Daily Drop (803): Fentanyl Crisis | Emerson Rosemount | EV Adoption | APT29 | HK: ExPats | SnailLoad | StarLink | Ivanti | U.S. Infrastructure | CN: Network Scanning | 250 npm Pkgs | Telecom Outages

06-29-24

Saturday, Jun 29 2024 // (IG): BB // ShadowNews // Coffee for Bob

*Started adding the Proof Of Concepts (PoC) if available for mentioned CVE’s :

A Proof of Concept (PoC) is a small exercise to test a certain hypothesis or demonstrate that a potential project can be viable. It's primarily used to verify that certain concepts or theories have the potential for real-world application. The purpose of a PoC is to showcase the feasibility, functionality, and potential of a concept before proceeding to the development of the full-scale project. *

Major U.S. Telecom Outage Disrupts Travelers in Europe

Bottom Line Up Front (BLUF): AT&T, T-Mobile, and Verizon are experiencing a significant roaming outage affecting U.S. customers traveling in Europe, likely due to issues with telecom infrastructure provider Syniverse.

Analyst Comments: This widespread international outage highlights vulnerabilities in global telecommunications infrastructure and the heavy reliance on third-party providers for critical roaming services. The incident underscores the need for improved redundancy and backup systems in international telecom networks. It also demonstrates potential economic and security implications for travelers and businesses operating abroad. This situation may prompt major telecom companies to reevaluate and strengthen their international roaming agreements and infrastructure. For consumers, it emphasizes the importance of having backup communication plans when traveling internationally, such as obtaining local SIM cards or relying on Wi-Fi-based services.

FROM THE MEDIA: The outage began on Thursday and continues to affect U.S. travelers in Europe. Verizon, AT&T, and T-Mobile have acknowledged the issue and are working to resolve it. Syniverse confirmed "intermittent connectivity issues." Affected customers cannot connect to mobile networks or the internet without Wi-Fi. Experts recommend using international SIM cards as a workaround. The Federal Communications Commission (FCC) and Cybersecurity and Infrastructure Security Agency (CISA) are reportedly investigating the causes. No timeline for full service restoration has been provided.

READ THE STORY:  The Streets

The New Money Laundering Network Fuelling the Fentanyl Crisis

Bottom Line Up Front (BLUF): U.S. officials allege that Chinese organized crime groups have become the primary money launderers for Mexican drug cartels, facilitating the fentanyl trade through sophisticated underground banking networks.

Analyst Comments: This development represents a significant evolution in global illicit finance, combining the massive cash flows from fentanyl sales with Chinese capital flight. The alliance between Chinese money launderers and Mexican cartels poses a formidable challenge to law enforcement, as it leverages encrypted communications, sophisticated banking techniques, and transnational networks to evade detection. The efficiency and low cost of this new laundering system may accelerate the fentanyl crisis by making drug trafficking more profitable. Additionally, the involvement of seemingly legitimate Chinese individuals in the U.S. complicates enforcement efforts.

FROM THE MEDIA: U.S. authorities indicted 12 individuals, including 9 Chinese nationals, for allegedly laundering $50 million for the Sinaloa cartel. The scheme involves "mirror transfers" using Chinese bank accounts, allowing dollars to remain in the U.S. while equivalent funds are transferred in China. Officials say Chinese groups now dominate cartel money laundering, charging lower fees and moving money faster than traditional methods. The system also caters to wealthy Chinese seeking to circumvent capital controls. Law enforcement in Italy and the UK have also noted increased involvement of Chinese money brokers in organized crime finance.

READ THE STORY:  FT

Military Space Trackers to Keep Public Informed on Starlink Satellite Reentries

Bottom Line Up Front (BLUF): U.S. Space Command announced it will closely monitor and provide public updates on SpaceX's controlled deorbiting of approximately 100 Starlink satellites over the coming months.

Analyst Comments: This announcement highlights the increasing importance of space situational awareness and debris management as satellite constellations rapidly expand. The collaboration between U.S. Space Command and SpaceX demonstrates a proactive approach to addressing potential safety concerns associated with large-scale satellite deorbiting operations. The public release of reentry information through Space-Track.org reflects a commitment to transparency and may help alleviate public concerns about falling space debris. However, the operation also underscores ongoing debates about the long-term sustainability of massive satellite constellations and the potential risks they pose.

FROM THE MEDIA: SpaceX announced in February its decision to deorbit about 100 early version Starlink satellites due to a potential issue increasing failure risk. U.S. Space Command will track the reentries and provide public updates via Space-Track.org. The article mentions a controversial FAA report warning of potential injuries from falling debris by 2035, which SpaceX strongly contested. SpaceX maintains its satellites are designed to completely burn up upon reentry, posing minimal risk to people on the ground.

READ THE STORY:  SpaceNews

Who Has the Best Scanning Tools in China?

Bottom Line Up Front (BLUF): A recent "China Cybersecurity Industry Panorama" report identifies 22 top vendors in the web application scanning and monitoring category, representing China's most capable cybersecurity companies.

Analyst Comments: This report provides valuable insight into China's growing cybersecurity industry and its leading companies. The prominence of these scanning tool vendors, many with government relationships and international expansion plans, suggests China is developing significant domestic cybersecurity capabilities. The absence of known hacking-related companies like i-SOON and Chengdu 404 from this list raises questions about the relationship between China's legitimate cybersecurity industry and potential state-sponsored hacking operations. The international expansion of these companies could have implications for global cybersecurity markets and potentially raise concerns about the dual-use nature of advanced scanning technologies. The close ties between many of these firms and Chinese government agencies highlight the blurred lines between private-sector cybersecurity development and state interests in China's cyber ecosystem.

FROM THE MEDIA: The report lists 22 top vendors in web application scanning and monitoring. Many are among China's top 10 cybersecurity companies by market share. 15 of the 22 vendors are vulnerability support units for the China National Vulnerability Database (CNNVD). 8 are technical support units for the China National Vulnerability Database (CNVD). 9 are emergency response technical support units for CNCERT. Companies like NSFOCUS, Venustech, and Knownsec are expanding internationally and gaining recognition from global analysts like Gartner.

READ THE STORY:  Natto Thoughts

SnailLoad Allows Attackers to Trace Visited Websites By Measuring Network Latency

Bottom Line Up Front (BLUF): Prices for memberships in Hong Kong's elite private clubs have fallen up to 20% on the secondary market over the past year due to economic slowdown and expatriate departures from the city.

Analyst Comments: This novel attack technique demonstrates the evolving sophistication of side-channel exploits, highlighting vulnerabilities in network infrastructure that persist even with encrypted traffic. SnailLoad's ability to operate without direct access to network traffic or code execution on victim systems makes it particularly concerning from a privacy standpoint. The high accuracy in identifying specific online activities could have significant implications for user privacy and anonymity. The difficulty in mitigating this attack, due to its exploitation of fundamental bandwidth differences, presents a challenge for cybersecurity professionals. This research underscores the need for continued innovation in network security and privacy-preserving technologies to counter emerging threats that leverage subtle timing differences in network behavior.

FROM THE MEDIA: SnailLoad exploits bandwidth bottlenecks in internet connections to measure delays in packet transmission, inferring user activity. The attack requires no JavaScript or code execution on the victim's system, simply involving slow content loading from an attacker-controlled server. In tests, SnailLoad achieved 98% accuracy in identifying YouTube videos and 62.8% accuracy in fingerprinting the top 100 websites. Mitigation is challenging as the root cause stems from fundamental bandwidth differences. The researchers reported the technique to Google, which acknowledged its severity and is investigating server-side mitigations for YouTube.

READ THE STORY:  The Cyber Express

American Interest in Electric Vehicles Short Circuits for First Time in Four Years

Bottom Line Up Front (BLUF): Pew Research reports that U.S. consumer interest in electric vehicles (EVs) has declined for the first time since 2020, with only 30% of Americans considering an EV for their next purchase, down 9% from last year.

