Subaru Security Flaws Exposed Its System for Tracking Millions of Cars

, ,

Security researchers discovered vulnerabilities in Subaru’s Starlink service that allowed them to track the locations of millions of cars, gaining access to up to a year's worth of detailed location data, including sensitive personal visits. Sam Curry and Shubham Shah demonstrated flaws that let them hijack car controls and access location histories by exploiting administrative weaknesses in Subaru's system. Though Subaru has since fixed the vulnerabilities, concerns remain about privacy regarding employee access to location data. Similar vulnerabilities have affected multiple automakers, highlighting broader issues in the automotive industry regarding data privacy and security.

https://www.wired.com/story/subaru-location-tracking-vulnerabilities/

Major Cybersecurity Vendors’ Credentials Found on Dark Web

Thousands of credentials from major cybersecurity vendors were found on the dark web, as reported by Cyble. Credentials from at least 14 security providers were leaked and sold for as low as $10, impacting both internal accounts and customer access. Notable vendors affected include McAfee, CrowdStrike, and Palo Alto Networks, with significant credential exposures. The breaches likely resulted from compromised internal systems, highlighting the need for dark web monitoring to prevent larger cyberattacks.

https://www.infosecurity-magazine.com/news/cybersecurity-vendors-credentials/

Targeted Supply Chain Attack Against Chrome Browser Extensions

, ,

TLDR: On December 26, 2024, Cyberhaven reported a targeted supply chain attack on their Chrome extension via compromised developer permissions gained through phishing. The attacker injected malicious code into a dozen extensions, aiming to harvest sensitive data (API keys, session cookies) from hundreds of thousands of users, including those of ChatGPT and Facebook. The report details phishing tactics, the compromised extensions, and the adversary's infrastructure, urging users to remove affected extensions and monitor their accounts for suspicious activity.

https://blog.sekoia.io/targeted-supply-chain-attack-against-chrome-browser-extensions/

MasterCard DNS Error Went Unnoticed for Years

, ,

MasterCard fixed a major domain name server error that allowed potential interception of its Internet traffic due to a typo that went unnoticed for nearly five years. A security researcher, Philippe Caturegli, registered the misspelled domain for $300 to prevent exploitation. Although MasterCard asserted there was no real threat, Caturegli argued that the misconfiguration posed significant risks, potentially enabling Man-in-the-Middle attacks. After notifying MasterCard, he faced backlash for publicly disclosing the error, suggesting a need for better corporate acknowledgment of security vulnerabilities.

https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/

Cloudflare Mitigated a Record-breaking 5.6 Tbps DDoS Attack

,

Cloudflare mitigated a record 5.6 Tbps DDoS attack on October 29, 2024, from a Mirai-based botnet of 13,000 devices, targeting an ISP in Eastern Asia. The 80-second attack was detected and mitigated autonomously, causing no alerts or impact. Hyper-volumetric DDoS attacks are rising, with significant increases in attacks over 1 Tbps and bursts lasting under 10 minutes. The most targeted industries were telecommunications and internet services, especially during peak usage times, indicating a trend toward ransom DDoS attacks.

https://www.bleepingcomputer.com/news/security/cloudflare-mitigated-a-record-breaking-56-tbps-ddos-attack/

7-Zip Fixes Bug That Bypasses Windows MoTW Security Warnings, Patch Now

,

7-Zip patched a high-severity vulnerability (CVE-2025-0411) that allowed attackers to bypass Windows Mark of the Web (MotW) security warnings, enabling code execution by improperly handling nested archives. Users must update to version 24.09 to mitigate this risk, as many may still use vulnerable versions without auto-update.

https://www.bleepingcomputer.com/news/security/7-zip-fixes-bug-that-bypasses-the-windows-motw-security-mechanism-patch-now/

AI Tool GeoSpy Analyzes Images and Identifies Locations in Seconds

GeoSpy, an AI tool by Graylark Technologies for law enforcement, analyzes photos to determine locations in seconds, revealing significant privacy risks. While originally intended for official use, public access led to misuse, including stalking. The tool requires no training, enabling any user to locate individuals via social media images despite stripped metadata. Concerns arise over potential abuse and the security of private data involved. GeoSpy's public access has now been restricted following reports of such misuse.

https://www.malwarebytes.com/blog/news/2025/01/ai-tool-geospy-analyzes-images-and-identifies-locations-in-seconds

Mass Campaign of Murdoc Botnet Mirai: a New Variant of Corona Mirai

,

Extreme TLDR: Murdoc Botnet, a new Mirai variant, exploits AVTECH Cameras and Huawei HG532 routers, utilizing ELF files and shell scripts for deployment. Launched in July 2024, it features over 1300 active IPs and 100+ command-and-control servers. Affected primarily are Malaysia, Thailand, Mexico, and Indonesia. Recommendations include monitoring for suspicious activities and keeping systems updated.

https://blog.qualys.com/vulnerabilities-threat-research/2025/01/21/mass-campaign-of-murdoc-botnet-mirai-a-new-variant-of-corona-mirai

Employees Enter Sensitive Data Into GenAI Prompts Too Often

,

Employees often input sensitive data into generative AI (GenAI) tools, increasing risks for enterprises, as 8.5% of prompts analyzed contained sensitive information. The categories at risk include customer data (45.77%), employee data (27%), legal/finance (14.88%), and security codes (5.64%). Organizations face a dilemma: adopt GenAI for efficiency or risk exposing sensitive data. Effective governance strategies, such as real-time tracking and employee training, are crucial to mitigative risks while leveraging GenAI's advantages.

https://www.darkreading.com/threat-intelligence/employees-sensitive-data-genai-prompts

Sneaky 2FA: Exposing a New AiTM Phishing-as-a-Service

, , ,

TLDR: Sekoia.io identified a new phishing kit named “Sneaky 2FA,” part of a phishing-as-a-service operation targeting Microsoft 365 accounts. Discovered in December 2024, it utilizes advanced techniques, including autograb for email input and anti-bot measures. The service is marketed via a Telegram bot and relies on compromised domains. It captures session cookies post-authentication, making it a significant threat. Detection measures focus on identifying inconsistent user-agent strings indicative of phishing attempts.

https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/

Microsoft Patches Windows to Eliminate Secure Boot Bypass Threat

,

Microsoft patched a Secure Boot vulnerability (CVE-2024-7344) that allowed attackers with privileged access to bypass protections and load malicious firmware. This threat persisted for over seven months and affected various recovery software. While Microsoft removed the vulnerable digital signatures in a recent update, it remains unclear if Linux systems were also impacted. Concerns have been raised about the safety of third-party UEFI apps.

https://arstechnica.com/security/2025/01/microsoft-patches-windows-to-eliminate-secure-boot-bypass-threat/

The Current State of Ransomware: Weaponizing Disclosure Rules and More

Ransomware threats are evolving, leveraging AI for sophisticated phishing and social engineering attacks, adopting “living-off-the-land” techniques to avoid detection, and exploiting legal disclosure regulations to pressure victims. Cybercriminals also use ransomware as a geopolitical weapon, targeting critical sectors like healthcare and public administration. Attack rates and recovery costs are rising significantly, with overall cybersecurity defenses needing to adapt to these complex challenges. Proactive measures, such as vulnerability management and incident response, are essential to counter these threats.

https://securityintelligence.com/articles/the-current-state-of-ransomware-weaponizing-disclosure-rules/

Scroll to Top