🚨 Cargill Cyberattack lawsuit dismissed, Palo Alto Patches Zeroday, Drinking Water exposed to Attacks

In today’s CyberHub Podcast, James Azar delivers a detailed analysis of the latest cybersecurity developments, spanning critical zero-day vulnerabilities, risks to critical infrastructure, high-profile breaches, and emerging trends. Broadcasting remotely due to travel, James reflects on the challenges of maintaining security on the go, accompanied by his signature "coffee cup cheers."

Palo Alto Networks Patches Two Critical Zero-Day Vulnerabilities

Palo Alto Networks addressed two zero-day vulnerabilities in their PAN-OS platform, which had been actively exploited:

CVE-2024-0012 This authentication bypass flaw allowed unauthenticated attackers to gain administrative privileges via the PAN-OS management interface. CVE-2024-9474 A medium-severity privilege escalation issue enabling attackers with admin rights to escalate to root privileges on the firewall.

The patches are included in the latest updates for PAN-OS 10.2 and 10.1.

The Shadowserver Foundation reported that 6,600 IPs were tied to exposed PAN-OS interfaces, down from 11,000 the previous week. While this marks progress, significant risks remain for users who have yet to secure their systems.

U.S. Drinking Water Systems: A Cybersecurity Weak Link

A report from the EPA's Office of Inspector General (OIG) revealed vulnerabilities in U.S. drinking water systems, potentially impacting millions: The assessment analyzed over 1,062 systems serving approximately 193 million people.

Findings:

• 25% of systems exhibited critical vulnerabilities that could lead to denial-of-service attacks or customer data compromise.

• 97 systems serving 27 million people contained critical or high-severity vulnerabilities.

• 211 systems serving 83 million people were identified with medium or low-severity weaknesses, including open ports visible externally.

The EPA lacks a dedicated incident response system for reporting cybersecurity breaches, instead relying on the Cybersecurity and Infrastructure Security Agency (CISA). Many water systems are under-resourced municipal operations, often managed by small teams with limited budgets and expertise.

Ford Faces Alleged Data Breach

Threat actors operating on BreachForums claimed to have accessed sensitive data tied to Ford. The breach reportedly exposed 44,000 records, including names, physical addresses, and product acquisition details. However, the data appears to pertain to dealerships rather than individual customers. Ford denied any breach but confirmed an active investigation into the claims.

The primary source of the claim, "Intel Broker," has a mixed track record of providing accurate and exaggerated information, leaving the legitimacy of the breach uncertain.

Leadership Transition Rumors at CISA

Speculation about CISA Director Jen Easterly stepping down has emerged amidst political transitions. It is customary for political appointees to submit resignations at the end of an administration, allowing the incoming leadership to decide on retaining or replacing them. Easterly’s tenure has been marked by efforts to centralize cybersecurity efforts under CISA, advocating for streamlined incident reporting and standards across critical infrastructure sectors.

This potential shift comes as South Dakota Governor Kristi Noem is expected to take over as DHS Secretary, a position that could influence continuity at CISA.

Fortinet VPN Zero-Day Exploited by Chinese-Linked APT

A sophisticated surveillance malware framework known as "Deep Data" exploited an unpatched zero-day vulnerability in the Fortinet VPN client for Windows.

Developed by Brazen Bamboo, a Chinese-linked state-sponsored APT. Used to extract credentials and sensitive information from browsers, communication apps, and password managers. The vulnerability remains unpatched, highlighting risks for organizations relying on Fortinet VPNs.

The malware’s capabilities underscore its targeted focus on journalists, activists, and political figures, particularly in Southeast Asia.

VMware vCenter Bug Actively Exploited in the Wild

A critical heap overflow vulnerability in VMware’s vCenter Server (CVE-2024-38812) has been exploited in the wild. With a CVSS score of 9.8, the vulnerability allows remote code execution and poses a severe threat to exposed systems.

First reported at a Chinese hacking contest five months ago, the issue persisted unpatched until now. The bug affects distributed computing environment remote procedure call protocols, which are essential for vCenter Server operations. VMware has issued urgent patches, though specific indicators of compromise (IOCs) have not been disclosed.

AI Security: Risks of Jailbreaking Large Language Models (LLMs)

Researchers demonstrated that a commercially available robot using OpenAI's ChatGPT could be manipulated to simulate harmful actions.

When asked directly, the LLM refused to perform a dangerous task. However, when framed as a fictional scenario, it executed the requested action, exposing vulnerabilities in AI guardrails. This study highlights challenges in securing AI systems against misuse and the blurred lines between fictional prompts and real-world actions.

Business Email Compromise Results in $250,000 Loss

Learning Engines, an AI company, fell victim to a business email compromise (BEC) attack that diverted $250,000. The threat actor accessed the company’s environment, altered payment instructions, and deleted key emails. The stolen funds were not recovered.

Phobos Ransomware Admin Extradited to the U.S.

Evgeny Patisyan, a 42-year-old Russian national and administrator of the Phobos ransomware, has been extradited to the U.S. to face charges.

Charges: Wire fraud, conspiracy, extortion, and intentional damage to protected computers.

Impact:

The Phobos ransomware extorted over $16 million globally, targeting schools, hospitals, and government agencies. Patisyan facilitated ransomware-as-a-service operations, earning fees from successful attacks. The extradition marks a victory for international collaboration in combating ransomware.

Summary of Action Items

1. Patch Critical Vulnerabilities:

   • Update Palo Alto Networks PAN-OS to address CVE-2024-0012 and CVE-2024-9474.

   • Apply VMware’s latest patches to mitigate CVE-2024-38812 on vCenter Server.

   • Monitor Fortinet for updates regarding the unpatched zero-day in their VPN client.

2. Strengthen Critical Infrastructure Security:

   • Encourage municipalities to assess and address vulnerabilities in water systems highlighted by the EPA report.

   • Advocate for centralized cybersecurity oversight under CISA to improve incident response and standard-setting across sectors.

3. Bolster Business Email Security:

   • Implement advanced email security measures to prevent business email compromise (BEC) attacks.

   • Educate employees on recognizing phishing and fraudulent communications.

4. Monitor AI Usage and Risks:

   • Assess the security of AI and LLM-powered tools to prevent misuse through prompt engineering or jailbreaking techniques.

   • Develop policies to clarify acceptable AI behaviors and reinforce safeguards.

5. Prepare for Potential Leadership Changes:

   • Monitor the transition at CISA and support efforts to retain proven leadership, such as Jen Easterly, to ensure continuity in cybersecurity strategy.

6. Strengthen International Collaboration:

   • Support efforts to extradite and prosecute cybercriminals like those involved with Phobos ransomware to deter future attacks.

By addressing these items, organizations can improve their security posture and contribute to a safer cyber environment.

Conclusion

This episode highlights the ongoing complexities of cybersecurity across sectors, from patching critical vulnerabilities to safeguarding AI systems and critical infrastructure. The interconnected nature of these challenges reinforces the need for a unified approach to cybersecurity, proactive threat management, and robust incident response capabilities.

Stay tuned for tomorrow’s episode for more in-depth analysis and updates. As always, stay cyber-safe!

✅ Story Links: 

https://www.securityweek.com/palo-alto-patches-firewall-zero-day-exploited-in-operation-lunar-peek/

https://www.cybersecuritydive.com/news/cargill-kronos-discrimination-suit-dismissed/732942/

https://www.securityweek.com/ford-investigating-potential-breach-after-hackers-claim-data-theft/

https://www.darkreading.com/vulnerabilities-threats/jen-easterly-cisa-director-resign-inauguration-day

https://www.securityweek.com/300-drinking-water-systems-in-us-exposed-to-disruptive-damaging-hacker-attacks/

https://www.securityweek.com/fortinet-vpn-zero-day-exploited-in-malware-attacks-remains-unpatched-report/

https://www.securityweek.com/vmware-discloses-exploitation-of-hard-to-fix-vcenter-server-flaw/

https://www.bankinfosecurity.com/its-alarmingly-easy-to-jailbreak-llm-controlled-robots-a-26837

https://therecord.media/ai-company-loses-250000-in-bec-cyberattack

https://cyberscoop.com/alleged-russian-phobos-ransomware-administrator-extradited-to-u-s-in-custody/

🔔 Subscribe now for the latest insights from industry leaders, in-depth analyses, and real-world strategies to secure your digital world. https://www.youtube.com/@TheCyberHubPodcast/?sub_confirmation=1  

✅ Important Links to Follow: 

👉Substack:

👉Listen here: https://linktr.ee/cyberhubpodcast   

✅ Stay Connected With Us.

👉Facebook: https://www.facebook.com/CyberHubpodcast/ 

👉LinkedIn: https://www.linkedin.com/company/cyberhubpodcast/ 

👉Twitter (X): https://twitter.com/cyberhubpodcast 

👉Instagram: https://www.instagram.com/cyberhubpodcast 

✅ For Business Inquiries:  info@cyberhubpodcast.com

=============================

✅ About The CyberHub Podcast.

The Hub of the Infosec Community. 

Our mission is to provide substantive and quality content that’s more than headlines or sales pitches. We want to be a valuable source to assist those cybersecurity practitioners in their mission to keep their organizations secure. 

Tune in to our podcast Monday through Thursday at 9AM EST for the latest news.