Read Time: 10 minutes

Howdy friends!

Can’t express my gratitude enough for all of you. After our 50th straight week of sending Vuln U, we crossed 10,000 members. This is even after I set up an automation to prune folks who were inactive, which unsubscribed around 3,000 people.

This is a strangely important milestone in newsletter land in which you begin to be taken a bit more seriously so it feels great to watch that particular odometer roll over. Thank you again.

This week’s blog is all about Stress since it is something I’ve been thinking a lot about.

ICYMI

🖊️ Something I wrote: We’ve moved on to the community open vote portion of the Best of AI Security 2023 project. Check out all the nominations and cast your votes!

🎧️ Something I heard: The crowd going wild for Caitlin Clark breaking the record for most points in NCAA basketball history

🎤 Something I said: At least a few dozen of you are here this week from my latest videos. Been getting good feedback, so I’m going to keep em up!

🔖 Something I read: Engineering Leadership newsletter from Kelly Vaughn. Wrote up her suggestions on how to stay technical after moving into leadership positions.

👉 Continue reading online to avoid the email cutoff issue 👈

Vulnerable News

U.S. Internet Leaked Years of Internal, Customer Emails

US Internet is an ISP that is big in Minnesota (I had to look that up). The gist is that some researchers found a public link that had a directory listing that somehow let whoever was on it access every single email for each of their customers. Krebs clicked around and saw examples going back to 2008 and some from the present day. He then found some of the CEO’s emails and forwarded his own email to himself as proof when asking him what was going on.

“Within minutes of that notification, U.S. Internet pulled all of the published inboxes offline. Mr. Carter responded and said his team was investigating how it happened. In the same breath, the CEO asked if KrebsOnSecurity does security consulting for hire (I do not).”

I’m going to let Krebs talk about this one mostly, as he has some of the most 🔥 comments I’ve seen from him in this one.

“KrebsOnSecurity has been writing about data breaches for nearly two decades, but this one easily takes the cake in terms of the level of incompetence needed to make such a huge mistake unnoticed. I’m not sure what the proper response from authorities or regulators should be to this incident, but it’s clear that U.S. Internet should not be allowed to manage anyone’s email unless and until it can demonstrate more transparency, and prove that it has radically revamped its security.” (read more)

Android app from China executed 0-day exploit on millions of devices

I know a few hundred of you are here because of a viral Twitter thread I had on this topic. If you watched the Super Bowl this past weekend, you couldn’t avoid the commercials for Temu. The jokes were bubbling up that a spyware company was buying very expensive ad space, and I was trying to figure out why we all felt a bit off about Temu. The service itself and its prices feel a bit scammy, but there was more to it. The comments on this were saying Temu is no worse than all the other apps that collect data for ads and that it was China fearmongering.

Well, upon some digging, Temu’s parent company, PDD Holdings, has a history of pushing malware to its Android app. They even burned a few 0days, all in the name of kicking their competitors off their users’ phones and preventing their apps from being uninstalled. It is a wild story, read my whole twitter thread and the technical article linked here. (read more)

How AI can strengthen digital security

I had the pleasure of working for Phil Venables at one point in my career, and I’m glad he’s at the helm over at Google Cloud.

I'm also glad to see Google through some big bucks behind AI security initiatives. They’re making a bold claim in this report that AI has the power to flip the script on the defender’s dilemma. If you’re unfamiliar, that is the story we tell ourselves that defenders have to be right every time and attackers only have to be right once. (I take issue with this, as 0 days are not invisibility cloaks, but I won’t dig into that now). Check the whole PDF on this one, not just the blog/landing page. (read more)

AI-generated voices in robocalls can deceive voters. The FCC just made them illegal

My phone has become virtually unusable as a means of contacting me via voice. I default to all numbers calling me are a scam. Now we’re throwing in AI robocalls? There used to be a little part of me that was happy knowing if a scammer was delayed on me messing with them, they couldn’t go scam someone else. But now, the scammers are robots, and we aren’t delaying anyone.

Well, in this case, the scammers are politicians (same thing, right?), and the FCC has taken a stand against using AI-generated robocalls altogether. Apparently, they were already being heavily used to trick voters into opinions about various candidates by mimicking their voices. I hope this ban has some teeth.

Can we ban infosec sales cold calls and LinkedIn DMs next? (read more)

The Day I Put $50,000 in a Shoe Box and Handed It to a Stranger

This NY Magazine personal finance columnist wrote her story about how she was tricked by a scam artist into emptying her bank account and giving it to them. This story is wild, the tale the scammer tells is insane, and I’m just shocked the author came out and admitted to all of this. I’m happy they did, as it is a lesson learned for all of us that anyone can fall for these things. The scammers know how to play on your emotions. Guards up! (read more)

CVE-2024-24691 (CVSS 9.6): Critical Zoom Privilege Escalation Vulnerability

Update your Zoom! I’ve caught myself calling all video calls “Zooms” lately - almost like “Velcro” or “Band-Aid” - the brand has become the thing for me. Anyway, this seemed like a fairly nasty privilege escalation bug. It seems it needs some user interaction to exploit, like clicking a link, but it is still rated 9.6 on the CVSS scale.

On your desktop app, you can click “Check for updates” by clicking on your profile photo. On mobile, just update from the App Stores. (read more)

The (Polish) Prime Minister surprised during his meeting with the President. He revealed a document regarding Pegasus

I found this via a Twitter thread by John Scott-Railton, who was feeling particularly vindicated as Citizen Lab had previously called out the use of Pegasus against victims in this situation and were called fake news.

