Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol

0:03A major vulnerability has been found in the ancient TACAX Plus networking protocol. Australia's Prime Minister claims an OpenAI agent hacked the country's Medicare website. OpenAI gives Ukraine access to its Daybreak Cyber Defence Program. And the UK will establish an Anti-Disinformation Centre. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 25th of September and this podcast episode is brought to you by SpectreOps. In today's top story, a major vulnerability has been found in TACX Plus, a 33-year-old protocol that manages authentication on networking hardware.

0:47The vulnerability is a pre-authentication remote code execution attack against TACX Plus authentication servers. The bug can be exploited over the internet, even if the targeted servers are behind edge equipment and not directly exposed online. Cisco released the TAC Axe Plus protocol in 1993. It's still present in products found in almost all large enterprises, ISPs, data centres and cloud providers. The vulnerability was discovered by Eltham Security in Australia. In other news, an OpenAI agent gained unauthorised access to an Australian Medicare portal earlier this year, according to the country's Prime Minister, Anthony Albanese.

1:31The agent was allegedly conducting research into public medical spending, bypassed the portal's defences and accessed public and non-public files. OpenAI notified the Australian government of the incident on September 10, three months after it happened. Officials are investigating what was accessed. Meanwhile, OpenAI agents attempted to hack into at least three websites earlier this year before the RubyGems and Hugging Face incidents. According to non-profit AI research lab Transluse, the agents abused URLQuery.net to bypass site protections and exploit security vulnerabilities. Targets included the public government archive site DataUSA, the University of New Mexico's Digital Library and the Australian Institute of Health and Welfare.

2:21A new hacking group claims to have stolen sensitive data from Australian graphic design software company Canva. The group, calling itself the Seven Deadly Sins, allegedly breached Canva's Salesforce account in late August. The group is now trying to extort the company. This is Canva's second breach after hackers stole the personal data of 139 million of its users in 2019. Hackers breached onboard systems of a Liberian-flagged LNG cargo ship, forcing it to dock in a Spanish port. The hackers allegedly compromised systems for controlling tank pressures, safety valves and boil-off gas management.

3:00The ship loaded LNG in New Orleans and was headed to a port in Italy. This is the third cyber incident involving oil and gas tankers to be disclosed this month. The FBI and US Coast Guard recently revealed they had boarded two vessels in the Gulf of Mexico to investigate alleged cyber attacks. The Shiny Hunters hacking group has released a sample of data stolen from FBI systems this month. The group published a 5 ,000-line spreadsheet containing details about FBI employees working on various operations, including drug cartels, cyber, China and Russia. The hackers have demanded the FBI alter a security alert about Shiny Hunters that the group says is inaccurate.

3:45The group gave the FBI seven days to make the correction. That deadline expires in three days. OpenAI has granted Ukraine's government access to its Daybreak AI Cyber Defence Program to help the country protect its critical infrastructure from cyber attacks. The program gives cyber defenders access to advanced AI models to automate cyber defence work. The move comes as Russian hacking groups are increasing their use of AI for attacks on Ukrainian organisations. France, Germany, Poland and the EU Cybersecurity Agency also have access to Daybreak. Democratic US Senator Ed Markey has introduced a bill to establish an independent board that would investigate major cybersecurity incidents, including AI-related hacks.

4:34If passed, the legislation would grant the new Cybersecurity and AI Board of Investigations subpoena authority, similar to the National Transportation Safety Board. The board would investigate hacks of U.S. critical infrastructure and security incidents caused by AI agents. The previous Cyber Safety Review Board was killed off by the second Trump administration. U.S. lawmakers have introduced a bill to create a voluntary framework for strengthening telecommunications cybersecurity. The framework would be developed by experts from the government and the private sector. The bill aims to improve the sector's readiness and defences against salt typhoon-style hacks.

