Newsletters

A novel supply chain attack has hit the users of NX, a popular developer tool used to automate and optimize CI/CD pipelines.

The incident took place on Tuesday, after a threat actor compromised the npm token for one of the NX developers, and then released malicious updates for several NX tools to the npm package repository.

The new versions contained a malicious script that:

Private sector cyber operators in the United States would be allowed to hack foreign cybercrime enterprises that target American citizens and infrastructure under new legislation being proposed by US Congressman David Schweikert (R). The legislation won't pass in its current form, but we like the idea of US private sector hacking capacity being let loose in some circumstances.

The Scam Farms Marque and Reprisal Authorization Act riffs on old-time letters of marque and reprisal. These were government licenses that authorised private operators (privateers) to attack and capture sailing vessels and goods from specified foreign states. Letters of marque were last issued by the US in 1815.

Since at least 2013, cyber letters of marque have regularly been suggested as a policy response to deal with rampant cybercrime and espionage. If we can't defend ourselves, let's make ourselves feel better by hacking back!

The US Federal Communications Commission has banned more than 1,200 voice service providers from the US telephone network after they failed to deploy robocall protections.

The number is almost half of the 2,411 voice providers the agency notified and ordered last year to become compliant with its new anti-robocall rules.

Voice providers had to deploy the STIR/SHAKEN protocol, provide accurate registration and ownership details, and a contact for reporting robocall abuse and issues.

For the second time this year, an Iranian hacktivist group has crippled the satellite communications systems on 64 Iranian ships at sea.

The incident took place last week and impacted 39 oil tankers and 25 cargo ships operated by the National Iranian Tanker Company (NITC) and the Islamic Republic of Iran Shipping Lines (IRISL).

The hack didn't target the ships directly, but Fannava, an Iranian tech company that provides satellite communication terminals for the ships.

Cisco and the FBI have asked "the public, private sector, and international community"—also known as "anyone willing to listen"—to patch their stupid end-of-life Cisco routers for an ancient 2018 vulnerability that's being "broadly" exploited by Russian hackers linked to the country's FSB intelligence service.

A group known as Static Tundra has been abusing a bug tracked as CVE-2018-0171 over the past year to install backdoors on old and outdated Cisco routers that are still haunting many corporate and government networks.

Static Tundra has been abusing the vulnerability ever since it was discovered back in 2018, but they expanded operations in 2022 and then again last year, as Russia's war in Ukraine has forced the FSB to ramp up intelligence collection capabilities.

A new report has taken a look at how the relationships between Russian cyber security firms and their government have changed since the country's 2022 invasion of Ukraine. 

The analysis by the CNA think tank shows that when it comes to cyber security and great power competition, it pays in record-making margins for companies to choose sides.

The report thoroughly explores three Russian firms that offer different cyber security services: Kaspersky, Security Code and Positive Technologies. All three had ties to the Russian state predating the war. Unsurprisingly, these ties have strengthened. 

The US National Institute of Standards and Technology released guidance this week to help companies detect face morphing incidents.

The technique involves blending photos of two or more real people to generate a new face that can be used to bypass facial recognition scans.

The new photo can be used to trick face recognition systems into identifying the morphed, combined face as both original individuals at the same time.

A team of academics has developed a novel attack that can downgrade 5G traffic to weaker states without using a rogue base station.

The attack uses a new software toolkit named Sni5Gect to intercept, sniff, and alter 5G data packets before the 5G authentication steps.

Once a 5G connection is altered, the attacker can crash the user's equipment (phone, tablet, or other device), harvest user equipment details, and finally downgrade it to a lower-generation connection where other attacks can be carried out with a higher success rate.

A new vulnerability in the HTTP/2 protocol can allow threat actors to launch nearly unlimited DDoS attacks to exhaust memory and crash servers.

The new attack is named MadeYouReset, was discovered by researchers at Deepness Lab, and is a variation of a previous attack known as HTTP/2 Rapid Reset.

The Rapid Reset attack was discovered in October 2023 after it was used to launch some of the largest DDoS attacks seen that year (Google, Amazon, and Cloudflare).

One by one, US federal government agencies are learning that the sensitive but unclassified information they hold is susceptible to theft by hackers. Unfortunately, education-by-breach is very costly.

Last week, Politico reported the electronic case filing system used by the federal judiciary had been breached in a "sweeping cyber intrusion". Hackers breached the Case Management/Electronic Case Files (CM/ECF) system that legal professionals use to upload and manage case documents. They also breached PACER, the system that gives the public limited access to some of the same data. 

The hack sounds just about as bad as can be, with officials concerned that Latin American drug cartels have obtained sensitive court data. Per Politico's follow-up reporting: