Nokia & Schneider Electric Investigate Data Breaches, MoneyGram Replaces Leadership, Spyware Legal Barriers Challenge Victims and Tech Firms

CyberHub Podcast

1×

0:00

-18:39

Nokia & Schneider Electric Investigate Data Breaches, MoneyGram Replaces Leadership, Spyware Legal Barriers Challenge Victims and Tech Firms

Third-Party Breaches, Executive Shake-ups, Deepfake Threats, and Legal Challenges in Spyware

James Azar

Nov 05, 2024

Transcript

Good morning, Security Gang! Welcome to another CyberHub Podcast. It's Tuesday, November 5, 2024, and with the elections in full swing, we're taking a break from all the political chatter. Today's episode zeroes in on cyber threats and developments across multiple fronts.

So, grab your double espresso, and let’s dive in.

Summary of Today’s Top Cyber Stories

Nokia Investigates Potential Breach by Third-Party Vendor

Nokia is investigating claims that a third-party vendor's compromised server exposed sensitive Nokia source code, SSH keys, and credentials. The attack originated through the vendor’s SonarCube server, accessed with default credentials, raising ongoing concerns over third-party risk management. This breach highlights the critical importance of robust vendor security practices, especially in development environments.

Schneider Electric’s Jira System Compromised

Attackers, calling themselves "Hellcat," claim to have breached Schneider Electric’s Jira system, exfiltrating data, including project information and user data. They demand a $125,000 ransom, promising a discount if the breach is confirmed. The attack on the isolated Jira environment still risks leaking sensitive data and customer details, posing an open-source intelligence (OSINT) threat.

Cisco Notifies Customers of Non-Public File Access

Cisco recently alerted a select group of customers after attackers accessed non-public files on its DevHub environment. Cisco denies an official breach, but a cybercriminal claims to have exfiltrated extensive documentation and source code. Cisco has notified affected customers directly and continues to work with law enforcement.

MoneyGram CEO Replacement Sparks Speculation Post-Breach

MoneyGram has replaced CEO Alex Holmes with Anthony Sohu. Although MoneyGram states this leadership change was pre-planned, internal sources allege it stemmed from the company's failure to address technical debt, culminating in a significant recent data breach.

SEC Pushes for SolarWinds Testimony from Czech Network Engineer

The SEC seeks testimony from former SolarWinds engineer Robert Krasir, now residing in the Czech Republic. His testimony could reveal vulnerabilities in SolarWinds' network, with implications for a 2025 trial. The case highlights ongoing legal complexities surrounding cybersecurity accountability.

Google’s November Android Security Patches

Google released patches for 40 vulnerabilities in Android, addressing two actively exploited flaws, one a severe Qualcomm bug and another an elevation of privilege issue. Users are urged to apply updates to avoid potential exploitation by spyware vendors.

Okta Fixes Authentication Bypass Vulnerability

Okta patched an authentication bypass bug affecting users with lengthy usernames, which could have allowed unauthorized access under specific conditions. The flaw underlines the need for rigorous username management in access control systems.

OWASP Warns of Rising Deepfake Threat

With AI-generated text and deepfake technology on the rise, OWASP issued new guidelines, including deepfake defenses and frameworks for AI security. Reports indicate an increasing use of LLM-generated text in email phishing attempts, prompting organizations to prepare for sophisticated AI-based threats.

Meta Presses Legal Action Against NSO Group for Non-Compliance

Following Apple's recent legal struggles with NSO, Meta is now urging a judge to penalize NSO for non-compliance with discovery orders related to their spyware. Spyware debates spark complex discussions around national security versus civil liberties, especially as governments face scrutiny for misusing such tools.

Thanks for reading CISO Talk by James Azar! This post is public so feel free to share it.

Vendor Security Management: Assess and strengthen your vendor risk management practices. Ensure third-party access is controlled, and default credentials are eliminated.
Jira and Internal Tool Security: For organizations using tools like Jira, isolate sensitive project data and enforce strict access controls to reduce OSINT risks in the event of a breach.
Secure Data Exfiltration Response: In case of a breach, promptly identify affected customers and provide transparent updates on incident investigations.
Addressing Technical Debt: Prioritize and manage technical debt actively to avoid potential breach impacts that could escalate to executive-level changes.
Android Security Updates: Apply Google’s latest Android security updates to mitigate known vulnerabilities, especially those actively exploited by spyware.
AI-Based Security Defenses: Implement AI and deepfake detection solutions, and prepare for evolving phishing attacks through increased awareness and updated email security policies.
Legal Readiness for Cybersecurity Incidents: Prepare for legal ramifications in cybersecurity by ensuring thorough documentation of network practices and security implementations, especially if managing or involved with publicly-traded entities.

Discussion about this podcast

CyberHub Podcast

Today’s top cybersecurity news and the latest from Practicing CISO James Azar, tune in to hear how practitioners read, view and work after hearing the latest headlines and how these stories help keep practitioners sharp and ready.

Listen on