Analyst Comments: This shift in consumer sentiment represents a potential setback for EV adoption in the U.S. market. The decline in perceived environmental benefits of EVs suggests a need for better public education on their overall impact. The political divide in EV perception highlights how clean energy technologies have become politicized. The slow rollout of charging infrastructure remains a significant barrier to adoption, indicating a mismatch between government goals and on-the-ground implementation. However, the rise in hybrid vehicle interest suggests consumers are still open to alternative fuel technologies. Notably, Tesla's declining sales significantly impact overall EV market trends, emphasizing the outsized influence of a single manufacturer on the sector. This data may prompt automakers and policymakers to reassess strategies for encouraging EV adoption, potentially focusing more on infrastructure development and addressing cost and reliability concerns.

FROM THE MEDIA: Key findings include a 20% drop since 2021 in those believing EVs are better for the environment, political divisions in EV perception, and widespread concern about charging infrastructure. Only 7 of 500,000 planned charging stations have been built using federal funds. Hybrid vehicles are gaining interest, with 40% of buyers considering them. The article notes that excluding Tesla, EV sales increased 33% year-over-year, suggesting Tesla's issues may be skewing overall market perceptions.

READ THE STORY:  The Register

Researchers Warn of Flaws in Widely Used Industrial Gas Analysis Equipment

Bottom Line Up Front (BLUF): Multiple security vulnerabilities have been discovered in Emerson Rosemount gas chromatographs, widely used for industrial gas analysis. These flaws could allow attackers to obtain sensitive information, cause denial-of-service conditions, and execute arbitrary commands.

Analyst Comments: These vulnerabilities in critical industrial equipment highlight the ongoing cybersecurity challenges in operational technology (OT) environments. The potential for unauthenticated attackers to gain admin capabilities and execute commands as root poses significant risks to industrial processes and safety. The flaws underscore the need for robust security practices in industrial control systems, including network segmentation, regular patching, and enhanced authentication mechanisms. The disclosure of these vulnerabilities, along with similar issues in other industrial devices, emphasizes the importance of proactive security assessments in OT environments. Organizations using these devices should prioritize applying the available patches and implementing recommended mitigations to reduce their exposure to potential attacks.

FROM THE MEDIA: The vulnerabilities affect Emerson Rosemount gas chromatograph models GC370XA, GC700XA, and GC1500XA in versions 4.1.5 and prior. Four main flaws were identified, with CVE-2023-46687 being the most severe (CVSS 9.8), allowing unauthenticated remote command execution. Other vulnerabilities permit authentication bypass, access to sensitive information, and denial-of-service conditions. Emerson has released updated firmware to address these issues. The article also mentions similar vulnerabilities discovered in other industrial devices, highlighting a broader trend in OT security concerns.

READ THE STORY:  THN

TeamViewer Credits Network Segmentation for Rebuffing APT29 Attack

Bottom Line Up Front (BLUF): TeamViewer reports that while Russian APT29 (Midnight Blizzard) accessed its corporate network, strong segmentation prevented access to customer data or product environments.

Analyst Comments: This incident highlights the effectiveness of defense-in-depth strategies, particularly network segmentation, in limiting the impact of cyber intrusions. TeamViewer's successful containment of the breach demonstrates the practical value of implementing basic cybersecurity best practices recommended by government agencies. However, the attack on a widely-used remote access tool underscores the ongoing risks associated with such software, which can provide attackers with legitimate system access if compromised. The advisories from NCC Group and H-ISAC emphasize the need for users to maintain vigilance and implement additional security measures, even when vendors claim successful mitigation.

FROM THE MEDIA: TeamViewer stated that APT29 accessed only its internal IT network due to strong segmentation between environments. Industry groups like NCC Group and H-ISAC advised users to remove TeamViewer if possible or implement additional security measures like two-factor authentication. The article notes the historically high stakes for remote access application security, citing previous incidents involving TeamViewer. It emphasizes that the limited impact of this incident demonstrates the value of defense-in-depth techniques.

READ THE STORY:  DarkReading

US Defense Sector Under Attack by China-Backed Hackers, NSA Confirms Ivanti Exploits to Blame

Bottom Line Up Front (BLUF): The US National Security Agency (NSA) has confirmed that China-backed hackers are exploiting vulnerabilities in Ivanti's enterprise VPN application to target the US defense sector.

Analyst Comments: This confirmation from the NSA underscores the significant and ongoing threat posed by state-sponsored cyber actors to critical US defense infrastructure. The targeting of the defense sector, which provides vital equipment and technology to the US military, raises serious national security concerns. The exploitation of VPN vulnerabilities highlights the persistent risks associated with remote access technologies, particularly in high-value sectors. The reported ability of attackers to persist even after factory resets and evade detection tools indicates a sophisticated level of compromise that may be challenging to fully remediate.

FROM THE MEDIA: The NSA confirmed the broad impact of Ivanti product exploits on the US defense sector. Mandiant identified a China-backed group, UNC5325, as actively exploiting Ivanti Connect Secure software vulnerabilities (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893). CISA warned that attackers can remain active even after the device resets and potentially evade Ivanti's integrity checker tool. Akamai reported up to 250,000 daily attacks across over 1,000 customers. Ivanti claims no awareness of successful persistence after implementing recommended security updates and resets.

READ THE STORY:  MSN

Hong Kong's Exclusive Clubs Rocked by Economic Slowdown and Expat Exodus

Bottom Line Up Front (BLUF): TeamViewer detected an "irregularity" in its corporate IT environment, likely indicating a security breach. The company claims customer data and product environments are unaffected, but investigations are ongoing.

Analyst Comments: This trend reflects broader economic challenges facing Hong Kong, including the lingering effects of strict COVID-19 policies and ongoing geopolitical tensions. The decline in club membership values serves as a barometer for the city's changing demographics and economic landscape. The exodus of expatriates and the downsizing of multinational corporations in Hong Kong suggest a potential shift in the city's status as a global financial hub. While the government is attempting to attract wealthy individuals and professionals through various incentives, the continued decline in club membership prices indicates these efforts have yet to fully offset the outflow. This situation may have long-term implications for Hong Kong's business culture and international appeal, potentially necessitating a reimagining of the city's economic strategy to maintain its competitive edge in the region.

FROM THE MEDIA: Membership prices for clubs like Aberdeen Marina Club, Hong Kong Cricket Club, and Kowloon Cricket Club have fallen significantly since early 2023. The American Club faced backlash after asking non-US members to pay up to HK$1.5 million to retain membership. Brokers cite poor economic sentiment, fewer mainland Chinese buyers, and departing multinational companies as reasons for the decline. Hong Kong's economy is forecast to grow 2.6% this year, following a 3.2% expansion last year. The government has restarted a capital investment immigration scheme to attract wealthy individuals.

READ THE STORY:  FT

China's Attacks on U.S. Infrastructure Aren't Going Anywhere

Bottom Line Up Front (BLUF): Nearly a year after the U.S. government first identified the Chinese Volt Typhoon hacking campaign targeting American infrastructure, cybersecurity leaders say the threat remains as significant as ever due to the group's unusual persistence.

Analyst Comments: The ongoing Volt Typhoon campaign highlights the evolving nature of nation-state cyber threats, particularly against critical infrastructure. The group's persistence, despite public exposure and U.S. countermeasures, suggests a high level of strategic importance for these operations from China's perspective. The campaign exploits the fragmented nature of U.S. infrastructure management, highlighting systemic vulnerabilities in America's cyber defenses. This situation underscores the need for improved coordination and resource allocation across critical infrastructure sectors. The continued threat also reflects broader geopolitical tensions between the U.S. and China, particularly regarding Taiwan.

FROM THE MEDIA: Volt Typhoon has been targeting U.S. infrastructure like electric grids, shipping ports, and water systems for at least five years. The group uses relatively common hacking tactics but stands out due to its persistence and the fragmented nature of U.S. infrastructure defenses. CISA Director Jen Easterly noted that Volt Typhoon hasn't changed its behavior despite U.S. efforts. Experts suggest the threat is likely to continue as long as U.S.-China tensions persist, especially regarding Taiwan. Federal agencies recommend operators implement basic security measures like multifactor authentication and automated threat detection.

READ THE STORY:  Natto Thoughts // Axios

Hackers Created 250 npm Packages, Mimicking Popular AWS And Microsoft Projects

Bottom Line Up Front (BLUF): Sonatype security researchers discovered over 250 malicious npm packages mimicking popular AWS, Microsoft, and other open-source projects, created by a Russian hacker claiming to be a bug bounty hunter.

Analyst Comments: This incident highlights the ongoing vulnerabilities in the open-source software supply chain, particularly in package management systems like npm. The creation of malicious packages mimicking legitimate, popular projects demonstrates a sophisticated approach to compromising developer environments and potentially injecting malicious code into a wide range of applications. The attacker's claim of being a bug bounty hunter raises concerns about the ethical boundaries in cybersecurity research and the potential for misuse of "security testing" as a cover for malicious activities. The sale of these exploits on Telegram further blurs the line between research and cybercrime. This case underscores the need for improved vetting processes in package repositories, enhanced developer awareness about supply chain risks, and more robust mechanisms for distinguishing between legitimate security research and malicious activities in the open-source ecosystem.

FROM THE MEDIA: Sonatype researchers identified 260 npm packages imitating Microsoft, Amazon, and other legitimate libraries. These packages contained reverse shell and remote code execution payloads, as well as dependency confusion exploits. The packages were released shortly after official versions of the mimicked projects. The Russian hacker responsible was selling the exploits on Telegram. The incident, named sonatype-2024-2066, follows similar attacks on PyPI, indicating a pattern of threat actors exploiting open-source registries for broad-based attacks.

READ THE STORY:  CSN

Items of interest

Microsoft CEO of AI: Your Online Content is 'Freeware' Fodder for Training Models

Bottom Line Up Front (BLUF): Mustafa Suleyman, CEO of Microsoft AI, claimed that most online content is "freeware" that can be used to train AI models while acknowledging legal challenges from content creators with corporate backing.

Analyst Comments: This statement from a high-level Microsoft executive highlights the ongoing tension between AI companies and content creators over the use of publicly available data for AI training. Suleyman's characterization of online content as "freeware" is likely to further inflame concerns about intellectual property rights in the digital age. His distinction between individual content and that backed by corporate lawyers underscores the power imbalance in this debate. The numerous lawsuits mentioned in the article indicate that this issue is far from settled legally or ethically. This situation emphasizes the urgent need for clearer regulations and policies regarding AI training data and intellectual property rights. The potential chilling effect on content creation, as creators may become reluctant to share work online, could have significant implications for the future of both the Internet and AI development.

FROM THE MEDIA: Suleyman stated that content on the open web has been considered "fair use" since the 1990s, but acknowledged a "gray area" for content explicitly protected by publishers. Several lawsuits against AI companies like OpenAI and Microsoft over the unauthorized use of content for AI training were mentioned. Legal experts suggest current laws are inadequate to address these issues, calling for new legislation. The article notes that individuals posting online may have compromised their rights through platform Terms of Service agreements, while major publishers with legal teams can negotiate content deals with AI companies.

READ THE STORY:  The Register

How ChatGPT Works Technically | ChatGPT Architecture (Video)

FROM THE MEDIA: The video "How ChatGPT Works Technically | ChatGPT Architecture" provides an in-depth explanation of the architecture, mechanisms, and processes underlying ChatGPT, highlighting its model structure, training methods, and operational functionalities.

ChatGPT Explained Completely (Video)

FROM THE MEDIA: The video "ChatGPT Explained Completely" offers a thorough explanation of ChatGPT's mechanisms, covering its architecture, training processes, and practical applications.

The stories selected cover a broad array of cyber threats and are intended to aid readers in framing key publicly discussed threats and overall situational awareness. InfoDom Securities does not endorse any third-party claims made in their original material or related links on their sites; the opinions expressed by third parties are theirs alone. For further questions, please contact InfoDom Securities at dominanceinformation@gmail.com.