5:16The UK will establish a new centre to counter foreign disinformation operations. The new centre will detect, attribute and disrupt disinformation campaigns that target British audiences. British Prime Minister Andy Burnham says the centre will also help other countries if needed. The CEO of a digital forensics company has been arrested in the US for lying to the government about its ownership when applying for government contracts. Oxygen Forensics Chief Executive Lee Reiber was arrested in Idaho on Sunday. The DOJ says the US-based company was actually owned by five Russian nationals and its software was developed in Russia.

5:56The agency has seized the company's domains and service, one Russian owner, Oleg Sergeyevich Davidov, has also been arrested in London. Oxygen had contracts with the Pentagon, Homeland Security Investigations and the US Secret Service. Latvian authorities have arrested a 23-year-old man for hacking two local companies. The suspect exploited bugs in public websites, stole sensitive data and tried to extort the companies for ransoms. One victim has been identified as Device Repair Company, TSC. An Armenian man has been sentenced to two years in a U.S. prison over his role with the Ryuk ransomware gang.

6:39Karin Sarobovich Vardinyan was arrested in Ukraine and extradited to the U.S. last year. He was a member of the Ryuk gang between 2019 and 2020. He used the hacker name Monikin. A Brooklyn man has been sentenced to 12 years in a US prison for stealing almost$16 million worth of cryptocurrency from Coinbase users. Ronald Spector posed as Coinbase support to trick victims into moving their crypto to crypto wallets he controlled. He scammed about 100 Coinbase customers. Investigators linked his home IP addresses to wallets that received the stolen crypto. Spectre lost$6 million of the stolen money to crypto gambling.

7:23A Kosovo national has pleaded guilty in the US to running the Ridox cybercrime marketplace. Ardit Kutleshi created and operated the illicit marketplace where users could buy and sell stolen personal information. The FBI seized Ridox and arrested Kutleshi in Kosovo in December 2024. He was extradited to the US the following year. A threat actor is using open source AI tools to hack online retailers at scale and deploy card-stealing skimmer scripts. According to Gambit Security, the hacker has breached at least 27 companies and stolen more than 600 ,000 credit card records. The attacker used CAN, Hermes and Strix AI to run the attacks with minimal oversight.

8:08The tools were configured using Chinese language prompts. Google has removed a cluster of Chrome extensions from the web store that hijacked users' browsers into a web scraping botnet. The extensions contained versions of Melotel, an SDK for sharing internet bandwidth. Security firm Spur says the number of Melotel proxy nodes fell from 90 ,000 to 18 ,000 after Google's action. Extensions that removed the SDK were allowed back on the web store. A threat actor has taken over the third-party.com domain to deploy malware via click-fix attacks. The domain is a popular placeholder URL used in the documentation of lots of tools and libraries.

8:54According to Manifold Security, users who landed on the site were prompted to copy-paste malicious PowerShell commands that installed malware on their systems. The malicious click-fix prompt is still live, but the domain has been added to most browser block lists. A threat actor used an AI agent to build a botnet from hacked Docker servers. The attacker used the Hermes AI to automate scans for exposed Docker systems, compromised servers, and spread to internal networks. Security firm ThreatDown discovered the operation after the threat actor exposed their own files via one of the Docker servers.

9:30The files suggest the botnet's operator is based in Costa Rica. A new Android banking trojan named RemControl is targeting banking customers in Canada, the Middle East and Western Europe. According to security firm Group IB, some of the trojan's infrastructure was coded using AI tools. RemControl's developers tricked the AI coding assistant by saying they were creating a parental monitoring application, but use the code for the Trojans' phishing overlays and backend servers. Threat actors began exploiting a WordPress vulnerability hours after a patch was released on Tuesday. The bug is an unauthenticated path traversal that can lead to remote code execution.

10:13All WordPress versions released in the last decade are vulnerable. And finally, Canonical is switching the Ubuntu Linux operating system from a four-week to a two-week release cycle. The company says the shorter release cycle will allow it to patch security flaws faster. Canonical says the use of AI security tools has led to an explosion in the number of reported and patched vulnerabilities. And that is all for this podcast edition. Today's show was brought to you by our sponsor, SpecterOps. Find them at specterops.io. Thanks for your company. Music Music Music Music