Risky Business

In this week’s show Patrick Gray and Adam Boileau recap all the infosec news of the last three weeks, including:

• Chinese woman arrested at Mar-a-Lago being very shady
• The ASUS supply chain attack
• Flame-related malware lived on longer than expected
• boostrap-sass Ruby gem backdoored
• Latest on Norsk Hydro and other victims of the same crew
• More trouble at Toyota
• Huawei spanked by UK oversight panel
• Exodus govvie malware affects Android and iOS
• Plus much, much more

This week’s sponsor interview is with Kumud Kalia, the Chief Information and Technology Officer of Cylance. They actually dropped a really interesting product announcement at RSA a few weeks back and Kumud will be along later on to tell us about that. The tl;dr it’s an agent that models endpoint behaviour so when someone - or something - else starts using that endpoint to do things that don’t fit the user profile, action can be taken.

It’s the type of tech concept that normally belongs in academic papers, not in actual products people can actually buy. That’s an interesting chat.

Links to everything are below, and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes Feds: Woman arrested at Mar-a-Lago had hidden-camera detector | Miami Herald Hackers Hijacked ASUS Software Updates to Install Backdoors on Thousands of Computers - Motherboard ASUS releases fix for Live Update tool abused in ShadowHammer attack | ZDNet Researchers publish list of MAC addresses targeted in ASUS hack | ZDNet Nation-state hacking kit ‘Flame’ had a second life, researchers say Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem | Snyk Norsk Hydro ransomware incident losses reach $40 million after one week | ZDNet Norsk Hydro will not pay ransom demand and will restore from backups | ZDNet Arizona Beverages knocked offline by ransomware attack | TechCrunch Ransomware Forces Two Chemical Companies to Order ‘Hundreds of New Computers’ - Motherboard Toyota announces second security breach in the last five weeks | ZDNet Huawei's Problem Isn't Chinese Backdoors. It's Buggy Software | WIRED HCSEC_OversightBoardReport-2019.pdf In issuing 5G recommendations, E.U. spurns U.S. hardline on Huawei Bezos’ Investigator Gavin de Becker Finds the Saudis Obtained the Amazon Chief’s Private Data NSO Group Says It Didn’t Hack Jeff Bezos On Behalf of Saudi Arabia - Motherboard 'Exodus' Spyware Posed as a Legit iOS App | WIRED Former NSA spies hacked BBC host, Al Jazeera chairman for UAE Lazarus rises in Israel with attempted hack of defense company, researchers say Defense Ministry rebukes Israeli spy tech company for unlawful exports | The Times of Israel Islamic State's collapse hastened with help of Australian cyber spies - ABC News (Australian Broadcasting Corporation) Company sues worker who fell for email scam - BBC News Utah Just Became a Leader in Digital Privacy | WIRED Office Depot rigged PC malware scans to sell unneeded $300 tech support | Ars Technica Microsoft warns Windows 7 users of looming end to security updates | TechCrunch Brace yourselves: Exploit published for serious Magento bug allowing card skimming [Updated] | Ars Technica Warfare Plugins on Twitter: "WE ARE AWARE OF A ZERO-DAY EXPLOIT AFFECTING SOCIAL WARFARE CURRENTLY BEING TAKEN ADVANTAGE OF IN THE WILD. Our developers are working to release a patch within the next hour. In the meantime, we recommend disabling the plugin. We will update you as soon as we know more." Pipdig Update: Dishonest Denials, Erased Evidence, and Ongoing Offenses Two serious WordPress plugin vulnerabilities are being exploited in the wild | Ars Technica Ex-NSA contractor pleads guilty to vast classified data leak, faces 9 years in prison Report deems Russia a pioneer in GPS spoofing attacks | ZDNet Above Us Only Stars - Exposing GPS Spoofing in Russia and Syria - Association of Old Crows Researchers find 36 new security flaws in LTE protocol | ZDNet AT&T, Comcast successfully test SHAKEN/STIR protocol for fighting robocalls | ZDNet Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years — Krebs on Security Third-Party Apps Exposed Over 540 Million Facebook Records | WIRED Man Behind Fatal ‘Swatting’ Gets 20 Years — Krebs on Security Top dark web marketplace will shut down next month | ZDNet Lithuanian man pleads guilty to scamming Google and Facebook out of $123 million | ZDNet China Considers Ban On Cryptocurrency Mining Because It's A Stupid Waste Of Energy | Gizmodo Australia Vigilantes Counter Christchurch Manifesto with Weaponized Version RedTeam Pentesting on Twitter: "We were also quite surprised to find this /etc/nginx.conf in 1.4.2.20… https://t.co/ymjjLM3eP7" Announcing QueryCon 2019 | Trail of Bits Blog PaperCall.io - QueryCon 2019 QueryCon 2019 — Hosted by Trail of Bits, with Kolide and Carbon Black Tickets, Thu, Jun 20, 2019 at 9:00 AM | Eventbrite