More from the Twitter thread: “For 8 years, #Poland's PiS-Party government was widely viewed as eroding democracy. The confirmation of #Pegasus abuses by Poland's new government under Donald Tusk is a powerful reminder: Mercenary spyware = part of the authoritarian toolkit.” (read more)

Microsoft Breach: What Happened? What Should Azure Admins Do?

This video deserves tens of thousands more views. This is the clearest walkthrough of the recent Russia Microsoft breach I’ve seen. It takes the info MS published and puts together all the possible options and best guesses to fill in the blanks of what happened. The speaker also pulls up Azure tenants to show the identity roles and app permissions that would’ve been set to make this attack possible. Just fantastic job. (read more)

Staying ahead of threat actors in the age of AI

A bit of a PR piece about Microsoft and their combo research with the OpenAI team. BUT I feel it is valuable and worth reading as we all need to stay on top of this space as it continues to evolve.

“Importantly, our research with OpenAI has not identified significant attacks employing the LLMs we monitor closely. At the same time, we feel this is important research to publish to expose early-stage, incremental moves that we observe well-known threat actors attempting, and share information on how we are blocking and countering them with the defender community.”

The bottom of this blog post is interesting as it highlights known threat actor groups that are using LLMs in their identified TTPs (read more)

Disrupting malicious uses of AI by state-affiliated threat actors

Here is the OpenAI side of the coin to the Microsoft blog above.

I like this level of transparency of the level of threats they are seeing and what they’re doing to combat them. (read more)

Mobile Threat Landscape Update

Great episode of the Microsoft Threat Intel podcast where Sherrod DeGrippo walks through Operation Triangulation, the iOS 0day we talked about a few weeks ago that dropped at CCC. A good run-through of the vuln and Microsoft researchers have a unique view of the world, which I always appreciate a look behind the curtain of. I learned a few things about the landscape of surveillanceware on mobile devices. They particularly focus on how security researchers can be a heightened target due to our line of work.

One tip I took away - Reboot your phone more often. Most of these attacks can’t survive a reboot, but a lot of folks never turn their phone off. (read more)

Zero Day Initiative - THE FEBRUARY 2024 SECURITY UPDATE REVIEW

Some good info on a bunch of the recent CVEs to come out, including Adobe and Microsoft patch Tuesday findings. The video shows a cool demo of an exploit the team there found in the wild for CVE-2024-21412 – Internet Shortcut Files Security Feature Bypass Vulnerability. It is a bypass in Microsoft Defender’s protection from downloading files off the Internet. It’s being used to target some forex traders with a remote access trojan in some online forums. (read more)

Analyzing a Suspected AgentTesla Sample with ChatGPT

A detailed run-through of a security researcher using ChatGPT to analyze a suspected AgentTesla sample. If you are unfamiliar, a quick Google search landed me on CheckPoint’s site, which says, “Agent Tesla is an example of an advanced remote access trojan (RAT) that specializes in the theft and infiltration of sensitive information from infected machines.” - It spreads mostly via phishing emails and has surged in prevalence since Covid.

I am less interested in the malware analysis in this one and more interested in how ChatGPT navigates some obfuscated and encrypted code snippets to analyze what is going on under the hood. (read more)

Technical analysis of WinRAR zero-day malware and C2 protocol emulation

This story on the other hand, I’m in for the malware analysis. It is a really good in-depth through of a WinRAR 0-day we talked about when it dropped here in the newsletter. (read more)

LLM Agents can Autonomously Hack Websites

Feels like an AI-heavy episode this week. But how can I avoid sharing all of this? Here is an academic research paper on different LLMs finding vulnerabilities in web apps.

Take this paper with a grain of salt, as it was a purposefully vulnerable web app that it was testing. It's not like it was out here finding CSRF on Facebook with a 100% success rate. BUT - I still think this paper proves a direction we all knew was coming. The skill level to find some of these bugs will continue to drop, and the autonomous discovery and exploitation of bugs will not require a skilled operator of Metasploit, which is the current low bar. (read more)

JetBrains - Critical Security Issue Affecting TeamCity On-Premises

This one caught my eye because of Kim Zetter’s post, where she points out that SolarWinds and many other software makers use TeamCity to build software. And they even wrote a story about it last year (here is her great piece on the SolarWinds hack). This week’s JetBrains TeamCity vuln lets an attacker bypass auth and become an admin.

From the advisory: The vulnerability affects all TeamCity On-Premises versions from 2017.1 through 2023.11.2. It has been fixed in version 2023.11.3. (read more)

Multiple threats to election systems prompt U.S. cybersecurity agency to boost cooperation with states

CISA made some big moves this week with 10 new hires dedicated solely to US Elections security. It being 2024, I’m guessing we’re seeing this to stave off any hope of a narrative forming that the US didn’t do everything possible to secure our presidential election.

“Understanding the complexity of each state’s election operating environment and their security needs is critical to us being effective partners in helping them mitigate those needs and ensuring the infrastructure security and resilience”

I hope this newly formed squad is transparent in their findings and initiatives as they have a very important mission. (read more)

Upcoming Appearances

I recorded an episode of the Phillip Wylie Show this week that will be dropping soon. It was a great chat, talking mostly about career advice. Phillip is great and always has fantastic guests (not sure how I snuck in there)

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay