Cybersecurity News Byte with Jim Guckin: Recent Episodes
Jim Guckin
Welcome to CyberSecurity News Byte with Jim Guckin, your one-stop resource for the latest cybersecurity news, updates, and discussions. The podcast is a vital tool for CyberSecurity and IT professionals, as well as technology leaders, who need to stay on top of the ever-evolving digital landscape.
Each week, we delve into the most significant cybersecurity stories from around the globe. Whether it's a new vulnerability discovered, a major data breach, or the rollout of a critical security patch, we aim to keep our listeners informed and prepared. We go beyond the headlines, breaking down complex issues into easy-to-understand segments, and providing insights into the potential implications and countermeasures that professionals can take.
This week we talk about [00:36] how Citrix is warning its customers to be aware of this integrated third party tool, then [07:55] we finally learn the identity of the main member of LockBit, Then we talk about [14:04] Dell had one of their sites scraped and all it cost them was 49 million customers records and we round up this weeks discussion on [23:09] a wordpress plugin that is being actively exploited by hackers and how even if you don't use this plugin, you can protect yourself.
This week we talk about [00:36] how a major player in the website protection game, get's hacked, [09:13] A Russian hacker group is using vulnerabilites from December to gain access to your account, [16:20] Mastadon has a critical vulnerability, can the admins patch their servers in time and finally [22:50] A popular remote access tool had their systems breach, and you should reset your account anyway.
[00:36] Cloudflare Hacked [09:13] Russian Hackers using NTLM Relay Attacks [16:20] Critical vulnerability in Mastodon [22:50] AnyDesk breached, reset passwords
This week we talk about [00:36] an Outlook vulnebility that leaks a hashed password to places it shouldn't, then [06:32] The US government doesn't need warrants for your information they just pay data brokers, [13:58] The NoName Ransomware group take target at industries around the work, and finally [20:31] the Trello data breach that wasn't really a data breach and why that doesn't make us feel any better.
On my return for 2024, we talk about [00:36] how a Russia backed group hacked Microsoft's top leaders email account, [09:25] VMWare sounds the alarm about their latest critical vCenter vulnerability that's currently being used in attacks, [16:00] How a popular IT remote access tool is being exploited back hackers and what not to do, and finally [23:11] a long dormant group wakes back up and using email to create havoc.
This week we talk about [00:36] ownCloud let's it users know it's found 3 critical vulnerabilites in some of it's software, [06:57] A school app based in India was leaking personal student data due to misconfiguration, [12:15] Microsoft takes a sucessful attack again it's Windows Hello service to break into computers and [18:49] BlackCat is back at it again, by claiming to hack a fortune 500 company.
This week we talk about [00:36] We talk about how some security researchers were able to extract a RSA key from signing errors, [07:27] How a now defunt shadowy hack-for-hire group was behind a bunch of attacks, [15:11] Vulnerabilities in some AL and ML tools should they give you something to think about, [22:59] and an old tactic being used to extract money from those who care and reminder how it's the season for social engineering.
This week we talk about [00:36] The Lace Tempest group seen exploiting a vulnerability in a popular IT Support Software, [06:46] Then we talk about how a company suffered a compromise, paid the attacker and the data was still leaked, [13:38] We talk about the new vulnerability that CISA is warning about, and finally [17:34] Sumo Logic urges it's users to change their credentials.
This week we talk about [00:36] A zero-day in a popular webmail client that can be exploited without interaction, then [06:38] How Octo Tempest gang's new addition to social engineering is a little scary, [14:12] The Lockbit gang has claimed to have hacked Boeing, but is it true and finally [18:57] A social engineering tactic being used on LinkedIN to spread malware.
This week we talk about [00:36] a new advertising campaign that is targeting Notepad++ to spread malware, then [00:36] a new cheaper malware avaialbe to cybercriminals that you need to be aware of, [00:36] a IT company's misconfiguration exposes 820,000 customers data, and Cisco has a new zero-day that's as severe as can be.
This week we talk about [00:36] How the blockchain is being utilized to help the spread of malware, [08:18] How the ToddyCat malware is being improved upon and how it's being utilized for compromising exchange servers, [14:47] How ALPHV has stolen data from a hosptial and how their extortion techniques are getting worse, and [21:03] DarkGate malware is making a come-back and how it changed it's money making model.
This week we talk about [00:36] how buying cheap android products on popular ecommerce sites may come preloaded with malware, then [07:16] we talk about how the curl library and command has 2 security patches that you need to make sure you update this week, [11:11] a popular DNA testing company has their data leaked on the internet and why that should concern you, and [16:25] Sony confirms another breach linked to the MoveIT vulernability.
This week we talk about how a new attack, is actually just hackers using the tools that security testers are using against us, Then we talk about how Apple has a new 0-day vulnerability that needs patching, and then to be fair we talk about the new Android vulnerability that is also being actively exploited, then we wrap it all up with a discussion about the Chinese hacker who gets access to Microsoft's encryption key and use it to breach the US government.
We talk about a new exploit that abuses a computer search component that hopes to trick your users into clicking malware, Then a new malware with an older tactic, using ads for popular technology software to get you to download and install it, Then we talk about a new report that explains why the education sector is a high value hacker target and we round off the week talking about how a hacker forum, known to selling breach data, is having its data sold after a breach.
Today's episode we talk about the recently uncovered 2-year-old botnet called AVrecon, Then talk about how criminals are making their own AI called WormGPT, How a recently busted cyber fraud market website announced a new owner is coming and finally we just back and give updates on SwingVPN and JumpCloud.
[00:36] AVrecon infects 70,000 routers
[09:56] WormGPT for clever phishing
[15:51] Genesis Market sold despite FBI disruption
[20:58] Story Updates, not update updates
On this week’s show we talk about [00:36] Android security update patches 3 exploits that are being actively used, [08:05] A new technique that allows the successful tricking of voice authentication, [15:20] JumpCloud security incident that causes the reset of their APIs and [21:52] TeamPhisher tool exploits Microsoft Teams.
This weeks show, we talk about a security researches discovery about Swing VPN, then the US Military is warning it's staff beware of unexpected smart watches, followed by the latest Mirai botnet campaign targeting IoT devices and finish the episode off with how a self propregrating malware found it's way to a healthcare network.
[00:36] Popular Swing VPN Android App as DDoS Botnet
[08:44] US Military warns of unexpected smart watches
[13:46] Latest Mirai Campaign Leveraging Multiple IoT Exploits
[19:09] Self-Propagating Malware Inadvertently Affects Networked Storage Devices
On this week's show, we talk about the new threat group that is targetting SSH servers, Barracuda announces get rid of impacted appliances after a Zero-Day attack on their equipment, GravityRAT pretends to be messaging application to go after your WhatsApp backups, and MOVEit Transfer in the news again for a third vulnerability in a few weeks.
[00:36] New Threat Group Targets SSH Servers
[06:23] Barracuda Zero-Day Attacks
[11:55] GravityRAT goes after WhatsApp backups
[14:55] Third MOVEit Bug Discovered
I talk about the [00:36] new easily exploitable Microsoft Visual Studio bug, [08:38] A new report that puts CyberSecurity awareness center stage, [19:15] A new “Picture in Picture” technique used in a new deceptive phishing attack, and [24:24] a security company releasing a PoC for Windows Win32k bug exploited in attacks, patch now!
Bullet points of key topics + chapter markers [00:36] New Backdoor Malware for Intelligence Gathering [00:36] New Ransomware Exhibit Striking Similarities with an older name [00:36] Discord Admins hit with malicious Bookmark [00:36] MOVEit Transfer zero-day mass-exploited in data theft attacks
Bullet points of key topics + chapter markers [00:36] Entering the Summer Caution Season [12:02] Size doesn’t matter when it comes to cyberattacks [21:43] Hot Pixels: checks CPU temp, power changes to steal data [29:44] Enhanced Legion Credential Harvester Targets SSH Servers and AWS Credentials
Bullet points of key topics + chapter markers [00:36] Cybersecurity firm Dragos discloses security incident and extortion attempt [00:36] DarkBERT [00:36] BrutePrint, vulnerability to Brute Force Fingerprint Locks [00:36] Voice Cloning-as-a-Service
Date: May 15, 2023 Episode title and number: 56 - May 15, 2023
Bullet points of key topics + chapter markers [00:36] Car location data of 2 million customers exposed for ten years [06:54] Millions of mobile phones come pre-infected with malware [12:25] Phishing Campaign Distributes SmokeLoader via Fake Invoice [16:00] Crooks are Using Malicious QR Codes to Steal Your Money
Bullet points of key topics + chapter markers
[00:36] Pentagon Document Leak [11:49] NCR was the victim of BlackCat ransomware gang [18:16] Free Movie Sites are a bad idea [24:14] Vice Society Ransomware Using Stealthy PowerShell Exfiltration
Bullet points of key topics + chapter markers [00:36] Impersonating Ransomware Gangs for Extorsion [08:39] DISH slapped with multiple lawsuits after ransomware cyber attack. [15:20] Lazarus Group Linked to 3CX Supply Chain Hack [22:05] Ukrainian Hacktivists Trick Russian Military Wives for Personal Info
Bullet points of key topics + chapter markers [00:36] Instagram scam uses fake SHEIN gift cards as lure [00:36] Linus Tech Tips Hacked [00:36] Another one bites the dust [00:36] Fake IRS tax email delivers Emotet malware
Bullet points of key topics + chapter markers [00:36] Google Pixel flaw allowed recovery of redacted, cropped images. [05:39] Actively Exploited Microsoft Outlook Vulnerability Imperils Microsoft 365 Apps [10:43] Emotet malware now distributed in Microsoft OneNote files to evade defenses [15:56] Hackers Use AI-Generated YouTube Videos to Spread Info-stealers
Bullet points of key topics + chapter markers [00:36] Batloader uses Google Ads [06:02] Crypto: Pay to Earn Scam [13:21] Akamai has mitigated the largest DDoS...So Far [19:01] Xenomorph Android Banking Trojan Returns
Bullet points of key topics + chapter markers [00:36] Popular fintech apps expose exploitable secrets [07:16] Microsoft Word RCE PoC is public [11:26] Phishing Campaign Targets Job Seekers, Employers [18:14] Old Vulnerabilities haunt organizations
Bullet points of key topics + chapter markers [00:36] Ransomware Ransom at the right price [07:32] Fake Amazon Prime email abuses LinkedIn's URL shortener [12:10] Wiper malware goes global [16:19] ChatGPT
Bullet points of key topics + chapter markers
[00:36] New CrySIS/Dharma Ransomware Variants [07:45] No Fly List Uncovered [17:12] Riot Games Hacked [22:23] MailChimp discloses new breach
Bullet points of key topics + chapter markers
[00:36] Medical Imaging Firm Faces 2 Class Actions [10:32] Hackers disrupt virtual esports event [17:49] Security Things to Remember as People Return to Work [23:43] PoC for critical bugs in popular WordPress plugins
Bullet points of key topics + chapter markers
[00:36] Hackers go after PII the most [09:35] InfoSec Community Target in Phishing Campaign [16:09] Harder to Detect Phishing Technique [23:47] Ransomware Victims Pay for Data Deletion
Cisco Warns of Many Old Vulnerabilities Being Exploited in Attacks, Glupteba botnet is back after Google disrupted it, 85 percent of attacks now use encrypted channels, InfraGard Hacked/Hacker Halts Sale of FBI’s High-Profile InfraGard Database
[00:36] Sequoia Discloses a Data Breach [09:56] Health Dept warns of Royal Ransomware [16:35] Hackers earn $989,750 for 63 zero-days exploited at Pwn2Own Toronto [23:17] Cisco discloses high-severity IP phone zero-day
How not to handle vulnerabilites, HHS warns use of pixel tracking tech without BAA violates HIPAA, Trustcor dropped as root certificate authority, Hyundai app bugs allowed hackers to remotely unlock, start cars
Tis the Season for Cyber Security, 487 Million WhatsApp Users Numbers for Sale, Hospitality company confirms Data Breach, SocGholish finds success through novel email techniques
Links https://thehackernews.com/2022/11/researchers-discover-hundreds-of-amazon.html https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots https://www.darkreading.com/attacks-breaches/researchers-alarm-batloader-malware-dropper https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html https://www.securityweek.com/samba-patches-vulnerability-can-lead-dos-remote-code-execution?&web_view=true https://www.samba.org/samba/security/CVE-2022-42898.html https://cyware.com/news/rapperbot-targets-game-servers-with-modified-brute-force-and-ddos-attacks-4294e924 Amazon RDS Instances Leaking Users’ Personal Data Dangerous BatLoader Malware Dropper Samba Vulnerability Can Lead to DoS or RCE RapperBot Targets Game Servers with Modified Brute-Force and DDoS Attacks
Emotet learns a new trick, Are Open-Source Repositories Safe?, Text4Shell Concern, 16 Apps Pulled Due to Malware
Vice Society sets a deadline for LA School District to pay ransom, SolarMarker Makers uses spamdexing to target tax consulting organization BEC Attacks on the Rise, Former IT Administrator Cripples Company, LinkedIN CISO Struggles