Risky Bulletin: Spyware chip found in Ledger crypto-wallets

0:11nd Dutch-owned supermarkets go offline in multiple countries following a cyber attack, and the EU wants smart glasses to beep loudly when they're recording. This is the Risky Bulletin, prepared by Catalan Kempanu and read by me, Claire Aird. Today is the 14th of October, and this podcast episode is brought to you by cloud security company Prowler. In today's top story, hardware crypto wallet maker Ledger has confirmed a spy chip was found in Nano X wallets sold by a Southeast Asian reseller. Ledger has urged customers to replace devices bought from that company, Cryptobilis. The chip was placed between the crypto secure element and the screen.

0:56It intercepted wallet seed phrases shown on the screen and sent them to a remote attacker. The hackers then used the seed phrases to empty cryptocurrency accounts. The backdoor devices have been linked to the theft of more than$86 million in cryptocurrency. In other news, a threat actor hacked the freezers and refrigerators at hundreds of French supermarkets and raised their temperatures. The incident took place on Sunday night and is estimated to have caused tens of millions of euros in food stock damages. The attack targeted Danfoss freezer and refrigerator controllers. Most of the affected units were owned by a French hypermarket chain, Enter Marchais, but other companies also reported issues.

1:41Danfoss says the hackers targeted devices that ran outdated firmware. Security researchers also discovered the affected fridges were running online and were using default credentials. Meantime, supermarket chains owned by the Dutch Aarhol Delhaes Group have gone offline in multiple countries following a cyber attack. The attack took place on the weekend and has primarily impacted a system used to handle online orders. Affected chains include Foodline and Stop and Shop in the US, Albert Hain, Atos and Goal & Goal in the Netherlands, Delhaize in Belgium, and Profi and Mega Image in Romania. A threat actor has stolen the data of more than 1 ,500 American Meta employees from the company's GitHub repositories.

2:28The hackers also stole some of the company's source code in the breach, which took place last month. Meta says the intruder used an employee's credentials to access the repos. The company is notifying affected employees. The US government says Chinese hackers hacked its embassy in Fiji. The hackers maintained access to the embassy's network between July and August this year. The embassy notified the Fijian government of the breach and provided technical details to help it investigate other possible intrusions. The White House has reinstated the UK government's access to the latest American AI models.

3:08The US cut off the UK's AI Security Institute last month after some models escaped the organisation's testing environment. The AISI is one of the most proficient and respected AI model testing organisations. EU privacy regulators want smart glasses sold in Europe to make loud sounds when taking pictures or recording video. According to a set of recommendations published this week, smart glasses should also send a Bluetooth signal when a recording starts. That signal could be used by nearby phones to alert users that they're being recorded. French authorities have arrested three teenagers who operated a platform that lets users search hacked and stolen data.

3:51The Reacher service launched in March but rebranded to Strikes in June. Paying subscribers were given access to more than 730 million records. The available data included names, home addresses, bank account details and vehicle registration information. Law enforcement agencies arrested 28 individuals linked to cyber scam operations as part of a multinational operation. The suspects were detained last week in Ghana and Nigeria during the operation, which was led by US and UK authorities. authorities. Officials say they acted on data collected and shared by tech companies. Authorities also seized$11 million.

4:32Tech companies collectively suspended more than 3.7 million accounts and groups that were used in the scams. Docker has patched a vulnerability in the hub portal that hosts free container images. The bug could have allowed threat actors to hijack user accounts and upload malicious Docker containers. The vulnerability exposed users' account tokens when they converted personal accounts into organization accounts. Docker says it's notified a limited number of users who converted their accounts while the bug was active. Avanti has released a security update to patch a zero-day in its Connect Secure VPN devices.

5:13The vulnerability is an authentication bypass and remote code execution bug that allows attackers to run malicious code on the devices. Security firm Velexity linked the zero-day campaign to a group it tracks as UTA 0576. The company says the hackers used the bug to pivot from the VPN to internal networks, where they stole Active Directory credentials and secrets, lapse passwords and BitLocker recovery keys. Security firm Anlab has linked North Korean hacking group Kimsuki to two ransomware strains, Endpoint and Funhaus. Endpoint was deployed early this year and Funhouse around September. Both are linear versions of the older Midnight Strain, which has been linked to previous DPRK operations.

6:04And finally, detections of the Xworm InfoSteeler have quadrupled this year as the malware became more sophisticated. According to security firm Netscope, Xworm creators released four new versions and 11 plugins that expanded the malware's capabilities. Xworm now includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module, making it closer to a spyware strain than an infostealer. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Prowler. Find them at prowler.com. Thanks for your company.