubiquiti IoT Cameras & Routers Are Sitting Ducks for Hackers

Article Link: https://www.darkreading.com/ics-ot-security/20k-ubiquiti-iot-cameras-and-routers-are-sitting-ducks-for-hackers?&web_view=true

• About 20,000 Ubiquiti IoT cameras and routers have a severe security flaw known since 2017, making them vulnerable to hacking, denial-of-service attacks, and data theft.
• The flaw involves an exposed port that allows unauthorized access, potentially revealing sensitive information such as device details, owner names, and locations, which can be used for further attacks.
• Although Ubiquiti has issued a fix, many devices remain unpatched, highlighting a common issue with IoT security, where devices often remain unpatched, unlike computers and smartphones.
• This situation underscores the need for automatic updates and greater user awareness about IoT security as the responsibility to apply updates often falls to users, who frequently neglect this task.

How Regional Regulations Shape Global Cybersecurity Culture

Article Link: https://www.darkreading.com/cyber-risk/how-regional-regulations-shape-global-cybersecurity-culture

• Cybersecurity practices vary greatly across the world, leading to exploitable gaps. North America’s major cyberattacks, and South America’s patchy regulations accentuate the urgent need for more cohesive and unified security measures.
• Africa’s fast-paced tech growth and linguistic diversity hinder its cybersecurity efforts, with few countries adopting key regulations. Europe is advancing with laws like GDPR but faces challenges due to uneven security cultures among organizations.
• Asia’s fragmented approach to cybersecurity mirrors its cultural and linguistic diversity. Oceania is improving with national policies and awareness efforts, yet recent data breaches reveal ongoing vulnerabilities.
• Effective global cybersecurity requires a unified governing body and consistent regulations. Until then, developing a strong security culture within organizations and individuals remains essential for protecting against cyber threats.

After the Dust Settles: Post-Incident Actions

Article Link: https://www.securityweek.com/after-the-dust-settles-post-incident-actions

• After a cybersecurity incident or tabletop exercise, take the time to carefully review what happened—how the attackers first gained entry, what they were trying to achieve, and how the attack finally ended. Understanding these details is prevalent for spotting weaknesses and strengthening your response for the future.
• Use the lessons learned to improve your security and incident response practices. Don’t keep your findings to yourself; share them with others in the industry. This collective knowledge helps everyone stay ahead of potential threats.
• After the security event, it is beneficial to look at where additional training might be needed and build a culture of security awareness. Encourage open dialogue and constructive feedback so your team can handle future threats more effectively, focusing on growth and learning rather than placing blame.